5 ms·

I am the owner of this rogue washing machine. If anyone has any ideas on how to investigate this, I'm open to ideas. As of now, I've just blocked the internet

by Johnie 3y ago

I am the owner of this rogue washing machine. If anyone has any ideas on how to investigate this, I'm open to ideas. As of now, I've just blocked the internet access.

coupdejarnac 3y ago
Does it stop functioning intermittently? I've seen cases of devices in the middle of a failed OTA, and the device keeps requesting the OTA again. If it's going on and offline often, this might the case.
squarefoot 3y ago
It may be worth sandboxing it into a dedicated network then analyze the traffic and see what it does in detail, for example if it accesses the local network then relays something outside, or if it opens ports waiting for connections, etc. I wonder if merely downloading so much data and storing it into its internal flash could wear it in a short time forcing the user to call for repair.
dilyevsky 3y ago
Have you tried tcpdump’ing its payload on your router? If it’s plain text it should be obvious what it’s doing. If it isn’t you can still sniff which domains it’s connecting to from SNI ClietnHello message but payload will be encrypted. You can still get to it but that would require some decent soldering and hw debugging skills…
pjsg 3y ago
I'd pcap a bunch of the traffic -- in particular the DNS requests -- that will tell you where it is connecting. Hopefully it is using TLS, and then the SNI headers can give you more information. I run a local DNS resolver and so I capture all the lookup responses so that I can turn IP addresses back into names. Depending on what firewall/router you have, you may be able to log connections. I use a locally hosted free Gravwell process to grab these logs and correlate with the DNS queries to find which systems are talking to where. If your home network is like mine, then there are probably a bunch of systems that you want to block from talking outside.
- Johnie 3y ago
  For those interested, you can setup tcpdump on Asus router pretty easily to monitor traffic going through the router. You don't even need to mess with the firmware on the router. 1. Install Entware https://github.com/Entware/Entware/wiki/Install-on-Asus-stock-firmware https://github.com/Entware/Entware/wiki/Install-on-Asus-stoc... 2. Then install tcpdump: `opkg install tcpdump` From there, you can monitor any traffic going through your router.
- Johnie 3y ago
  Right now it looks like it has stopped uploading data. Looking at my router log, the only web history request is: 2024-1-08 19:44:10 LG_Smart_Laundry2_open aic-common.lgthinq.com This was likely after I had removed it from my main wifi and reconnected it to a segregated wifi. I don't see any logs for prior to this point.
  - somerandomqaguy 3y ago
    Might be legit, LG ThinQ is their smart appliance page. And aic-common.lgthinq.com is registered to LG. Genuinely unsure what would be taking that much data though but honestly my first guess is a bug of some kind. Kind of wondering if the App has some sort of issue reporting page on it, might be worth sending in something about it. Might not get a response, it but could get some gears turning on their end behind the scenes.
- runjake 3y ago
  https://gist.github.com/Jonathan727/9ef58e7a64806d1e01112b202cdc14bc https://gist.github.com/Jonathan727/9ef58e7a64806d1e01112b20...
maerF0x0 3y ago
You can have fun with Wireshark https://www.wireshark.org/ https://www.wireshark.org/ Depending on the details in each of the layers[1] you might be able to spoof traffic towards it to trick it things. you may need to try MITM the certs/key exchange stuff[2], hopefully they have a broken implementation that doesnt validate signatures etc. [1]: https://www.bmc.com/blogs/osi-model-7-layers/ https://www.bmc.com/blogs/osi-model-7-layers/ [2]: first promising hit when i googled: https://gbhackers.com/mitm-attack-https-connection-ssl-strip/ https://gbhackers.com/mitm-attack-https-connection-ssl-strip...
- SushiHippie 3y ago
  Looks like the android app at least does certificate pinning https://github.com/zimmra/frida-rootbypass-and-sslunpinning-lg-thinq https://github.com/zimmra/frida-rootbypass-and-sslunpinning-...
omgmajk 3y ago
I wash Really hoping for some wireshark goodness in that thread!
- PlunderBunny 3y ago
  I can’t tell if that typo was a deliberate pun or not.
SushiHippie 3y ago
What software/router do you have, that shows this upload/download graph?
chucklenorris 3y ago
If you have a openwrt router than it should be quite simple. Redirect the traffic from the ip of the washing machine to a machine that has mitmproxy installed (using iptables). Hopefully the protocol is https and it doesn't have some form of certificate pinning. That should get you the raw requests/responses.

by Johnie 3y ago

I am the owner of this rogue washing machine. If anyone has any ideas on how to investigate this, I'm open to ideas. As of now, I've just blocked the internet access.

coupdejarnac 3y ago

Does it stop functioning intermittently? I've seen cases of devices in the middle of a failed OTA, and the device keeps requesting the OTA again. If it's going on and offline often, this might the case.

squarefoot 3y ago

It may be worth sandboxing it into a dedicated network then analyze the traffic and see what it does in detail, for example if it accesses the local network then relays something outside, or if it opens ports waiting for connections, etc. I wonder if merely downloading so much data and storing it into its internal flash could wear it in a short time forcing the user to call for repair.

dilyevsky 3y ago

Have you tried tcpdump’ing its payload on your router? If it’s plain text it should be obvious what it’s doing. If it isn’t you can still sniff which domains it’s connecting to from SNI ClietnHello message but payload will be encrypted. You can still get to it but that would require some decent soldering and hw debugging skills…

pjsg 3y ago

I'd pcap a bunch of the traffic -- in particular the DNS requests -- that will tell you where it is connecting. Hopefully it is using TLS, and then the SNI headers can give you more information. I run a local DNS resolver and so I capture all the lookup responses so that I can turn IP addresses back into names. Depending on what firewall/router you have, you may be able to log connections. I use a locally hosted free Gravwell process to grab these logs and correlate with the DNS queries to find which systems are talking to where. If your home network is like mine, then there are probably a bunch of systems that you want to block from talking outside.

Johnie 3y ago
For those interested, you can setup tcpdump on Asus router pretty easily to monitor traffic going through the router. You don't even need to mess with the firmware on the router. 1. Install Entware https://github.com/Entware/Entware/wiki/Install-on-Asus-stock-firmware https://github.com/Entware/Entware/wiki/Install-on-Asus-stoc... 2. Then install tcpdump: `opkg install tcpdump` From there, you can monitor any traffic going through your router.
Johnie 3y ago
Right now it looks like it has stopped uploading data. Looking at my router log, the only web history request is: 2024-1-08 19:44:10 LG_Smart_Laundry2_open aic-common.lgthinq.com This was likely after I had removed it from my main wifi and reconnected it to a segregated wifi. I don't see any logs for prior to this point.
- somerandomqaguy 3y ago
  Might be legit, LG ThinQ is their smart appliance page. And aic-common.lgthinq.com is registered to LG. Genuinely unsure what would be taking that much data though but honestly my first guess is a bug of some kind. Kind of wondering if the App has some sort of issue reporting page on it, might be worth sending in something about it. Might not get a response, it but could get some gears turning on their end behind the scenes.
runjake 3y ago
https://gist.github.com/Jonathan727/9ef58e7a64806d1e01112b202cdc14bc https://gist.github.com/Jonathan727/9ef58e7a64806d1e01112b20...

maerF0x0 3y ago

You can have fun with Wireshark https://www.wireshark.org/ https://www.wireshark.org/ Depending on the details in each of the layers[1] you might be able to spoof traffic towards it to trick it things. you may need to try MITM the certs/key exchange stuff[2], hopefully they have a broken implementation that doesnt validate signatures etc. [1]: https://www.bmc.com/blogs/osi-model-7-layers/ https://www.bmc.com/blogs/osi-model-7-layers/ [2]: first promising hit when i googled: https://gbhackers.com/mitm-attack-https-connection-ssl-strip/ https://gbhackers.com/mitm-attack-https-connection-ssl-strip...

SushiHippie 3y ago
Looks like the android app at least does certificate pinning https://github.com/zimmra/frida-rootbypass-and-sslunpinning-lg-thinq https://github.com/zimmra/frida-rootbypass-and-sslunpinning-...

omgmajk 3y ago

I wash Really hoping for some wireshark goodness in that thread!

PlunderBunny 3y ago
I can’t tell if that typo was a deliberate pun or not.

SushiHippie 3y ago

What software/router do you have, that shows this upload/download graph?

chucklenorris 3y ago

If you have a openwrt router than it should be quite simple. Redirect the traffic from the ip of the washing machine to a machine that has mitmproxy installed (using iptables). Hopefully the protocol is https and it doesn't have some form of certificate pinning. That should get you the raw requests/responses.