106 ms·

Attacking My Landlord's Boiler

388 points by ericvolp12 1y ago

willvarfar 1y ago
I guess your toolbox really shapes your solution space thinking; as I read through this, being completely lost in the whole world of RF whatnot, my mind jumped straight to an alternative attack that better fit my own tooling: could you encase the thermostat in a box that you can mechanically control the temperature of?
- kbuck 1y ago
  Or attach an ESP32 to the boiler's control board that closes a dry contact circuit...?
  - unsnap_biceps 1y ago
    That was my first thought on how I would approach it as well.
  - mschuster91 1y ago
    The problem is, if your landlord ever comes around for inspection, or the bloody thing breaks down due to your installation attempt, you can be held liable up to and including getting evicted.
    - aceofspades19 1y ago
      Where can you get evicted for something like that? The worst case is that they would sue your insurance for damages, or you'd have to pay them out of pocket.
      - sitharus 1y ago
        Many countries have no contest evictions, so you could even get evicted if the landlord doesn't like your cooking.
      - mschuster91 1y ago
        Probably half of the US, but messing around with stuff like boilers can and will lead to issues even here in Germany.
- avidiax 1y ago
  This sounds good, except that cooling a box is problematic. He needs the temperature sensor to read low so that it turns on the heat. That said, if he has access to the interior of the thermostat, I'm sure it won't be difficult to replace the temperature sensor with a circuit to cause it to read either really high or really low on demand.
  - toast0 1y ago
    > This sounds good, except that cooling a box is problematic. He needs the temperature sensor to read low so that it turns on the heat. Ice pack and desiccant?
  - willvarfar 1y ago
    I was literally imagining duck-taping one of those cheap electric "instant cooling" cups over the box on the wall, and running a small incandescent bulb in to be the heating up element.
  - dtech 1y ago
    For such a minor use case a peltier element is suitable. Very energy inefficiënt but you don't need much and it can both heat and cool.
- mjlee 1y ago
  Or, assuming they have physical access to the combi boiler, removing the receiver unit and replacing it with a more Home Assistant friendly combi boiler thermostat. Probably a 30 minute job if you’ve never done it before and easily reversible with a little bit of double sided sticky tape, which all Brits should be familiar with if they ever made a Tracy Island. There is a real risk of electrocution which could be completely militated against by turning off the power to the boiler. Still, a fun hack, and nicely executed!
- haileys 1y ago
  I removed the thermistor from inside my wall controller and wired in a digital pot instead. Achieves the same thing without physically heating and cooling the sensor
- nippoo 1y ago
  Yes! You can indeed do exactly this. Look up CoolBot - they do exactly this, by just heating up the existing thermostat
- anal_reactor 1y ago
  I've heard a story of people renting an apartment with locked thermostat to the legally allowed minimum. Tenants would put ice on the thermostat
  - Gazoche 1y ago
    I heard that was a well-known trick at my old uni dorm. There was a single thermostat for the whole floor so once people figured out where the sensor was, the ones who lived closest to it would often leave packs of frozen food on it.
thomashabets2 1y ago
If you do want to decode it, it's probably not that hard. I was going to implement the transmission side when I did this, but then I moved. https://blog.habets.se/2017/04/Decoding-FSK.html https://blog.habets.se/2017/04/Decoding-FSK.html
yurishimo 1y ago
If OP ever shows up here, you probably could have just replaced the thermostat with one that is compatible with your boiler for less money and headache. The boiler market is fairly open to competition as evidenced by the fact that you could find a Honeywell signal in a random OSS project that also worked. Good luck with your future apartment customizations!
- glitchcrab 1y ago
  I think you missed where it was explained that the apartment is rented and therefore you cannot modify anything.
  - Griffinsauce 1y ago
    Cannot modify irreversibly though right? Something like a Nest or whatever is easy to return to the original state when you leave.
    - sitharus 1y ago
      Depends where you are. Where I live it's no modification. If it's hard-wired the tenant can't touch it. Though in reality many landlords don't mind as long as you know what you're doing and return it to how it was. Just a problem if you get a jerk landlord.
      - foobarian 1y ago
        Except how does the landlord know? Surprise inspections? And what are the penalties? This should all be spelled out in the lease contract.
        sitharus 1y ago
        Here a landlord can do an inspection with 48 hours notice. If you're out of town they are allowed access without you present. Also the landlord can end your tenancy with 90 days notice with no reason. Penalties would depend on the adjudicator's opinion of the damages and risk.
smelendez 1y ago
I wonder what the ideal one-size fits all thermostat looks like. The one in my apartment has a “feature” a lot of US thermostats now have, where you set four ordered times called wake, leave, return, and sleep and the temperature you want the space in each interval. I know very few people who actually live in a household where everyone wakes, leaves, returns, and sleeps on the same schedule every day. I work from home and personally just want to set a temperature and have the space stay at that temperature indefinitely but this system requires that I tap through and enter the desired temperature four times, while confirming the four intervals. I guess I’d be happier with a more programmable thermostat that I could set to behave like an old school dial thermostat.
- deleted 1y ago
  [deleted]
- Freak_NL 1y ago
  Isn't this pretty much what these thermostats already allow? I have a new Honeywell Thermostat which basically does what the twenty years old one it replaced does with a few added conveniences in terms of UI. It has those wake/leave/return/sleep instants for each weekday (but also adds an optional second leave/return pair), and it has an option to override the day programme to 'holiday', which is essentially an eighth programmable weekday you can activate at any time. Your use case is possible with that. Just set the standard program to 15°C, and activate the holiday set to whatever you need whenever you want. Configure it to go to 15°C at some sensible time in the evening, so it won't go on even if you forget it.
  - meindnoch 1y ago
    15 C is very cold. Are you American?
    - Freak_NL 1y ago
      15°C would be the standard setting of 'no heating' (just keep the house warm enough to avoid mould and such). The 'holiday' programme would be 21°C or whatever is desired. That would effectively turn the thermostat into one where turn on the heating by putting it in 'holiday' mode, and can turn it off by exiting that mode or just letting it revert to 15°C after 23:00 or so.
YakBizzarro 1y ago
Funny how the manufacturer proudly claims that the protocol is encrypted, but completely forget to mitigate replay attacks,thus making the encryption completely useless
- kleiba 1y ago
  Which raises the question whether the OP now unknowingly also controls the heater in the apartment next to his...
  - mattigames 1y ago
    And so the heat-stroke-killer was born, offing his victims with rapid changes between coldest and hottest setting, natural death has never been this human-made.
  - simooooo 1y ago
    Probably not otherwise the original would also potentially run that risk
    - kleiba 1y ago
      Good point!
  - mhw 1y ago
    Unlikely. This kind of wireless thermostat has two parts: the thermostat itself, and a separate receiver box that's directly connected to the boiler. There's usually a pairing process that you can go through where the two parts negotiate a shared value used in the protocol; this prevents one thermostat unintentionally controlling other boilers. You can see this described in the Installation Guide for the thermostat linked from the article (it's called 'binding' in the guide).
  - videah 1y ago
    The thermostats are paired, if my setup was able to control another apartments boiler then the original thermostat would also do that
badmonster 1y ago
loved the blend of reverse engineering and persistence
pinoy420 1y ago
[dead]
__turbobrew__ 1y ago
The legit Hackrf One is known to have frequency smearing, I wouldn’t use one off Aliexpress to transmit without testing it with a spectrum analyzer first (which you probably don’t have if you are buying knockoffs from Aliexpress).
- KeplerBoy 1y ago
  What does frequency smearing mean in this context?
  - tgsovlerkhgsel 1y ago
    You're trying to transmit (only) on e.g. 433 MHz, but you actually transmit on 433 MHz and a bell curve around it.
    - KeplerBoy 1y ago
      so, severe LO clock drift?
      - __turbobrew__ 1y ago
        Not exactly, the transmitted power tends to be centered on the frequency you desire, but there are unwanted harmonics off the center frequency. Its like having a fire hose that hits the desired target with water (something on fire), but it also hits everything else around the target in a large radius as well which may be very sensitive to water (precious art, high power transformers, etc)
- tgsovlerkhgsel 1y ago
  The blogpost mentions "I guess it's always good to have another SDR just to confirm that we're not polluting other frequencies." and they have an RTLSDR which probably could serve as a good enough spectrum analyzer for this use case?
solarist 1y ago
One doesn’t actually need any extra hardware for this… just 8cm of wire and this https://github.com/F5OEO/rpitx https://github.com/F5OEO/rpitx (use at your own risk of course)
- LeonM 1y ago
  From the linked repo: > rpitx is a general radio frequency transmitter for Raspberry Pi which doesn't require any other hardware unless filter to avoid intererence. It can handle frequencies from 5 KHz up to 1500 MHz. Wait, how does that work? 1.5GHz is a _lot_, I can't imagine this is done with bit-banging an I/O line, nor do I expect the Pi will have a DAC with anything close to a 3GHz+ sample rate. > Plug a wire on GPIO 4, means Pin 7 of the GPIO header (header P1). This acts as the antenna. A bit of Googling shows me that on the later Pi board GPIO4 (pin 7) has a bunch of alternative modes, amongst which is a general purpose clock output (GPCLK0), a DPI output bit (DPI_D0) and what I recon is composite analog video in/out (AVEOUT_VID0, AVEIN_VID0), and the TDI JTAG pin. But none of these would get close to 1.5Ghz TRX capabilities, no? What's the magic here?
  - solarist 1y ago
    RF is basically black magic but here it’s the harmonics of lower frequencies that are in GHz range (and very noisy and weak)
- videah 1y ago
  This did come up when I was researching this but it’s incredibly dangerous as you’ll be spewing all over the spectrum due to harmonics, I considered it too much of a hack for my liking
Mond_ 1y ago
Cool as fuc + very nice blog design.
- pyfon 1y ago
  Furry cartoons are catching on.
buccal 1y ago
Cool project. Speaking of newish natural gas (CH4) heaters, they all should have modulating thermostat capability with OpenTherm/eBus or other protocol. Combined with a thermostat with outdoor temperature sensor system efficiency is increased a few percent and that should help offset thermostat and installation costs. In the end you have more efficient modern heating system. Same should apply for heat pump systems.
- steelegbr 1y ago
  OpenTherm is a cool idea but even new installations aren't always wired for it. When installing a new smart thermostat I found the installation has been wired as S Plan with the few cables running between the boiler location and valves location already consumed. Makes the job much bigger if you're not prepared for it.
  - buccal 1y ago
    There are many wireless OpenTherm thermostats. Wired is better but is not required for modern thermostats.
alistairSH 1y ago
Is this a non-standard thermostat control mechanism? I don’t know what’s common in apartments. All my houses have the thermostat wired to the HVAC (and are easily replaceable by the resident).
sokoloff 1y ago
> I also have it so the heating turns off when I go into town and turns back on when I'm just a few train stops away so my place is nice and toasty for me getting home! If your goal is saving energy/money, you don’t want a system capable of going from cool to toasty in 20 minutes. Instead, you want a system that runs (much) lower water circulation temperatures (giving lower losses in the unconditioned spaces and more even room heating). That can be done to any condensing boiler by just turning down the flow target temperature. A second layer of optimization on top of this is the addition of outdoor reset/weather compensation which will adjust that flow temperature based on the outside temperature, giving a flow temperature than can just barely restore the building to the desired setpoint temp. With mine properly tuned, I was targeting having the thermostat act more like a high-limit and for it to call for heat between 22 and 24 hours per day while not overheating the house. That often meant flow temps in the 110°F (warm day) to 135°F (below freezing day) range. Compared to the prior winter (at a constant 160°F flow), the house used 8-15% less gas and was wildly more comfortable. (This setup does preclude using deep setback settings, which also can save money, because recovery times are necessarily long in such a scheme, unless you have an even smarter control system that can run perfectly tuned water most times but hotter water during recovery from setbacks.)
- frereubu 1y ago
  I've read that it's always more efficient to turn heating off when you're not home and then turn it back on when you return. Is the reason for it being on 22-24 hours here that it takes a very long time to get back to the desired temperature, meaning you'd actually be cold for quite a while as it returned to the desired temperature?
  - sokoloff 1y ago
    I work entirely remote so, other than travel, there are not many long periods when the house is unoccupied. I target the long run time to maximize efficiency. A 160°F pipe will lose more heat to the part of the building that I don’t want to heat as well as more heat to the wall right behind the radiators. It also results in the house going micro too-hot, too-cold, too-hot, too-cold as it cycles. Mine is constantly trickling in just enough heat to replace the heat lost instead of cycling between adding way more than needed then none for a while. Another large effect is that low return water temperatures into the boiler allow for greater condensation of exhaust gas energy to be used in the building instead of sent outside. Walking by my house on a cold day, you’ll see minimal steam plume during operation. All that steam I see my neighbors emitting is energy they paid for and delivered to the outside… (They paid a lot for a boiler with a 95% or 98% sticker and run it at 80% efficiency.) https://kw-engineering.com/how-to-optimize-condensing-boiler-system-maximum-energy-savings/ https://kw-engineering.com/how-to-optimize-condensing-boiler...
DecoPerson 1y ago
The Flipper Zero is great, and could handle all of the hacking/investigation part by installing custom firmware. The original product understandably arrives with heavily-restricted firmware (I imagine to reduce the amount of flak the company receives). However, it is incredibly easy to install Flipper Unleashed or similar, which removes all said restrictions and adds a lot of additional functionality. Possessing the tools that could be used to commit a crime is not necessarily a crime in and of itself! Just be careful with what you do or, depending on what country you’re in, you might find some men in suits knocking at your door. Personally, I wanted to replay “encrypted” 433MHz signals for my own devices (electric gate, roller door, roller shutters, …) and this was disabled with the Flipper’s region set to Australia.
- 0xEF 1y ago
  > Possessing the tools that could be used to commit a crime is not necessarily a crime in and of itself! While I do agree 1000%, I also want people to be careful with this thinking since I have gotten in some minor trouble in the past. Always assume the authority questioning you can and will create whatever narrative they wish, that it will be accepted, and that your own reasoning will likely be used against you. I will always encourage exploration and curiosity in tech, but if we stick with the Flipper Zero example, there's a few things one should keep in mind, regardless of the jurisdiction they're in: * Don't carry it around unless you intend to use it. * Read all documentation before you start practicing, then practice being subtle. * Taking a note from my outdoorsy side, adopt the "leave no trace" ethos. * Pay attention to the effect your presence and actions have on the environment and your target and how that might be interpreted by an outside observer, then take action to mitigate suspicion. These apply to lots of devices, everything from your disposable smartphone to a cheap RFID card copier from Temu. Our eagerness sometimes gets the best of us, especially new-comers, and we want to jump to the part where we can be like the hackers we see in tv and video games. There's a reason those guys are fictional characters. Innocuous actions or not, the perception of the authority questioning you is all that will matter, in the end.
  - crtasm 1y ago
    Or perhaps go for the opposite of subtle - in many places it's quite normal to see people in hi-vis vests taking readings etc.
sz4kerto 1y ago
We've moved to an new apartment (house) and we had to do a full renovation. It doesn't have modern insulation and I calculated that for the time being the ROI on insulation isn't worth it. It's a multi-floor semi-detached house and I wanted the best comfort and the most economical heating possible. In particular: stable and individually adjustable temperatures for bedrooms and living rooms; underfloor heating in some rooms (bedrooms), radiator-based heating in some others (living room), and combined UFH+radiators in some others (where UFH might not be enough during extreme colds). I thought I can just pay someone some money and they'll set up the controls for me. It must be a simple exercise, right? I could not have been more wrong. After spending a few hours of understanding the setups that "experts" have recommended, I figured out edge cases where they would be either wasteful or uncomfortable (meaning: unnecessary and inavoidable temperature overshoots or undershoots, etc.). I had many-many rounds with Honeywell, Tado, Siemens, etc. and every single one of them had _major_ issues. The renovation got a bit stuck because of this, but the plumbing was ready so I wanted to see whether the pluming and pumps are working, at least. So I connected the pumps and valves to "smart plugs", i.e. Zigbee-controlled plugs, so that I can see that they turn on. They did, which got me thinking... Right now I have $20 Zigbee temp sensors sprinkled across the house, $30 smart plugs and relays driving valves, pumps and the boiler, and Home Assistant is controlling the whole thing. Everything works perfectly and I could implement some features that simply no system would have done out of the box, for example in rooms where there's combined UFH and radiators I can drive both heating systems when the target temperature is far from the desired (so that the room heats up quickly) but as the room temp is getting closer to the target, the radiators are turned off so that UFH dominates heating (more comfortable and more energy efficient than radiators). In rooms with radiators, temp is +- 0.4 C within target, in rooms with UFH, it's +-0.1C within target.
- darkwater 1y ago
  Yeah, the automated/remote controlled heating system world, and also the ringbell world is basically a giant scam, since they are updates on world that also scammed you in the past. I cried when I shelled out so much money for my Tado device, but even a dumb bTicino device costed in the hundred of euros realm, and it's just a sensor + a small LCD display and a designed-in-hell menu system to program it. And the same happens in Ip-based ringbells. A Doorbird will cost you hundreds of euros for what is basically a webcam plus some nice metal casing and a shitty software, but it competes with analog systems with optic cables etc that cost basically the same or more.
rsynnott 1y ago
Some risk of collateral damage in the form of randomly controlling other peoples' boilers if your transmitter turns out to be more powerful than the one in the thermostat, tho...
- frontlodjkgi 1y ago
  I imagine even encrypted messages could be replayed if the protocol wasn't designed against it. It also doesen't say what kind of encryption it uses, it could be a very weak in-house "encryption", for all we know it could be only an unknown encoding.
- videah 1y ago
  The thermostat is paired with the boiler, the signals bundle the unique ID’s of each so this won’t happen. Otherwise there would be a risk the original thermostat would do the same.
robocat 1y ago
> sledgehammer approach A hammerier solution would be to control the temperature seen by the thermostat (ignore the difficult RF protocol). A heating element and a temperature reading could control the heat seen by the thermostat. I'm pretty sure you wouldn't need any cooling (Peltier or whatever). Just a heater and ambient cooling! Set the thermostat to a high temperature, and run the heater to make the measured temperature hotter: when you don't want the heating to run. That said, I think hacking the RF protocol is geekier and far awesomer.
poopiokaka 1y ago
[flagged]
- kebokyo 1y ago
  if i had a nickel for every time someone said the word "objectively" to make something seem more true when it's just, their opinion, man... i would be rich enough to lobby for government-mandated fursonas
gRoberts84 1y ago
I went through various stages of this myself and got an Sonoff RF Bridge, that allowed me to capture and replay RF via Home Assistant. In the end though, it was always easier to use an off the shelf solution, especially for boilers. OpenTherm with Tado worked perfectly.
gcanyon 1y ago
It's an awesome hack! It seems like the easier hack would be to put a peltier heater/cooler under the thermostat then control that remotely to assume control over what temperature the thermostat sees. The link to the exact model of thermostat isn't working, so I don't know how amenable its design is to this approach, but the thermostats I've used are generally wall-mounted and putting a heat/cool source under them wouldn't be too hard. You'd need to make sure that you didn't send both the heat and cool into the thermostat, but that's a simple positioning problem.
- paulkrush 1y ago
  Cool idea! It's ironic that this is such an efficient use case for device that is so inefficient.
- catsma21 1y ago
  yeah i put mine in the freezer
- looofooo0 1y ago
  Actually the best control system for such a boiler would be to control the heating curve where heating water temperature is fixed to the outside temperature. If you aim for the lowest water temperatures possible, then the system will become quite slow reacting. Then you only need to adjust the flow of water to the individual rooms to fix varying temperature issue. But this is long term manual optimization process which takes 1 to 2 years to perfect.
T3RMINATED 1y ago
[dead]
gwbas1c 1y ago
> The only thing I'm not happy with is needing to use a very powerful and versatile radio like the HackRF for something as simple as a boiler on/off switch. But I'd rather use something overkill and have it work than spend ages trying to force smaller radios to do my bidding. All the apartments I lived in had basic thermostats; and I even rewired and replaced one of them. What was blocking Videah from buying an off-the-shelf thermostat?
- simooooo 1y ago
  I’ve got a similar problem, and plan to replace the thermostat with a Shelly relay which can be toggled by home assistant’s events based on the TRVs in each room. Then the boiler is basically controlled by the relay.
aboardRat4 1y ago
In the former Soviet Union we just have central heating The government maintains indoor temperature at 24 degrees from October to May, and the water is heated at the power stations.
- jobs_throwaway 1y ago
  Jesus that sounds miserable. Sleeping at 75F?!
  - mkevac 1y ago
    You would regulate temp by opening the window.
- dzhiurgis 1y ago
  And a €500 heating bill every month.
  - mkevac 1y ago
    No, it was basically free.
    - aboardRat4 1y ago
      It's about 50 dollars per month.
MisterTea 1y ago
Instead of attacking a radio controlled relay, the author should have read up on how their heating system works. All they need is a relay controlled by an internet connected thing to replace the thermostat receiver. I could understand if the receiver was locked away but the video clearly shows they have access to the boiler.
- wpietri 1y ago
  That leaves very visible evidence that things have been hacked. Any time the landlord comes around you'd want to remove that. And if there's some sort of infrastructure emergency (plumbing problem, heat goes out, fire in the building) it could be very challenging to get there and remove all traces before the landlord is stomping around.
  - MisterTea 1y ago
    Why would you be that paranoid? What laws exist in the UK where this is so illegal as to be that paranoid? That's a level of paranoia I would never have. You can easily conceal them in a way that is almost imperceptible.
    - wpietri 1y ago
      Paranoia? People generally don't like you messing with their stuff. They especially don't like it when you add sketchy-looking electronics to things that are expensive and can burn their property down. If you want to take a swing at it, I'm not stopping you. But after 30 years having landlords, plus having family and friends who are landlords, I think I have a pretty good sense of what can upset a landlord. Maybe yours will be super chill. Me, I'd rather go the radio route.
josefritzishere 1y ago
For a related hack... If your apartment building with a BACnet system, it also relies on a set of commands for heating and cooling. Assuming you are on the same VLAN as teh server, you can inject commands. The difficulty is that every BACnet server is somewhat different, though most have spec online.
epsilonaurigae 1y ago
OP removed their comment section, but if you’re here: I haven’t done this since 2014 but the google nest API used to (hopefully still does?) let you see and or set the thermostats status with curl commands. My use case was to run one shell script that got my burglar alarms status, and if it was “armed/away” to simply set my nest thermostat as away, too. But it can also be hooked up to a dummy load or a relay and just used as an indoor temperature sensor. And the curl commands OP is relying on can be tied in to indoor and outdoor temperatures , such as scraping local weather with curl/wget and based on that integer, turning the boiler to a minimum when it’s a certain temperature outside. Or turning it completely off when it’s warm outside. I’m about to revisit this again just because I have an ancient gas pig of a furnace that uses microvolt and is too cold when it’s cold outside, and too hot when it’s warm outside. So I need one thermostat in place to turn it on no matter what at 40F, but then some conditional logic to kick that thing on and off on different cycles based on outdoor temps. The whole systems too crude to implement one off the shelf without adding a zone controller, so I just want a Linux box at home to be the zone controller…. where I differ is that I’m not sending an RF signal to the boiler, I just have to close an NO contact to engage mine (and I’m lazily going to use the nest for that.) If anyone knows of a better thermostat that has its own API I can set, read sensors, turn hvac on and off without using google/nest account or having a dependency on the goodwill of their API existing forever , I’ll come back and glean any responses thanks in advance. As an afterthought, hm I can just attach temperature probes and a GPIO for a relay and indoor/outdoor temps and do away with google/nest altogether…. Thanks for jogging my brain a bit I might do exactly that. (The nest was cool , and educational, I guess, 12 years ago when I didn’t know how to really do anything but run and fire off curl commands on someone else’s hardware for temp sense and closing a relay and I don’t have anything bad to say about it as a starting point.) Where I was going with this , though, was that , you could use an off the shelf nest , and run 1) one command against API to get thermostat status (system thinks it’s on or off , even though it’s factually not directly controlling anything) and then based on that, 2) another command to your RF board to transmit a matching signal. … (However you could also do the same with a temperature probe that can be read on board or over WiFi , and then manage your setpoints in the script and or by other means: eg scraping a weather site for the local outdoor temp in your case where the landlord probably wouldn’t let you attach or connect an outdoor probe.) Bonus with the nest approach is you get a dial, can mount it on anything , doesn’t have to be the wall of your unit… and it “sort of works” like a normal thermostat as well, as soon as the shell script reconciles the two states manually. Long winded rant but the original use case was an apartment where the thermostat was proprietary and serialized data and I didn’t have any option to integrate a smart thermostat other than turning it to its maximum set point and then using the nest with a massive 220V/50A HVAC relay to just chunk the AC power line on and off on demand.
ambalangoda 1y ago
I just gotta say, I really like the animated gifs. Kudos to the blogger.
KennyBlanken 1y ago
What is with this absurd headline? Imitating your RF thermostat isn't "attacking" anything.
mattmaroon 1y ago
I would probably just go about this by heating/cooling the thermostat itself rather than messing around with radio signals. Put a little box around it and something that could control the temp in the box, like a little peltier element. When you want the heat to run, cool the inside of the box. When you want it to stop, warm it up. Etc. But then I build thermal control devices for fun so maybe it just seems like a much easier method to me.
- pards 1y ago
  X-10 devices [0] that do this have been around for a long time. I've even seen elaborate setups that can be controlled via a landline. [0]: https://thex10shop.com/products/x10-powerhouse-th2807-thermostat-set-back-controller?variant=6287992422432 https://thex10shop.com/products/x10-powerhouse-th2807-thermo...
  - mattmaroon 1y ago
    Neat.
pete1302 1y ago
Men in Black suit knocking on the door for this is a First-world thing.
tgtweak 1y ago
I would have put a peltier/TEC below the thermostat to influence it's measured air temp vs resorting to reverse engineering and illegal signal broadcasting.
- noncovalence 1y ago
  If I understood the OP correctly, then the broadcasting would only be illegal in the US.
  - archi42 1y ago
    Yes but no: The original device operates in the 868MHz band, which is a ISM band in the EU. However this band isn't availabe for public use in the US (IIRC some mobile phone cells operate in that band) - so the original thermostat is already illegal to sell/buy/use in the US. If you bought such a thermostat in the US (e.g. at walmart or what-do-I-know), that device would probably operate on 433 or 915 MHz. I think you can legally broadcast on these in the US, much like the OP did [in the UK]. Power limits might be a bit different and such. But IANAL and no US person, so do some research before grabbing a HackRF One ;-)
jorisboris 1y ago
I need this solution Our landlord installed a Honeywell home, the cheapest version, and it has no remote or timer capabilities And especially in winter it would be nice if it would jump on before we wake up!
xbar 1y ago
The UK's Online Safety Act is pretty horrific. Our friends in the UK have my sympathy.
lenerdenator 1y ago
> Please do your due diligence and check local laws before attempting anything I do in this post. Transmitting radio signals can become legally problematic very quickly, and the band I specifically transmit on here (868Mhz) is illegal in the United States without a license. I'd rather you didn't have men in suits knocking on your door on my account. You've been warned! Let's be honest here: the FCC is gonna have to see a helluva lot of problems coming from your transmissions before they bother to send the black Suburbans filled with men in suits to knock on your door. You're going to get a series of letters that basically say "please don't do that" if anything.
- johnwalkr 1y ago
  An American thermostat would be using around 920MHz which is the equivalent unlicensed band in the US. Funnily enough, the author warns Americans as an example but he is running more foul of the local rules an American would be (assuming an American would use 920MHz and not 868MHz). In the US you are allowed to tinker around there with home-built RF devices for personal use and prototyping in unlicensed bands, to some extent. Although, using an SDR for this requires a certain interpretation of the rules. In Europe it's basically not allowed, one shall only use pre-certified modules. Or only use the device you've built in an RF anechoic chamber until you've undertaken the certification process (totally impractical for a hobbyist).
cft 1y ago
Very interesting ending of the post: ```There was a comment section here. It's gone now. As of March 16th, 2025 the United Kingdom's Online Safety Act has gone into full effect. The law presents a lot of challenges for hobbyist websites like this one to present any user-to-user content (like y'know, blog comments) and comes with some pretty serious repercussions for non-compliance. The odds of Ofcom (the regulator whose job is to enforce this) kicking my door down over this blog are low if we are being honest with ourselves. But the odds are at least somewhere above zero and the punishment is a life ruining £18 million fine(!!) so it's just not worth the risk. A kind lawyer has written up the implications of this law for self-run blogs like this one and the only way to guarantee that I am not in-scope would be to manually review all comments made before being available to the public. Not to be a big baby about it all but I don't really want to do this! I liked my current setup! So I guess as a little act of protest and to hedge against any risk I've removed the comment section entirely. Sorry about that!```
newacc666 1y ago
[flagged]
p3rls 1y ago
This is basically why companies like HeatWatch have 90% market share for NYC landlords
m1n1 1y ago
Could the same radio be controlling other nearby boilers unintentionally?

388 points by ericvolp12 1y ago

I guess your toolbox really shapes your solution space thinking; as I read through this, being completely lost in the whole world of RF whatnot, my mind jumped straight to an alternative attack that better fit my own tooling: could you encase the thermostat in a box that you can mechanically control the temperature of?

kbuck 1y ago
Or attach an ESP32 to the boiler's control board that closes a dry contact circuit...?
- unsnap_biceps 1y ago
  That was my first thought on how I would approach it as well.
- mschuster91 1y ago
  The problem is, if your landlord ever comes around for inspection, or the bloody thing breaks down due to your installation attempt, you can be held liable up to and including getting evicted.
  - aceofspades19 1y ago
    Where can you get evicted for something like that? The worst case is that they would sue your insurance for damages, or you'd have to pay them out of pocket.
    - sitharus 1y ago
      Many countries have no contest evictions, so you could even get evicted if the landlord doesn't like your cooking.
    - mschuster91 1y ago
      Probably half of the US, but messing around with stuff like boilers can and will lead to issues even here in Germany.
avidiax 1y ago
This sounds good, except that cooling a box is problematic. He needs the temperature sensor to read low so that it turns on the heat. That said, if he has access to the interior of the thermostat, I'm sure it won't be difficult to replace the temperature sensor with a circuit to cause it to read either really high or really low on demand.
- toast0 1y ago
  > This sounds good, except that cooling a box is problematic. He needs the temperature sensor to read low so that it turns on the heat. Ice pack and desiccant?
- willvarfar 1y ago
  I was literally imagining duck-taping one of those cheap electric "instant cooling" cups over the box on the wall, and running a small incandescent bulb in to be the heating up element.
- dtech 1y ago
  For such a minor use case a peltier element is suitable. Very energy inefficiënt but you don't need much and it can both heat and cool.
mjlee 1y ago
Or, assuming they have physical access to the combi boiler, removing the receiver unit and replacing it with a more Home Assistant friendly combi boiler thermostat. Probably a 30 minute job if you’ve never done it before and easily reversible with a little bit of double sided sticky tape, which all Brits should be familiar with if they ever made a Tracy Island. There is a real risk of electrocution which could be completely militated against by turning off the power to the boiler. Still, a fun hack, and nicely executed!
haileys 1y ago
I removed the thermistor from inside my wall controller and wired in a digital pot instead. Achieves the same thing without physically heating and cooling the sensor
nippoo 1y ago
Yes! You can indeed do exactly this. Look up CoolBot - they do exactly this, by just heating up the existing thermostat
anal_reactor 1y ago
I've heard a story of people renting an apartment with locked thermostat to the legally allowed minimum. Tenants would put ice on the thermostat
- Gazoche 1y ago
  I heard that was a well-known trick at my old uni dorm. There was a single thermostat for the whole floor so once people figured out where the sensor was, the ones who lived closest to it would often leave packs of frozen food on it.

thomashabets2 1y ago

If you do want to decode it, it's probably not that hard. I was going to implement the transmission side when I did this, but then I moved. https://blog.habets.se/2017/04/Decoding-FSK.html https://blog.habets.se/2017/04/Decoding-FSK.html

yurishimo 1y ago

If OP ever shows up here, you probably could have just replaced the thermostat with one that is compatible with your boiler for less money and headache. The boiler market is fairly open to competition as evidenced by the fact that you could find a Honeywell signal in a random OSS project that also worked. Good luck with your future apartment customizations!

glitchcrab 1y ago
I think you missed where it was explained that the apartment is rented and therefore you cannot modify anything.
- Griffinsauce 1y ago
  Cannot modify irreversibly though right? Something like a Nest or whatever is easy to return to the original state when you leave.
  - sitharus 1y ago
    Depends where you are. Where I live it's no modification. If it's hard-wired the tenant can't touch it. Though in reality many landlords don't mind as long as you know what you're doing and return it to how it was. Just a problem if you get a jerk landlord.
    - foobarian 1y ago
      Except how does the landlord know? Surprise inspections? And what are the penalties? This should all be spelled out in the lease contract.
      - sitharus 1y ago
        Here a landlord can do an inspection with 48 hours notice. If you're out of town they are allowed access without you present. Also the landlord can end your tenancy with 90 days notice with no reason. Penalties would depend on the adjudicator's opinion of the damages and risk.

smelendez 1y ago

I wonder what the ideal one-size fits all thermostat looks like. The one in my apartment has a “feature” a lot of US thermostats now have, where you set four ordered times called wake, leave, return, and sleep and the temperature you want the space in each interval. I know very few people who actually live in a household where everyone wakes, leaves, returns, and sleeps on the same schedule every day. I work from home and personally just want to set a temperature and have the space stay at that temperature indefinitely but this system requires that I tap through and enter the desired temperature four times, while confirming the four intervals. I guess I’d be happier with a more programmable thermostat that I could set to behave like an old school dial thermostat.

deleted 1y ago
[deleted]
Freak_NL 1y ago
Isn't this pretty much what these thermostats already allow? I have a new Honeywell Thermostat which basically does what the twenty years old one it replaced does with a few added conveniences in terms of UI. It has those wake/leave/return/sleep instants for each weekday (but also adds an optional second leave/return pair), and it has an option to override the day programme to 'holiday', which is essentially an eighth programmable weekday you can activate at any time. Your use case is possible with that. Just set the standard program to 15°C, and activate the holiday set to whatever you need whenever you want. Configure it to go to 15°C at some sensible time in the evening, so it won't go on even if you forget it.
- meindnoch 1y ago
  15 C is very cold. Are you American?
  - Freak_NL 1y ago
    15°C would be the standard setting of 'no heating' (just keep the house warm enough to avoid mould and such). The 'holiday' programme would be 21°C or whatever is desired. That would effectively turn the thermostat into one where turn on the heating by putting it in 'holiday' mode, and can turn it off by exiting that mode or just letting it revert to 15°C after 23:00 or so.

YakBizzarro 1y ago

Funny how the manufacturer proudly claims that the protocol is encrypted, but completely forget to mitigate replay attacks,thus making the encryption completely useless

kleiba 1y ago
Which raises the question whether the OP now unknowingly also controls the heater in the apartment next to his...
- mattigames 1y ago
  And so the heat-stroke-killer was born, offing his victims with rapid changes between coldest and hottest setting, natural death has never been this human-made.
- simooooo 1y ago
  Probably not otherwise the original would also potentially run that risk
  - kleiba 1y ago
    Good point!
- mhw 1y ago
  Unlikely. This kind of wireless thermostat has two parts: the thermostat itself, and a separate receiver box that's directly connected to the boiler. There's usually a pairing process that you can go through where the two parts negotiate a shared value used in the protocol; this prevents one thermostat unintentionally controlling other boilers. You can see this described in the Installation Guide for the thermostat linked from the article (it's called 'binding' in the guide).
- videah 1y ago
  The thermostats are paired, if my setup was able to control another apartments boiler then the original thermostat would also do that

badmonster 1y ago

loved the blend of reverse engineering and persistence

pinoy420 1y ago

[dead]

__turbobrew__ 1y ago

The legit Hackrf One is known to have frequency smearing, I wouldn’t use one off Aliexpress to transmit without testing it with a spectrum analyzer first (which you probably don’t have if you are buying knockoffs from Aliexpress).

KeplerBoy 1y ago
What does frequency smearing mean in this context?
- tgsovlerkhgsel 1y ago
  You're trying to transmit (only) on e.g. 433 MHz, but you actually transmit on 433 MHz and a bell curve around it.
  - KeplerBoy 1y ago
    so, severe LO clock drift?
    - __turbobrew__ 1y ago
      Not exactly, the transmitted power tends to be centered on the frequency you desire, but there are unwanted harmonics off the center frequency. Its like having a fire hose that hits the desired target with water (something on fire), but it also hits everything else around the target in a large radius as well which may be very sensitive to water (precious art, high power transformers, etc)
tgsovlerkhgsel 1y ago
The blogpost mentions "I guess it's always good to have another SDR just to confirm that we're not polluting other frequencies." and they have an RTLSDR which probably could serve as a good enough spectrum analyzer for this use case?

solarist 1y ago

One doesn’t actually need any extra hardware for this… just 8cm of wire and this https://github.com/F5OEO/rpitx https://github.com/F5OEO/rpitx (use at your own risk of course)

LeonM 1y ago
From the linked repo: > rpitx is a general radio frequency transmitter for Raspberry Pi which doesn't require any other hardware unless filter to avoid intererence. It can handle frequencies from 5 KHz up to 1500 MHz. Wait, how does that work? 1.5GHz is a _lot_, I can't imagine this is done with bit-banging an I/O line, nor do I expect the Pi will have a DAC with anything close to a 3GHz+ sample rate. > Plug a wire on GPIO 4, means Pin 7 of the GPIO header (header P1). This acts as the antenna. A bit of Googling shows me that on the later Pi board GPIO4 (pin 7) has a bunch of alternative modes, amongst which is a general purpose clock output (GPCLK0), a DPI output bit (DPI_D0) and what I recon is composite analog video in/out (AVEOUT_VID0, AVEIN_VID0), and the TDI JTAG pin. But none of these would get close to 1.5Ghz TRX capabilities, no? What's the magic here?
- solarist 1y ago
  RF is basically black magic but here it’s the harmonics of lower frequencies that are in GHz range (and very noisy and weak)
videah 1y ago
This did come up when I was researching this but it’s incredibly dangerous as you’ll be spewing all over the spectrum due to harmonics, I considered it too much of a hack for my liking

Mond_ 1y ago

Cool as fuc + very nice blog design.

pyfon 1y ago
Furry cartoons are catching on.

buccal 1y ago

Cool project. Speaking of newish natural gas (CH4) heaters, they all should have modulating thermostat capability with OpenTherm/eBus or other protocol. Combined with a thermostat with outdoor temperature sensor system efficiency is increased a few percent and that should help offset thermostat and installation costs. In the end you have more efficient modern heating system. Same should apply for heat pump systems.

steelegbr 1y ago
OpenTherm is a cool idea but even new installations aren't always wired for it. When installing a new smart thermostat I found the installation has been wired as S Plan with the few cables running between the boiler location and valves location already consumed. Makes the job much bigger if you're not prepared for it.
- buccal 1y ago
  There are many wireless OpenTherm thermostats. Wired is better but is not required for modern thermostats.

alistairSH 1y ago

Is this a non-standard thermostat control mechanism? I don’t know what’s common in apartments. All my houses have the thermostat wired to the HVAC (and are easily replaceable by the resident).

sokoloff 1y ago

> I also have it so the heating turns off when I go into town and turns back on when I'm just a few train stops away so my place is nice and toasty for me getting home! If your goal is saving energy/money, you don’t want a system capable of going from cool to toasty in 20 minutes. Instead, you want a system that runs (much) lower water circulation temperatures (giving lower losses in the unconditioned spaces and more even room heating). That can be done to any condensing boiler by just turning down the flow target temperature. A second layer of optimization on top of this is the addition of outdoor reset/weather compensation which will adjust that flow temperature based on the outside temperature, giving a flow temperature than can just barely restore the building to the desired setpoint temp. With mine properly tuned, I was targeting having the thermostat act more like a high-limit and for it to call for heat between 22 and 24 hours per day while not overheating the house. That often meant flow temps in the 110°F (warm day) to 135°F (below freezing day) range. Compared to the prior winter (at a constant 160°F flow), the house used 8-15% less gas and was wildly more comfortable. (This setup does preclude using deep setback settings, which also can save money, because recovery times are necessarily long in such a scheme, unless you have an even smarter control system that can run perfectly tuned water most times but hotter water during recovery from setbacks.)

frereubu 1y ago
I've read that it's always more efficient to turn heating off when you're not home and then turn it back on when you return. Is the reason for it being on 22-24 hours here that it takes a very long time to get back to the desired temperature, meaning you'd actually be cold for quite a while as it returned to the desired temperature?
- sokoloff 1y ago
  I work entirely remote so, other than travel, there are not many long periods when the house is unoccupied. I target the long run time to maximize efficiency. A 160°F pipe will lose more heat to the part of the building that I don’t want to heat as well as more heat to the wall right behind the radiators. It also results in the house going micro too-hot, too-cold, too-hot, too-cold as it cycles. Mine is constantly trickling in just enough heat to replace the heat lost instead of cycling between adding way more than needed then none for a while. Another large effect is that low return water temperatures into the boiler allow for greater condensation of exhaust gas energy to be used in the building instead of sent outside. Walking by my house on a cold day, you’ll see minimal steam plume during operation. All that steam I see my neighbors emitting is energy they paid for and delivered to the outside… (They paid a lot for a boiler with a 95% or 98% sticker and run it at 80% efficiency.) https://kw-engineering.com/how-to-optimize-condensing-boiler-system-maximum-energy-savings/ https://kw-engineering.com/how-to-optimize-condensing-boiler...

DecoPerson 1y ago

The Flipper Zero is great, and could handle all of the hacking/investigation part by installing custom firmware. The original product understandably arrives with heavily-restricted firmware (I imagine to reduce the amount of flak the company receives). However, it is incredibly easy to install Flipper Unleashed or similar, which removes all said restrictions and adds a lot of additional functionality. Possessing the tools that could be used to commit a crime is not necessarily a crime in and of itself! Just be careful with what you do or, depending on what country you’re in, you might find some men in suits knocking at your door. Personally, I wanted to replay “encrypted” 433MHz signals for my own devices (electric gate, roller door, roller shutters, …) and this was disabled with the Flipper’s region set to Australia.

0xEF 1y ago
> Possessing the tools that could be used to commit a crime is not necessarily a crime in and of itself! While I do agree 1000%, I also want people to be careful with this thinking since I have gotten in some minor trouble in the past. Always assume the authority questioning you can and will create whatever narrative they wish, that it will be accepted, and that your own reasoning will likely be used against you. I will always encourage exploration and curiosity in tech, but if we stick with the Flipper Zero example, there's a few things one should keep in mind, regardless of the jurisdiction they're in: * Don't carry it around unless you intend to use it. * Read all documentation before you start practicing, then practice being subtle. * Taking a note from my outdoorsy side, adopt the "leave no trace" ethos. * Pay attention to the effect your presence and actions have on the environment and your target and how that might be interpreted by an outside observer, then take action to mitigate suspicion. These apply to lots of devices, everything from your disposable smartphone to a cheap RFID card copier from Temu. Our eagerness sometimes gets the best of us, especially new-comers, and we want to jump to the part where we can be like the hackers we see in tv and video games. There's a reason those guys are fictional characters. Innocuous actions or not, the perception of the authority questioning you is all that will matter, in the end.
- crtasm 1y ago
  Or perhaps go for the opposite of subtle - in many places it's quite normal to see people in hi-vis vests taking readings etc.

sz4kerto 1y ago

We've moved to an new apartment (house) and we had to do a full renovation. It doesn't have modern insulation and I calculated that for the time being the ROI on insulation isn't worth it. It's a multi-floor semi-detached house and I wanted the best comfort and the most economical heating possible. In particular: stable and individually adjustable temperatures for bedrooms and living rooms; underfloor heating in some rooms (bedrooms), radiator-based heating in some others (living room), and combined UFH+radiators in some others (where UFH might not be enough during extreme colds). I thought I can just pay someone some money and they'll set up the controls for me. It must be a simple exercise, right? I could not have been more wrong. After spending a few hours of understanding the setups that "experts" have recommended, I figured out edge cases where they would be either wasteful or uncomfortable (meaning: unnecessary and inavoidable temperature overshoots or undershoots, etc.). I had many-many rounds with Honeywell, Tado, Siemens, etc. and every single one of them had _major_ issues. The renovation got a bit stuck because of this, but the plumbing was ready so I wanted to see whether the pluming and pumps are working, at least. So I connected the pumps and valves to "smart plugs", i.e. Zigbee-controlled plugs, so that I can see that they turn on. They did, which got me thinking... Right now I have $20 Zigbee temp sensors sprinkled across the house, $30 smart plugs and relays driving valves, pumps and the boiler, and Home Assistant is controlling the whole thing. Everything works perfectly and I could implement some features that simply no system would have done out of the box, for example in rooms where there's combined UFH and radiators I can drive both heating systems when the target temperature is far from the desired (so that the room heats up quickly) but as the room temp is getting closer to the target, the radiators are turned off so that UFH dominates heating (more comfortable and more energy efficient than radiators). In rooms with radiators, temp is +- 0.4 C within target, in rooms with UFH, it's +-0.1C within target.

darkwater 1y ago
Yeah, the automated/remote controlled heating system world, and also the ringbell world is basically a giant scam, since they are updates on world that also scammed you in the past. I cried when I shelled out so much money for my Tado device, but even a dumb bTicino device costed in the hundred of euros realm, and it's just a sensor + a small LCD display and a designed-in-hell menu system to program it. And the same happens in Ip-based ringbells. A Doorbird will cost you hundreds of euros for what is basically a webcam plus some nice metal casing and a shitty software, but it competes with analog systems with optic cables etc that cost basically the same or more.

rsynnott 1y ago

Some risk of collateral damage in the form of randomly controlling other peoples' boilers if your transmitter turns out to be more powerful than the one in the thermostat, tho...

frontlodjkgi 1y ago
I imagine even encrypted messages could be replayed if the protocol wasn't designed against it. It also doesen't say what kind of encryption it uses, it could be a very weak in-house "encryption", for all we know it could be only an unknown encoding.
videah 1y ago
The thermostat is paired with the boiler, the signals bundle the unique ID’s of each so this won’t happen. Otherwise there would be a risk the original thermostat would do the same.

robocat 1y ago

> sledgehammer approach A hammerier solution would be to control the temperature seen by the thermostat (ignore the difficult RF protocol). A heating element and a temperature reading could control the heat seen by the thermostat. I'm pretty sure you wouldn't need any cooling (Peltier or whatever). Just a heater and ambient cooling! Set the thermostat to a high temperature, and run the heater to make the measured temperature hotter: when you don't want the heating to run. That said, I think hacking the RF protocol is geekier and far awesomer.

poopiokaka 1y ago

[flagged]

kebokyo 1y ago
if i had a nickel for every time someone said the word "objectively" to make something seem more true when it's just, their opinion, man... i would be rich enough to lobby for government-mandated fursonas

gRoberts84 1y ago

I went through various stages of this myself and got an Sonoff RF Bridge, that allowed me to capture and replay RF via Home Assistant. In the end though, it was always easier to use an off the shelf solution, especially for boilers. OpenTherm with Tado worked perfectly.

gcanyon 1y ago

It's an awesome hack! It seems like the easier hack would be to put a peltier heater/cooler under the thermostat then control that remotely to assume control over what temperature the thermostat sees. The link to the exact model of thermostat isn't working, so I don't know how amenable its design is to this approach, but the thermostats I've used are generally wall-mounted and putting a heat/cool source under them wouldn't be too hard. You'd need to make sure that you didn't send both the heat and cool into the thermostat, but that's a simple positioning problem.

paulkrush 1y ago
Cool idea! It's ironic that this is such an efficient use case for device that is so inefficient.
catsma21 1y ago
yeah i put mine in the freezer
looofooo0 1y ago
Actually the best control system for such a boiler would be to control the heating curve where heating water temperature is fixed to the outside temperature. If you aim for the lowest water temperatures possible, then the system will become quite slow reacting. Then you only need to adjust the flow of water to the individual rooms to fix varying temperature issue. But this is long term manual optimization process which takes 1 to 2 years to perfect.

T3RMINATED 1y ago

[dead]

gwbas1c 1y ago

> The only thing I'm not happy with is needing to use a very powerful and versatile radio like the HackRF for something as simple as a boiler on/off switch. But I'd rather use something overkill and have it work than spend ages trying to force smaller radios to do my bidding. All the apartments I lived in had basic thermostats; and I even rewired and replaced one of them. What was blocking Videah from buying an off-the-shelf thermostat?

simooooo 1y ago
I’ve got a similar problem, and plan to replace the thermostat with a Shelly relay which can be toggled by home assistant’s events based on the TRVs in each room. Then the boiler is basically controlled by the relay.

aboardRat4 1y ago

In the former Soviet Union we just have central heating The government maintains indoor temperature at 24 degrees from October to May, and the water is heated at the power stations.

jobs_throwaway 1y ago
Jesus that sounds miserable. Sleeping at 75F?!
- mkevac 1y ago
  You would regulate temp by opening the window.
dzhiurgis 1y ago
And a €500 heating bill every month.
- mkevac 1y ago
  No, it was basically free.
  - aboardRat4 1y ago
    It's about 50 dollars per month.

MisterTea 1y ago

Instead of attacking a radio controlled relay, the author should have read up on how their heating system works. All they need is a relay controlled by an internet connected thing to replace the thermostat receiver. I could understand if the receiver was locked away but the video clearly shows they have access to the boiler.

wpietri 1y ago
That leaves very visible evidence that things have been hacked. Any time the landlord comes around you'd want to remove that. And if there's some sort of infrastructure emergency (plumbing problem, heat goes out, fire in the building) it could be very challenging to get there and remove all traces before the landlord is stomping around.
- MisterTea 1y ago
  Why would you be that paranoid? What laws exist in the UK where this is so illegal as to be that paranoid? That's a level of paranoia I would never have. You can easily conceal them in a way that is almost imperceptible.
  - wpietri 1y ago
    Paranoia? People generally don't like you messing with their stuff. They especially don't like it when you add sketchy-looking electronics to things that are expensive and can burn their property down. If you want to take a swing at it, I'm not stopping you. But after 30 years having landlords, plus having family and friends who are landlords, I think I have a pretty good sense of what can upset a landlord. Maybe yours will be super chill. Me, I'd rather go the radio route.

josefritzishere 1y ago

For a related hack... If your apartment building with a BACnet system, it also relies on a set of commands for heating and cooling. Assuming you are on the same VLAN as teh server, you can inject commands. The difficulty is that every BACnet server is somewhat different, though most have spec online.

epsilonaurigae 1y ago

OP removed their comment section, but if you’re here: I haven’t done this since 2014 but the google nest API used to (hopefully still does?) let you see and or set the thermostats status with curl commands. My use case was to run one shell script that got my burglar alarms status, and if it was “armed/away” to simply set my nest thermostat as away, too. But it can also be hooked up to a dummy load or a relay and just used as an indoor temperature sensor. And the curl commands OP is relying on can be tied in to indoor and outdoor temperatures , such as scraping local weather with curl/wget and based on that integer, turning the boiler to a minimum when it’s a certain temperature outside. Or turning it completely off when it’s warm outside. I’m about to revisit this again just because I have an ancient gas pig of a furnace that uses microvolt and is too cold when it’s cold outside, and too hot when it’s warm outside. So I need one thermostat in place to turn it on no matter what at 40F, but then some conditional logic to kick that thing on and off on different cycles based on outdoor temps. The whole systems too crude to implement one off the shelf without adding a zone controller, so I just want a Linux box at home to be the zone controller…. where I differ is that I’m not sending an RF signal to the boiler, I just have to close an NO contact to engage mine (and I’m lazily going to use the nest for that.) If anyone knows of a better thermostat that has its own API I can set, read sensors, turn hvac on and off without using google/nest account or having a dependency on the goodwill of their API existing forever , I’ll come back and glean any responses thanks in advance. As an afterthought, hm I can just attach temperature probes and a GPIO for a relay and indoor/outdoor temps and do away with google/nest altogether…. Thanks for jogging my brain a bit I might do exactly that. (The nest was cool , and educational, I guess, 12 years ago when I didn’t know how to really do anything but run and fire off curl commands on someone else’s hardware for temp sense and closing a relay and I don’t have anything bad to say about it as a starting point.) Where I was going with this , though, was that , you could use an off the shelf nest , and run 1) one command against API to get thermostat status (system thinks it’s on or off , even though it’s factually not directly controlling anything) and then based on that, 2) another command to your RF board to transmit a matching signal. … (However you could also do the same with a temperature probe that can be read on board or over WiFi , and then manage your setpoints in the script and or by other means: eg scraping a weather site for the local outdoor temp in your case where the landlord probably wouldn’t let you attach or connect an outdoor probe.) Bonus with the nest approach is you get a dial, can mount it on anything , doesn’t have to be the wall of your unit… and it “sort of works” like a normal thermostat as well, as soon as the shell script reconciles the two states manually. Long winded rant but the original use case was an apartment where the thermostat was proprietary and serialized data and I didn’t have any option to integrate a smart thermostat other than turning it to its maximum set point and then using the nest with a massive 220V/50A HVAC relay to just chunk the AC power line on and off on demand.

ambalangoda 1y ago

I just gotta say, I really like the animated gifs. Kudos to the blogger.

KennyBlanken 1y ago

What is with this absurd headline? Imitating your RF thermostat isn't "attacking" anything.

mattmaroon 1y ago

I would probably just go about this by heating/cooling the thermostat itself rather than messing around with radio signals. Put a little box around it and something that could control the temp in the box, like a little peltier element. When you want the heat to run, cool the inside of the box. When you want it to stop, warm it up. Etc. But then I build thermal control devices for fun so maybe it just seems like a much easier method to me.

pards 1y ago
X-10 devices [0] that do this have been around for a long time. I've even seen elaborate setups that can be controlled via a landline. [0]: https://thex10shop.com/products/x10-powerhouse-th2807-thermostat-set-back-controller?variant=6287992422432 https://thex10shop.com/products/x10-powerhouse-th2807-thermo...
- mattmaroon 1y ago
  Neat.

pete1302 1y ago

Men in Black suit knocking on the door for this is a First-world thing.

tgtweak 1y ago

I would have put a peltier/TEC below the thermostat to influence it's measured air temp vs resorting to reverse engineering and illegal signal broadcasting.

noncovalence 1y ago
If I understood the OP correctly, then the broadcasting would only be illegal in the US.
- archi42 1y ago
  Yes but no: The original device operates in the 868MHz band, which is a ISM band in the EU. However this band isn't availabe for public use in the US (IIRC some mobile phone cells operate in that band) - so the original thermostat is already illegal to sell/buy/use in the US. If you bought such a thermostat in the US (e.g. at walmart or what-do-I-know), that device would probably operate on 433 or 915 MHz. I think you can legally broadcast on these in the US, much like the OP did [in the UK]. Power limits might be a bit different and such. But IANAL and no US person, so do some research before grabbing a HackRF One ;-)

jorisboris 1y ago

I need this solution Our landlord installed a Honeywell home, the cheapest version, and it has no remote or timer capabilities And especially in winter it would be nice if it would jump on before we wake up!

xbar 1y ago

The UK's Online Safety Act is pretty horrific. Our friends in the UK have my sympathy.

lenerdenator 1y ago

> Please do your due diligence and check local laws before attempting anything I do in this post. Transmitting radio signals can become legally problematic very quickly, and the band I specifically transmit on here (868Mhz) is illegal in the United States without a license. I'd rather you didn't have men in suits knocking on your door on my account. You've been warned! Let's be honest here: the FCC is gonna have to see a helluva lot of problems coming from your transmissions before they bother to send the black Suburbans filled with men in suits to knock on your door. You're going to get a series of letters that basically say "please don't do that" if anything.

johnwalkr 1y ago
An American thermostat would be using around 920MHz which is the equivalent unlicensed band in the US. Funnily enough, the author warns Americans as an example but he is running more foul of the local rules an American would be (assuming an American would use 920MHz and not 868MHz). In the US you are allowed to tinker around there with home-built RF devices for personal use and prototyping in unlicensed bands, to some extent. Although, using an SDR for this requires a certain interpretation of the rules. In Europe it's basically not allowed, one shall only use pre-certified modules. Or only use the device you've built in an RF anechoic chamber until you've undertaken the certification process (totally impractical for a hobbyist).

cft 1y ago

Very interesting ending of the post: ```There was a comment section here. It's gone now. As of March 16th, 2025 the United Kingdom's Online Safety Act has gone into full effect. The law presents a lot of challenges for hobbyist websites like this one to present any user-to-user content (like y'know, blog comments) and comes with some pretty serious repercussions for non-compliance. The odds of Ofcom (the regulator whose job is to enforce this) kicking my door down over this blog are low if we are being honest with ourselves. But the odds are at least somewhere above zero and the punishment is a life ruining £18 million fine(!!) so it's just not worth the risk. A kind lawyer has written up the implications of this law for self-run blogs like this one and the only way to guarantee that I am not in-scope would be to manually review all comments made before being available to the public. Not to be a big baby about it all but I don't really want to do this! I liked my current setup! So I guess as a little act of protest and to hedge against any risk I've removed the comment section entirely. Sorry about that!```

newacc666 1y ago

[flagged]

p3rls 1y ago

This is basically why companies like HeatWatch have 90% market share for NYC landlords

m1n1 1y ago

Could the same radio be controlling other nearby boilers unintentionally?