Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flume Water Monitor 915 MHz Security Is Pretty Good

waveformsecurity.com

Post reply on HN
Print view View original

11–20 of 38 posts

Re: Flume Water Monitor 915 MHz Security Is Pretty Good

#11

Post by elmoret »

Ductapemaster wrote: post #3

Interesting timing, I have spent the last week with Claude reverse engineering the on-air protocol and I'm getting pretty close to building a secondary "listener" receiver that will collect measurements from my bridge + sensor pair locally. To Flume's credit, it required me to dump the firmware from the bridge device's ESP8266 in order to extract my key. I didn't consider an approach like this article took, given I h…

If you document this somewhere I'd love to read about it! I took the approach of sniffing the packets between the radio and mcu on the bridge board, got most of the way into reverse engineering that, then helped build this instead:

https://github.com/tronikos/esphome-magnetometer-water-gas-m...

But I always wanted to finish pulling flume data to home assistant, without the cloud.

Re: Flume Water Monitor 915 MHz Security Is Pretty Good

#12

Post by sedatk »

nabilt wrote: post #7

So if I understand correctly, they used hard coded constants to generate keys that only have 44 bits of entropy, which is brute forcible for $10, but you have to do it per device. They presumably did this to make pairing the bridge and sensor easier while not using a static key for all devices. Not the worst compromise I guess. I've been working on an open source solution on and off for a number of years called http:…

> is probably going to use LoRa

why not Zigbee or Thread?

Re: Flume Water Monitor 915 MHz Security Is Pretty Good

#14

Post by nabilt »

sedatk wrote: post #12
nabilt wrote: post #7

So if I understand correctly, they used hard coded constants to generate keys that only have 44 bits of entropy, which is brute forcible for $10, but you have to do it per device. They presumably did this to make pairing the bridge and sensor easier while not using a static key for all devices. Not the worst compromise I guess. I've been working on an open source solution on and off for a number of years called http:…

> is probably going to use LoRa why not Zigbee or Thread?

I think most ZigBee and Thread chips use 2.4 GHz which limits distance. A lot of water meters are underground on the front yard somewhere so sub gigahertz radio would penetrate better. The modulation scheme of LoRa also allows for greater distance at the cost of data rate. It's also super low power.

Re: Flume Water Monitor 915 MHz Security Is Pretty Good

#15

Post by Oliveaniss »

ivlad wrote: post #4
Oliveaniss wrote: post #2

One thing I appreciate about this kind of research is that it doesn't assume every wireless protocol must end with a catastrophic vulnerability. A result of "the security is actually pretty good" is arguably just as valuable as finding a critical flaw. It helps distinguish between systems that are merely proprietary and those that were designed with a reasonable threat model in mind. I'd be interested to know where t…

44 bits of security is not “pretty good”. The post author used Python, but anything more performant would result almost real-time decryption. There are no performance implications of using a proper 128 key because they are doing AES anyway. If they were resource constrained and choose a variant of TEA encryption due to constraints, it would be understandable, but no, the encryption is implemented in hardware. There a…

[dead]

Re: Flume Water Monitor 915 MHz Security Is Pretty Good

#16

Post by tehlike »

EvanAnderson wrote: post #9

> I reached out to Flume. They were very responsive, and their CTO shared an overview of their already-in-progress plans to further improve the product’s privacy and security. Read: There will be a firmware update that further "secures" the device from owners who would like to use it without the "cloud" and the "app".

We need a law that makes such iot devices local capable, or maybe a rs485/rs233 like interface like in solar panels

Re: Flume Water Monitor 915 MHz Security Is Pretty Good

#17

Post by tehlike »

sedatk wrote: post #12
nabilt wrote: post #7

So if I understand correctly, they used hard coded constants to generate keys that only have 44 bits of entropy, which is brute forcible for $10, but you have to do it per device. They presumably did this to make pairing the bridge and sensor easier while not using a static key for all devices. Not the worst compromise I guess. I've been working on an open source solution on and off for a number of years called http:…

> is probably going to use LoRa why not Zigbee or Thread?

Distance.

Re: Flume Water Monitor 915 MHz Security Is Pretty Good

#18

Post by badatnames »

Oliveaniss wrote: post #2

One thing I appreciate about this kind of research is that it doesn't assume every wireless protocol must end with a catastrophic vulnerability. A result of "the security is actually pretty good" is arguably just as valuable as finding a critical flaw. It helps distinguish between systems that are merely proprietary and those that were designed with a reasonable threat model in mind. I'd be interested to know where t…

> the security is actually pretty good

I had a slightly different read.. their CTO replied directly and in an affirmative manner. It's amazing how the human touch helps align and build understanding. How many of these have you read where it's just a scathing product teardown devoid of any appreciation for any work that's otherwise been put in.

Re: Flume Water Monitor 915 MHz Security Is Pretty Good

#19

Post by br0ceph »

i feel like it doesnt matter how secure the rf transport is, if ultimately ur data gets uploaded to a corporate cloud, and the only way to access it is through some shady cloud app

its a nice experiment, but i wouldnt say the security is good... good security would havr everything documented with sourcecode,user generated keys, and a opensource server/client, whose code can be examined fully

Post reply on HN