Reverse-engineering an encrypted IoT protocol #ReverseEngineering #IoT
Scott reverse-engineered the encrypted protocol GoodWe smart meters and solar inverters use to send metrics to the cloud.
The result of my lucky dip was a GoodWe DNS G3 Inverter and a GoodWe HomeKit 1000 Smart Meter. These devices look quite slick, and so does the website. They are also popular here in Australia, so my hopes were high that it would be easy to set up local monitoring, because surely someone else had figured out how to do it.
So Scott went about hacking the system to obtain metrics on energy use locally and see how bad the security is on this “cloud-only based system”. What was found:
Telnet left on in a production firmware image, with credentials admin:admin.
nmap can crash the device hard enough to factory reset.
Packets sent over TCP with identifying data (serial number) in the clear.
The metrics seem to be poorly encrypted (identical section of ciphertext in consecutive frames).
Unauthenticated configuration protocol.
A web UI that looks like it was hacked together in an afternoon. Inspecting the source shows lots of commented out HTML blocks.
And it looks like their AES encryption key is 16 bytes of 0xff!
Check out the very thorough analysis in the post here.
Adafruit publishes a wide range of writing and video content, including interviews and reporting on the maker market and the wider technology world. Our standards page is intended as a guide to best practices that Adafruit uses, as well as an outline of the ethical standards Adafruit aspires to. While Adafruit is not an independent journalistic institution, Adafruit strives to be a fair, informative, and positive voice within the community – check it out here: adafruit.com/editorialstandards
Stop breadboarding and soldering – start making immediately! Adafruit’s Circuit Playground is jam-packed with LEDs, sensors, buttons, alligator clip pads and more. Build projects with Circuit Playground in a few minutes with the drag-and-drop MakeCode programming site, learn computer science using the CS Discoveries class on code.org, jump into CircuitPython to learn Python and hardware together, TinyGO, or even use the Arduino IDE. Circuit Playground Express is the newest and best Circuit Playground board, with support for CircuitPython, MakeCode, and Arduino. It has a powerful processor, 10 NeoPixels, mini speaker, InfraRed receive and transmit, two buttons, a switch, 14 alligator clip pads, and lots of sensors: capacitive touch, IR proximity, temperature, light, motion and sound. A whole wide world of electronics and coding is waiting for you, and it fits in the palm of your hand.
Have an amazing project to share? The Electronics Show and Tell is every Wednesday at 7:30pm ET! To join, head over to YouTube and check out the show’s live chat and our Discord!
Python for Microcontrollers – Adafruit Daily — Python on Microcontrollers Newsletter: Diving into the Raspberry Pi RP2350, Python Survey Results and more! #CircuitPython #Python #micropython @ThePSF @Raspberry_Pi
EYE on NPI – Adafruit Daily — EYE on NPI Maxim’s Himalaya uSLIC Step-Down Power Module #EyeOnNPI @maximintegrated @digikey
