Reverse engineering my Coway air purifier to ditch the cloud
The author documents an epic quest to free a Coway air purifier from its capricious cloud overlords, transforming it into a locally controlled Home Assistant device. This deep technical dive, made remarkably easier by the guiding hand of AI, highlights both the frustrating pitfalls of modern IoT and the empowering potential of reverse engineering.
The Lowdown
Driven by the erratic nature of cloud-dependent IoT and the desire for seamless smart home integration, the author embarked on a journey to liberate his Coway Airmega IconS air purifier. Initially relying on a flaky Home Assistant integration that still routed through Coway's cloud—prone to frequent breakages and even account bans—the goal was to achieve true local control.
His breakthrough hinged on two key factors: a temporary vulnerability in an eMudhra certificate authority (though later found unnecessary for this device) and the potent assistance of AI. LLMs proved instrumental in automating the tedious setup of a man-in-the-middle (MitM) environment and deciphering encrypted communications.
- MitM Discovery: The crucial insight emerged when
mitmproxyrevealed the air purifier downloads its Amazon root CA certificate over plain, unencrypted HTTP. This meant the device could always be MitM-ed without needing advanced certificate forging, asmitmproxycould simply inject its own CA. The AI quickly mapped the fan's MQTT commands by analyzing traffic generated from app interactions. - Bluetooth Provisioning: To eliminate the MitM entirely for future provisioning, the author delved into the device's Bluetooth setup. Leveraging an Android phone's debug logs and a large language model to decompile the Coway app and reconstruct the provisioning protocol, he discovered how the device receives its Wi-Fi credentials and crucial server URLs.
- Local Control Achieved: With this knowledge, the author built a Home Assistant custom integration that provisions the fan directly via Web Bluetooth. This setup allows the device to receive local URLs for its certificates and MQTT server, entirely bypassing Coway's cloud service and bringing it fully under local Home Assistant and Apple Home control.
This intricate reverse engineering feat underscores the increasing ease with which individuals can reclaim ownership of their smart devices, thanks to sophisticated tools and the accelerating capabilities of AI.
The Gossip
AI's Enabling Ascent
Commenters lauded the role of LLMs in democratizing complex reverse engineering, making tasks that once took days or weeks feasible in minutes. Many expressed excitement about AI enabling more users to liberate their hardware from cloud dependencies, while also noting that some LLM providers (like Claude) are more restrictive than others (like ChatGPT) in assisting with such 'cyber' activities. A counter-argument emerged that manufacturers might eventually use AI to harden DRM, leading to a potential future where older, 'hackable' devices become a valuable niche.
Cloud Critiques and Connected Conundrums
A dominant theme was the shared frustration with cloud-dependent IoT devices. Users celebrated the 'device liberation' trend, recounting their own experiences freeing smart home gadgets from manufacturer control. The discussion highlighted the pitfalls of proprietary cloud services: unreliability, forced updates, account bans, and the general lack of longevity and user sovereignty. Many questioned the fundamental need for Wi-Fi in appliances like air purifiers, while others pointed out the convenience of remote control and data monitoring, arguing that the problem lies with poor implementation, not the concept itself.
Air Quality Alternatives & Aesthetics
A significant tangent debated air purification methods. Many commenters championed the 'Corsi-Rosenthal Box'—a DIY solution involving a box fan and multiple MERV filters—as a far more cost-effective and efficient alternative to commercial purifiers, especially for large spaces or wildfire smoke. This sparked a debate on aesthetics vs. function, with some embracing the DIY look and others preferring the sleek design (and higher price) of commercial units like Coway, arguing that the 'ugly homemade' appearance is a non-starter for their living spaces. Another sub-discussion centered on the effectiveness of central HVAC filtration with MERV-13 filters compared to standalone units.
The Peril of Plain HTTP & IoT Insecurity
The discovery that Coway's purifier downloaded its root CA certificate over plain HTTP was a major talking point. Commenters mused about the decision-making behind such a glaring security oversight, attributing it to rushed development, cost-cutting, or a desire for easy certificate updates. This led to a broader discussion on IoT security, with some noting that the eMudhra CA incident served as a 'gift' for white-hat hackers. A nuanced debate emerged about whether downloading *public* certificates over HTTP is inherently insecure (given signature validation), contrasting it with the 'HTTPS everywhere' mentality and the general insecurity baked into many low-cost IoT devices.