Flume Water Monitor 915 MHz Security Is Pretty Good

The Flume Water Monitor is simply a wide utilized user instrumentality that attaches to a home’s h2o metre and transmits near-real-time usage information to a companion span instrumentality connected the location Wi-Fi network. The span past uploads the information to the cloud, wherever it is accessible via the Flume app. The water-meter-sensor–><–bridge nexus uses a 915 MHz set RF signal. This nexus is encrypted, and I was capable to conclusion the encryption pinch a fewer weeks of part-time effort, aided by the reverse-engineering activity published by Steve Crosby [1]. Here’s a little summary of what I did.

Finding and Demodulating the 915 MHz Band RF Signal

FCC archiving indicates the instrumentality uses a 50-channel frequency-hopping attack successful the 902.5–927 MHz band, pinch 500 kHz transmission separation. I tuned my LimeSDR Mini package defined power to the halfway of the set (using a 20 MHz show bandwidth) and turned connected the faucet. Short-duration (~1 ms) signals pinch ~500 kHz bandwidth were readily visible, arsenic shown below.

Example Frequency Spectrum of Flume RF Message (909 MHz halfway frequency)

After immoderate experimentation, I wished that the awesome uses 2-FSK (Frequency Shift Keying) modulation astatine 200 kbps [2], pinch a information of the ~25-byte messages whitened utilizing an action successful the sensor’s RFM69 transmitter chip. Side note: the whitening series is poorly documented, but I judge it originates pinch FF 87 B8 89… (see [3] for afloat sequence).

The connection building is straightforward:

I validated the Cyclical Redundancy Check CRC-16 values utilizing the generator polynomial 0x1021 (per the chipset documentation) and pinch the first seed and XOR options wished via exhaustive search.

What About the Encrypted Payload?

The 16-byte payload is encrypted successful AES-128 Electronic Codebook (ECB) mode (another RFM69 chipset option). According to the earthy information successful Crosby’s post, the 128-bit cardinal is derived from an 8-byte cardinal utilizing a elemental hardcoded mapping. While 64 bits is still excessively ample to brute-force directly, it turns retired that a subset of the RF connection header bytes (not encrypted) supply different 16 bits of the key. This reduces the hunt abstraction to 48 bits. Adding the presumption (inferred from Crosby’s data) that half of the key’s past byte is simply a known changeless further reduces it to 44 bits.

I brute-forced the remaining 44 chartless bits by testing aggregate messages and looking for consistently low-entropy plaintext (or plaintexts pinch a precocious number of matching bits). An unoptimized Python book connected a decent GPU took astir 1 time (<$10 connected a unreality platform).

Wrapping It Up

For a user h2o sensor, a frequency-hopping waveform mixed pinch 44-bit effective encryption connected the payload is not an unreasonable level of security. That said, location is still immoderate risk: pinch knowledge of the AES key, CRC algorithm, and different parameters, it becomes imaginable to make spoofed messages. These could perchance alteration malicious firmware updates if over-the-air (OTA) updates are supported (I person not investigated this and do not scheme to).

I reached retired to Flume. They were very responsive, and their CTO shared an overview of their already-in-progress plans to further amended the product’s privateness and security. They are now comfortable pinch the merchandise of this post.

[1] (https://lithostech.com/2024/12/diving-into-flume-water-monitor/)

[2] different signals pinch different information rates were besides observed (e.g. upon span reboot)

[3] (https://www.nxp.com/docs/en/application-note/AN5070.pdf)