Claude refused to help, ChatGPT obliged, and Coway’s app is no longer in control.
a]:text-inherit [&>a]:underline">
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
The fan’s inconsistency had a reason: the IconS has no official HA support, so the route around that relied on a community integration that logs into Coway’s IoCare+ cloud. Coway originally banned the integration for overloading its servers before allowing it after a community dispute. Coway also rebranded its app and cloud from IoCare to IoCare+, which forced a rewrite. Even small HTML layout changes on the pages the integration scraped could break it. On top of that, the company’s servers went offline here and there.
His method involved using the purifier’s security lapse against itself. At setup, it fetches the certificate it trusts over plain, unencrypted HTTP, which can be intercepted and replaced using mitmproxy/mitmweb with nftables port redirection. The request he saw was a plain HTTP GET for AmazonRootCA1.pem from an S3 bucket in AWS’s Seoul region. He then had his proxy serve its own CA to the fan, and the fan made HTTPS requests to Coway’s cert server, which included downloads of a device certificate and private key. Another proxy plugin then swapped his own key into that response.
1994 Jeep Cherokee owner hacks 32-year-old car with Claude AI to pass California smog tests
Developer uses Claude Code to debloat Android smart TV for 'unbelievable' performance upgrade
He had first considered exploiting eMudhra, a certificate authority whose private keys turned out to be trivially weak last month, which would have involved forging a certificate. That wasn’t necessary because of the plain-HTTP download. Self-signed certificates are nothing new to enthusiasts; this just took a little extra work and avoided the eMudhra plan’s reliance on several things lining up.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/dev-hacks-coway-air-purifier-to-cut-it-off-from-the-cloud-now-runs-locally-in-home-assistant-fan-downloads-the-certificate-over-plain-http-letting-a-home-server-stand-in-for-coways#main
- https://futureplc.com/privacy-policy/
- 3D printing dev’s free tool unlocks curved printing along all three axes
- U.S. Treasury Secretary questions whether Nvidia knowingly sold AI GPUs to shell companies, says company itself is responsible
- Elon Musk signs petition to reinstate Jensen Huang as Nvidia CEO
- Researchers allege DeepSeek, Kimi, and other Chinese AI models were trained using banned Nvidia Blackwell GPUs
- How NVIDIA Open Source Tools Are Helping Researchers Build Next-Generation 6G Networks
Informational only. No financial advice. Do your own research.