← Back to context

Comment by EvanAnderson

3 days ago

> ...looks like they reverse-engineered the nest thermostat and wrote a firmware...

Not to diminish what this project has done, but they modified existing firmware to make it communicate with a different server. They've also implemented a server for the thermostat API.

It's pretty neat but, at this point, it's just a hacked firmware that talks to a different proprietary server.

Edit: It's not even a modification to the firmware binaries. They're just injecting /etc/hosts entries into the firmware[0]. If the Nest device just uses DNS to resolve these names then you wouldn't even need to modify the firmware-- just point it at a DNS server that's authoritative for the necessary names.

[0] https://github.com/codykociemba/NoLongerEvil-Thermostat/issu...

8 comments

EvanAnderson

Reply
forgotusername6  3 days ago

Does it not use TLS? Wouldn't the Nest have to trust a CA willing to issue certificates without proving ownership?

  • EvanAnderson  3 days ago

    They're also injecting a CA bundle so, presumably, they're in including their own root of trust so they can sign their own certificate. I'm on mobile and can't easily look at what they're including.

    Edit: Guess I've got openssl in my termux environment. They're injecting a fake Nest root CA key. Makes sense.

    I'm shocked it was this easy to subvert the root of trust on these devices. I would expect a newer device would have the trust root pinned in hardware (TPM, etc) and firmware updates would be have been authenticated.

    • gruez  3 days ago

      >I would expect a newer device would have the trust root pinned in hardware (TPM, etc) and firmware updates would be have been authenticated.

      All those things cost money in hardware or development time, so companies basically never bother. You're probably also letting all the stories about DRM on phones or whatever color your experience on IOT as a whole. TPM basically makes no sense to implement on anything that's not a PC. Not even phones use it.

      3 replies →

    • tracker1  3 days ago

      I'm glad they didn't go that far... I wouldn't want that to get into a home device as long as it requires physical access to bypass/update the security in place. I'm really not a fan of excessively locked down hardware.