HOLY CRAP. just decompiled the wyze android app. There are references to ihealth and I found that same R1, R2 encryption/authentication thing. I think they are LITERALLY the same device under the hood.
@@ytadmin LOL you got me excited for a second. Unfortunately, they only have one device in scope for their BB program and its not their scale. Just ordered the Wyze scale and will do a video on it 😁
@@mattbrwn we have a brand called etekcity, I wouldn't be surprised if they're ALL exactly the same. I remember we used to buy LiPo chargers from China, the same exact charger, but probably I had 20 different brands. At this point, they're out of naming ideas so Amazon is full of brands like XUIKLUIFII, FAKFAKLING, BALPOVER, etc. 🤓
Nice one, mate. Not only did you hack it, but you opened it up so people with that device can use it without the android app. That is genuinely useful and beneficial
You make such good videos, this is one of my new favorite channels. You look so genuinely stoked to be explaining what you've found and unraveled and it's definitely contagious. I get the same giddy feeling any time my digging unearths something interesting. That feeling of looking inside the black box and poking around is super unique and you capture it in all your vids. Appreciate you sharing, take care Matt
IoT thing has bad security = who could have know Chinese medical health IoT thing has bad security = who could have known They should have their license reviewed/revoked for not responding the security issues. :) Love your stuff!
Man very inspiring. But i noticed that is a bug in you decrypt script because at min 39:29 we can see body_bulding is 0.😊 Nice you are inspiring people and this kind of work is pushing companies to make better products and consumers to choose better products. Keep going.
To get BLE logs without the errors: `logcat -d | awk '{ if ($5!="E") print }' | grep -i ble` Just the errors: `logcat -d | awk '{ if ($5=="E") print }' | grep -i ble`
@@vextech I saw a few comments that looked like they supported it. Must be their "special" format I have no interest of researching or learning. We got standards for a reason but they wanna be a difficult kind of special cuz "bunch'o overpriced paper professionals work here & we makin $£€₿¥, so we right no matter how stupid it is".
@@vextech The amount of paid professional programmers I know that can't make their way thru a 400 line project on git is too damn high. One got me into crypto because he was having problems compiling & configuring his mining rig. He majored in Computer Science with a minor in Mathematics. He stuck on a paycheck when he could code up one of his ideas and make a few $milli. I saw a few of his ideas done by someone else and they ran the money up like their name was Bigboy Baggit.
Matt, thank you for being our eyes going through the Java packets to figure out the complete protocol paths. I am now on the edge of removing SmartTrack app that connects to my BT scale! Looking forward to the next episode after the IHealth binge! 😅🎉
I was just at my hackerspace yesterday where our primary volunteer dev was poking through our code and noticed that a path that really doesn't matter - the edge rfid controller telling the server 'hey I saw xyz card uuid' - was unauthenticated. In theory, someone could via wifi tell the server that a card was seen. It wouldn't unlock the door, it would only log that that card's user was seen recently. ...and it was immediately patched. (the doors were one of the first things built, and by someone else...so there is some sloppy security there. the rest is encrypted.
Super cool video! Will be sharing it with my colleagues 🎉 Ive often found that you can copy paste the jadx decompiled output to build your own client/server if for whatever reason rebuilding it in a different language would take too long.
This is a excellent video on reversing non-BT protocol level crypto via the mobile app. I was looking at a smart Bluetooth scale last year & found out it wasn't encrypting anything and sent stuff like Age, Gender, Height data in cleartext over the air
Hilariously thats what PANs are for. Personal Area Network. Literally expressly meant to centralize your 'medical' and 'personal accessories' like year buds under one relatively secure roof. Of course, even though its based on a bluetooth layer for communication, none of the companies have figured out a way to trick people into a faux walled garden of proprietary sounding software, so they just copy paste the same old BT libraries and its off to the races.... The protocols exist, they're just either bastardized or ignored because they cant squeeze a profit channel from it....
Your videos are really interesting and informative and teach a lot about hardware hacking. The hardcoded credentials even in 2024 are a real problem... they could simply generate a hash from the name that the user creates, and then encrypt the traffic to send with the hash. By the way the 'double way' authentication is called mTLS, but I knew that it was used mainly in microservice architectures with kubernetes for example. Also, you are getting me more and more interested in actually giving a chance to Python. I really prefer to write in C, but when sending data over the network, python is less lines of code to write, and less time used overall.
I've been watching your video's non-stop since I discovered your channel. Very inspirational! I'm looking forward to future content. If I may ask: is there a device you'd recommend for a total beginner to get started with? I've even tried looking for purpose-built boards, but that doesn't really seem to be a thing.
Hey Matt. thank you for your effort and videos. i really like to watch them and maybe also do a little bit of iot hacking when i have some time left. when you find some vulnerabilities are they new CVEs? i mean do you then register the CVEs in your name or is that not a topic of your hacking?
@@mattbrwn and it's getting worse with all those script kiddies finding non-issues (like CVE-2023-34585) or those now using AI that hallucinate things.
Comments about Wyze, woozy, and low Energy rainbow tables have become my favorite way to wake up Mondays. *That said nearly everything just edits a git repo and book diggity Shenjhau express* 🚂 SL SL SL
R1_stroke likely refers to a way of writing that it's after the "encryption" round and is likely writen that way to write the " R1ʼ " or the R1 with a bar over both the R and 1 ways of writing the same thing. This is a common practice in the math/programming world for cryptography functions. The R1_stroke would then likely be named something closer to R1_prime but maybe there was a translation thing happening there or perhaps they didn't want to confuse themselves with the way a public key algorithm like RSA uses primes. Interesting video and the above are just my thoughts on something trivial in the video that ultimately doesn't matter for the reversing or security points made here.
@@mattbrwn i actually saw it a few minutes in the video when you started using the phone but for sure thank you for sharing the name of the program, you are awesome! 🙌
Hi Matt, great video about reverse engineering. I wonder whether it would be possible to do the same for the Piper Security Systems which have been becoming obsolete a couple of months ago after the company decommissioned their service. I guess a lot of people (me included) would be grateful if their would be a way to run those cameras without requiring Piper servers.
You need to buff up :D Seriously tho, great video and as always, I hope everyone learned something :) I want to do something like this myself :P Maybe some series about other side - how to design secure IoT devices?
I'd imagine that you probably didn't just sit down in a single class to learn everything you know, so how did you come to know so much? Are you self-taught or did you take a small class, and it just grew from there over time?
For now it's a personal data problem. If you can fake the scale, and feed erroneous data back to the app for potential use by a doctor, who then uses it for the prescribing of medication, then you have a more serious and potentially dangerous problem. It may be difficult to keep up consistent bad data for a set of scales, but not impossible. Thankfully it's not a critical to life medical device.
Bro, how long the process of this RND. From start till end, took how many days? I just asking to see the feasible or standard timeline if this translate to the project.
Most of the time its not their product, it just has their branding on it for this market. You gotta find the factory district that made it and try to get ahold of a dev there
Is the Shopify website builder the new 5-minute wordpress templates for e-commerce sites? :D Also; you just put your feet on the Internet. So, yeah, that's going to be out there forever now.
I have a scale that looks exactly the same, but the center piece is round instead of square and the rectangular screen is vertical instead of horizontal. Wonder if this will work on mine too. The brand is Posture.
Bro, could you please try to hack an Amazon Echo show 5 2 Gen. These devices run on Android and if you could make a video how you find out what the bootloader code is or enable Adb that would be very helpful. The problem is that the Android is very locked down.
See how the Japanese do it - Omron have app connected medical devices too. I know there are 3rd party apps (such as MedM health) which can interrogate them. But unofficially.
I have the Wyze version
HOLY CRAP. just decompiled the wyze android app. There are references to ihealth and I found that same R1, R2 encryption/authentication thing. I think they are LITERALLY the same device under the hood.
@@mattbrwn Get that wyze bug bounty money!
@@ytadmin LOL you got me excited for a second. Unfortunately, they only have one device in scope for their BB program and its not their scale. Just ordered the Wyze scale and will do a video on it 😁
@@mattbrwn we have a brand called etekcity, I wouldn't be surprised if they're ALL exactly the same. I remember we used to buy LiPo chargers from China, the same exact charger, but probably I had 20 different brands. At this point, they're out of naming ideas so Amazon is full of brands like XUIKLUIFII, FAKFAKLING, BALPOVER, etc. 🤓
"do they respond to my emails about security vulnerabilities in their products, ofcourse they dont" every IOT company ever 😂
"S" in IoT stands for Security
AmoguS
It stands for SHiot
Matt Brown. 28 years in look, 48 years of experience.
LOL I might have lied on some of that data... I also might not be 7 foot tall
@@mattbrwn Just exceptional work Matt. Very few even with 20 years of experience in engineering can explain things as you do. Just love it.
Nice one, mate. Not only did you hack it, but you opened it up so people with that device can use it without the android app. That is genuinely useful and beneficial
You make such good videos, this is one of my new favorite channels. You look so genuinely stoked to be explaining what you've found and unraveled and it's definitely contagious. I get the same giddy feeling any time my digging unearths something interesting. That feeling of looking inside the black box and poking around is super unique and you capture it in all your vids. Appreciate you sharing, take care Matt
this man explains it so well. Learned so much in the past 3 months
IoT thing has bad security = who could have know
Chinese medical health IoT thing has bad security = who could have known
They should have their license reviewed/revoked for not responding the security issues.
:) Love your stuff!
The "S" in IoT stands for security. Great work, really interesting video.
Man very inspiring. But i noticed that is a bug in you decrypt script because at min 39:29 we can see body_bulding is 0.😊 Nice you are inspiring people and this kind of work is pushing companies to make better products and consumers to choose better products. Keep going.
body_bulding = 0
yeah clearly a flawed device.
To get BLE logs without the errors:
`logcat -d | awk '{ if ($5!="E") print }' | grep -i ble`
Just the errors:
`logcat -d | awk '{ if ($5=="E") print }' | grep -i ble`
@@vextech I saw a few comments that looked like they supported it. Must be their "special" format I have no interest of researching or learning.
We got standards for a reason but they wanna be a difficult kind of special cuz "bunch'o overpriced paper professionals work here & we makin $£€₿¥, so we right no matter how stupid it is".
@@vextech The amount of paid professional programmers I know that can't make their way thru a 400 line project on git is too damn high. One got me into crypto because he was having problems compiling & configuring his mining rig. He majored in Computer Science with a minor in Mathematics.
He stuck on a paycheck when he could code up one of his ideas and make a few $milli. I saw a few of his ideas done by someone else and they ran the money up like their name was Bigboy Baggit.
This is amazing Matt! I love watching your videos :)
Matt, thank you for being our eyes going through the Java packets to figure out the complete protocol paths. I am now on the edge of removing SmartTrack app that connects to my BT scale!
Looking forward to the next episode after the IHealth binge! 😅🎉
I was just at my hackerspace yesterday where our primary volunteer dev was poking through our code and noticed that a path that really doesn't matter - the edge rfid controller telling the server 'hey I saw xyz card uuid' - was unauthenticated. In theory, someone could via wifi tell the server that a card was seen. It wouldn't unlock the door, it would only log that that card's user was seen recently. ...and it was immediately patched. (the doors were one of the first things built, and by someone else...so there is some sloppy security there. the rest is encrypted.
Man! This is really good video!
Incredible! Thanks, both for the video and the large amount of work that it took to reverse engineer this. Well Done!
Keep it up!!! Love all these vids recently!!!
Super cool video! Will be sharing it with my colleagues 🎉
Ive often found that you can copy paste the jadx decompiled output to build your own client/server if for whatever reason rebuilding it in a different language would take too long.
This is a excellent video on reversing non-BT protocol level crypto via the mobile app. I was looking at a smart Bluetooth scale last year & found out it wasn't encrypting anything and sent stuff like Age, Gender, Height data in cleartext over the air
I don't think IoT and Health belong in the same sentence.
Hilariously thats what PANs are for. Personal Area Network. Literally expressly meant to centralize your 'medical' and 'personal accessories' like year buds under one relatively secure roof. Of course, even though its based on a bluetooth layer for communication, none of the companies have figured out a way to trick people into a faux walled garden of proprietary sounding software, so they just copy paste the same old BT libraries and its off to the races....
The protocols exist, they're just either bastardized or ignored because they cant squeeze a profit channel from it....
Your videos are really interesting and informative and teach a lot about hardware hacking. The hardcoded credentials even in 2024 are a real problem... they could simply generate a hash from the name that the user creates, and then encrypt the traffic to send with the hash. By the way the 'double way' authentication is called mTLS, but I knew that it was used mainly in microservice architectures with kubernetes for example. Also, you are getting me more and more interested in actually giving a chance to Python. I really prefer to write in C, but when sending data over the network, python is less lines of code to write, and less time used overall.
I've been watching your video's non-stop since I discovered your channel. Very inspirational! I'm looking forward to future content.
If I may ask: is there a device you'd recommend for a total beginner to get started with? I've even tried looking for purpose-built boards, but that doesn't really seem to be a thing.
another great breakdown!
Great vid, did I spot a reference to the 1990s film Sneakers in the background on the phone at one point?
Hey Matt. thank you for your effort and videos. i really like to watch them and maybe also do a little bit of iot hacking when i have some time left. when you find some vulnerabilities are they new CVEs? i mean do you then register the CVEs in your name or is that not a topic of your hacking?
I don't think its bad for researchers to register CVEs but I personally think that system is largely broken.
@@mattbrwn and it's getting worse with all those script kiddies finding non-issues (like CVE-2023-34585) or those now using AI that hallucinate things.
LOVE YOUR VIDS MAN, REALLY GREAT STUFF
Learning a lot from these videos! They are probably using ”stroke” as a misnomer for "prime". As in R1' = enc(R1)
Comments about Wyze, woozy, and low Energy rainbow tables have become my favorite way to wake up Mondays. *That said nearly everything just edits a git repo and book diggity Shenjhau express* 🚂 SL SL SL
Thanks Matt, I'm curious to see if someone will create some Home Assistant integration based upon your research.
Masterbuilt? I just built mine! can't wait to see that video :D
Solid smoker, but I'm guessing the tech might have some vulns...
R1_stroke likely refers to a way of writing that it's after the "encryption" round and is likely writen that way to write the " R1ʼ " or the R1 with a bar over both the R and 1 ways of writing the same thing. This is a common practice in the math/programming world for cryptography functions. The R1_stroke would then likely be named something closer to R1_prime but maybe there was a translation thing happening there or perhaps they didn't want to confuse themselves with the way a public key algorithm like RSA uses primes. Interesting video and the above are just my thoughts on something trivial in the video that ultimately doesn't matter for the reversing or security points made here.
Did you use Google's android emulator to run the app on your machine?
No. I was running that app on a real phone (emulator can't do BLE). Was using a program called scrcpy to view the phone on my computer.
@@mattbrwn i actually saw it a few minutes in the video when you started using the phone but for sure thank you for sharing the name of the program, you are awesome! 🙌
I just love this stuff. It tickles just the right spot without me having to actually spend the time myself 😅
❤from The Netherlands.
Hi Matt, great video about reverse engineering. I wonder whether it would be possible to do the same for the Piper Security Systems which have been becoming obsolete a couple of months ago after the company decommissioned their service. I guess a lot of people (me included) would be grateful if their would be a way to run those cameras without requiring Piper servers.
I actually LOLed at this. Can't help because of reasons... Look me up on LinkedIn and you'll see ;)
@@mattbrwn ups, I understand - actually that wouldn't be a reverse engineering as you probably have all the info needed
You need to buff up :D
Seriously tho, great video and as always, I hope everyone learned something :)
I want to do something like this myself :P
Maybe some series about other side - how to design secure IoT devices?
I'd imagine that you probably didn't just sit down in a single class to learn everything you know, so how did you come to know so much? Are you self-taught or did you take a small class, and it just grew from there over time?
Definitely Collecting Data of Average Weight, Height, Age, Ethnicity, Gender of The American Citizen.
For now it's a personal data problem. If you can fake the scale, and feed erroneous data back to the app for potential use by a doctor, who then uses it for the prescribing of medication, then you have a more serious and potentially dangerous problem. It may be difficult to keep up consistent bad data for a set of scales, but not impossible. Thankfully it's not a critical to life medical device.
Is it 'stroke' as an analogue to a line being drawn through the plaintext?
Bro, how long the process of this RND. From start till end, took how many days? I just asking to see the feasible or standard timeline if this translate to the project.
Solid 3 days of focused RE.
Brilliant well done
Most of the time its not their product, it just has their branding on it for this market. You gotta find the factory district that made it and try to get ahold of a dev there
Is the Shopify website builder the new 5-minute wordpress templates for e-commerce sites? :D
Also; you just put your feet on the Internet. So, yeah, that's going to be out there forever now.
I have a scale that looks exactly the same, but the center piece is round instead of square and the rectangular screen is vertical instead of horizontal. Wonder if this will work on mine too. The brand is Posture.
Is it possible to do the same thing to a smart bracelet?
Bro, could you please try to hack an Amazon Echo show 5 2 Gen. These devices run on Android and if you could make a video how you find out what the bootloader code is or enable Adb that would be very helpful. The problem is that the Android is very locked down.
Lets hack it to weigh megabytes then show, in weight, your network throughput. :)
But the name starts with a lower case "i" so it MUST be good, right?
Here we go again !
See how the Japanese do it - Omron have app connected medical devices too. I know there are 3rd party apps (such as MedM health) which can interrogate them. But unofficially.
It would be wonderful if you show us a reverse engineering project that you failed because of good security practices
Is @mattbrown really 7 feet (213cm) tall?! 😲 (see 4:00 and 39:30)
that's insane.. now hack another IoT device and Modify to steal wifi password or another scary stuff. You can
Can you do the same for the Chinese crap Deeper Network (Decentralized VPN) as per they claim.
I was not able to do this
For the source code viewing using jadx-gui may be easier to track down xrefs definitions
"Bluetooth logs sent over a wire" xdd
I call BS on the 7' in the app.
Damn. I have the withings 😂
that scale looks VERY similar to the one I have...
学习了
Wow