13 ms·
I hacked my washing machine
- bblou 1y agoI'm surprised you let your washing machine into your network. I now get the appeal of just an alert the washing machine is done. But I could not for the life of me allow any of these kinds of devices onto my home network. Even in isolation...
- stavros 1y agoWhy wouldn't you allow it in isolation?
- yjftsjthsd-h 1y agoHow isolated are we talking? A device that only has access to the internet can still get botnetted and send malicious traffic from your IP. Or burn your data cap, or spy on you for the vendor.
- stavros 1y agoBut the comment said "I wouldn't allow it on my local network", not "I wouldn't allow it on the Internet".
- aspenmayer 1y agoLAN is being used in an under specified way. To my reading, a separate VLAN or standalone LAN for the washing machine wouldn’t be on “my (main/primary LAN is assumed here) local network” if I mean that “my local network” doesn’t have untrusted devices on it. I tend to read these kinds of comments with a bit of wiggle room because sometimes folks disagree about if VLANs are actually isolated enough to consider them separate local networks, as the same device may do routing and firewall or VLAN tagging, so there is isolation in principle, but bad actors can’t be expected to comply with network security policies. I guess I can see how each of you could be right to their own reading.
- stavros 1y agoI agree otherwise, but they said "even in isolation", which removes the ambiguity.
- aspenmayer 1y agoBy they, do you mean that you said that? They said it here: https://news.ycombinator.com/item?id=44704593 https://news.ycombinator.com/item?id=44704593 But when you responded, am I bound by their context or yours? For clarity, I am responding to you both in a good faith steelman manner, so please respond in kind. I thought the ambiguity remained, because different people have different opinions about network isolation, what it entails, how it may be implemented securely, and how different implementations have different implications regarding failure to maintain isolation in the event of a security breach that compromises networking equipment. Most folks aren’t running diodes at home. If your isolation relies upon configuration of reconfigurable equipment and/or VLANs, that isn’t isolated to readings that require or imply a highly secure computing environment. https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
- wrboyce 1y agoFor untrusted IoT devices I’ve found that sticking them on the IoT VLAN (so no device-to-device communication, and either no or extremely limited internet access; but I let my trusted clients punch through to IoT devices) has allowed me to retain all functionality whilst being confident they’re not up to anything I don’t want or expect.
- ahoef 1y agoThis is my setup. I find this to be a reasonable balance for comfortable life. Except my printer, that gets no Internet so it cannot update to some crappy firmware that nags about supplies.
- neoden 1y agoWhy?
- doubleg72 1y agoIt's fairly simple to keep these devices isolated and if you have a decent firewall, you shouldn't have much to worry about. Keeping them in a separate, internet-only VLAN with peer to peer isolation is typically the standard protocol. That said, in a lot of cases, even keeping the isolated doesn't resolve any privacy concerns. Also, with some devices, you have to open up mDNS.
- EspadaV9 1y agoMy dryer doesn't have a delay function accessable via the front panel, it's been "app gated", and the only way the app can talk to it is via WiFi, so if I ever need to set a delay, I have to use the app. All IoT devices are on their own VLAN though, and where possible firewalled off too. I can easily imagine more features being locked behind the app for future models.
- j45 1y agoCreating an IoT wifi that is one way is reasonably possible. Someone shared this pdf written by someone that had a nice overview that is transferable to any router. https://github.com/mjp66/Ubiquiti https://github.com/mjp66/Ubiquiti
- timedout_uk 1y agoHey, blog author here. It only had access to the internet for a brief second, and even then it was on an entirely separate network because of how I just set up my openwrt router as a client to the main network. Our guest network is completely isolated, an explicit firewall rule had to be added so that my script could communicate with the washer while it's on this network. It has no access to anything but itself, and occasionally hears the screams of my script demanding it serves up data. It has access to nothing, only my script has access to it - I don't see a risk here. I still have the heebie jeebies knowing it's connected to anything at all, or even the fact that it can do that, but also spending a night hacking a washing machine was incredibly funny to me and totally worth it. Plus, got some useful notifications out of it.
- sgarland 1y agoI have all IoT devices in a VLAN, with a traffic rule that they can’t respond to any external requests unless they initiated it. Good enough for me, but everyone’s level of comfort is different.
- KolibriFly 1y agoFor some folks the "just let it talk and see what it says" curiosity wins out
- madaxe_again 1y agoRespect, but this is kinda the hard way - I just plugged mine (dumb machine, not smart) in via an energy metering plug, and when energy use drops to less than 10W for more than 2 minutes, it’s done - very simple homeassistant automation. Convenient for me as the machine is 500m from the house.
- bombcar 1y agoNow I want to know why your washing machine is half a kilometer from your house.
- snickerdoodle12 1y agoSeriously, me too. I also want to know how they transport the laundry to/from the machine. I'm hoping for a conveyor belt of sorts.
- pastorhudson 1y agoThe factory must grow!
- rogerrogerr 1y agoVacuum tube system like a bank drive through.
- ash_091 1y agoA well aimed wind-compensated tshirt cannon.
- madaxe_again 1y agoA backpack, currently, although one of my myriad projects is a rack railway for when I am old and feeble.
- grishka 1y agoThem living on a farm is the only explanation I can come up with.
- gausswho 1y agoThis is what Hacker News posts should be.
- Biganon 1y agoYES. More actual hacking (as in tinkering), less LLM bullcrap that recently beat some metric I don't give a fuck about
- beached_whale 1y agoThat's https://hackaday.com/ https://hackaday.com/ :)
- lillecarl 1y agoPractical engineer in me screams: SIMPLIFY, SIMPLIFY, SIMPLIFY. Just plug the washing machine into a smartplug and alert when power draw drops to idle for more than X minutes.
- timedout_uk 1y agobut where's the fun in that :P
- pavel_lishin 1y agoOur previous washing machine had a mechanical rotating switch, sort of like an egg timer, built into it. I seriously thought about just gluing a pair of metal bits onto it to make a physical connection when it was done, which would either do something clever like trigger a RasPi into sending me a text, or something stupid like physically triggering a doorbell chime.
- bilinguliar 1y agoI suggest pushing washing machine metrics to Prometheus, it just asks for it.
- procflora 1y agoI'd say laundry is more Sisyphean than Promethean in my experience.
- csmattryder 1y agoOne must imagine the washing machine user happy.
- pentamassiv 1y agoUnless you are using a rooted Android, putting your own certificates on your phone is annoying. They need to be in the system certificate store which is, as far as I know, only possible with a Magisk module. An easier way is to run an Android virtual device with an older Android version on your computer. You can then use some scripts to add the certificates and proxy the traffic to Burpsuite or mitmproxy. That way you also don't have to switch devices. It would also be interesting to use APKLab or Jadx to look at the code of the app. Maybe you can find the key derivation algorithm. The app and the washing machine must somehow generate keys or have pre-shared secrets. If I understand correctly, the app only works if both devices are in the same network? I like that
- laurencei 1y agoI did something with my Bosch washing machine (not like the OP). My washing machine is at the other end of the house from my home office. Sometimes I would put a load of washing on, and despite setting an alarm, might forget (perhaps I am in an important meeting etc). So I decided to solve it. Using the Bosch API - I can tell both when a cycle is complete, and if the door is open. Currently I use their default version, but there is a local hosted option I'll be switching too now the proof of concept works. So using Home Assistant I have a simple script that detects when a washing machine cycle is complete AND the door has NOT been opened. This implies my washing machine has wet clothes still in it. So Home Assistant will alert my phone (and my wife only if she is home based upon presence detection) once every 15mins that there are wet clothes waiting in the washing machine. Very simple - works perfectly.
- 05 1y agoYeah I tried to use the builtin sensor on my LG one but it turns out, there's no 'door open' sensor per se, only the 'locked successfully' signal. So I had to add an external Zigbee reed switch door sensor..
- SecretDreams 1y agoI occasionally do a washing load before bed that I know I might not wake up for to put into the dryer. Fortunately, my machine has an "extended tumble" cycle of sorts that will keep the clothes fresh all night at the expense of a bit more water, but while saving my bedtime routine. We end up with a lot of these nighttime loads because we're toasted all day watching kids and we prioritize laundry off-peak electricity hours. Love my Electrolux, but I imagine many brands have a comparable feature.
- GuB-42 1y agoIf you like these kind of posts, maybe you should go to https://hackaday.com/ https://hackaday.com/ it is all articles like this every day, though usually more on the hardware side. Here is one in the same vein: https://hackaday.com/2023/04/15/internet-of-washing-machines-solves-an-annoyance/ https://hackaday.com/2023/04/15/internet-of-washing-machines... => https://tratt.net/laurie/blog/2023/displaying_my_washing_machines_remaining_time_with_curl_jq_pizauth.html https://tratt.net/laurie/blog/2023/displaying_my_washing_mac...
- firesteelrain 1y agoAssuming the only reason this works is because the washing machine and app don’t use TLS 1.2 and instead some homegrown Caesar cipher? Otherwise, you would need some MitM style attack?
- timedout_uk 1y agoThe washing machine doesn't use TLS at all and instead opts to just XOR data, explained later in the post.
- firesteelrain 1y agoI understand. I was saying how this could have been avoided by the manufacturer
- ethan_smith 1y agoMany of these consumer IoT devices use either plaintext protocols or implement weak encryption with hardcoded keys in the firmware, making packet capture and analysis possible without traditional MitM techniques.
- firesteelrain 1y agoI understand. I am asking whether if the certs were in the device and the app would this have fixed it
- Ecko123 1y ago[dead]
- xyst 1y agoI am contemplating hacking my washing machine "smart" module into its original silicon dust and replacing with a dumb interface. Anybody interested in this write up? Might even include a "Office Space"-esque montage of the smart module destruction.
- senectus1 1y agothat was a very easy to read article. I really enjoyed it and now want to start poking around my "smart" appliances.
- userbinator 1y agoThe washing machine REALLY liked talking to... itself? I don't think whoever engineered their networking stack knew what a loopback interface was, because it was sending a lot of traffic from itself to its own IP address. I didn't think this was relevant, so I ignored it. It really liked sending traffic to 255.255.255.255 every second, for some reason. Again, ignored Are those gratuitous ARPs? This is a common behaviour.
- gibs0ns 1y agoThat was my exact thought. I've seen this a lot on IoT devices, to detect IP collisions/changes.
- timedout_uk 1y agoPossibly, I completely forget ARP exists most of the time. I didn't pay much mind to it anyway, I was too bemused at the constant requests from/to its own IP rather than using loopback
- xd1936 1y agoI have a magnetic Zigbee vibration sensor on my washer and dryer connected to Home Assistant. I hadn't thought of monitoring smart outlet current/voltage instead, that's a good idea too.
- linker3000 1y agoThat's how I do it. I have a smart plug on the washer dryer and the power consumption gets sent via MQTT to Node-RED where some simple monitoring and trigger conditions update a dashboard and send an email to myself when the washing machine starts and when it stops. That's good enough for our needs. The machine does have an app and Bluetooth, but I can't see the point of spending the time reverse engineering the protocol, and the app is never going to be activated on my phone because it wants access to camera, sound, phone and my contacts list. Edit: It seems some integration work has been done for HA: https://github.com/home-assistant-HomeWhiz/home-assistant-HomeWhiz/blob/main/README.md https://github.com/home-assistant-HomeWhiz/home-assistant-Ho...
- gorfian_robot 1y agothis guy needs a Clapper
- bob1029 1y ago> when your "three hour" (usually like 4-5 hours) load finishes What kind of laundry cycles are we running here? My machine finishes a normal "eco" cycle in <30 minutes. It also beeps really loudly when it's done. The combination of quick cycles and simple notification signal keeps me out of the weird tech solutions rabbit hole.
- tallanvor 1y agoI'm guessing you're in the US? European washing machines take longer due to requirements around lower water and electricity usage. Plus, it looks like that device is a combined washer and dryer, and they take even longer. My washer normally takes 104 minutes on the regular cycle, but if it decides I've overloaded it, it can take as long as 3 hours! And mine is just a washer.
- bob1029 1y agoAt what point is it taking too long regardless of other factors? Laundry is uniquely hellish in that you have an entire pipeline of it that need to be processed. Getting barely 3 loads done per day seems comical to me. This might be acceptable in a dishwasher but not a laundry machine.
- tallanvor 1y agoMany people in Europe don't even have a dryer, so they're often not doing more than one load a day. And really, unless you have a really large family, you probably don't have to do laundry every day anyway. In Norway they also structure your electricity fees to discourage running multiple appliances at once. --For example, to keep my flat delivery rate as low as possible I have to keep my peak usage under 2KWh. That is, for each day of the month they take the hour when you used the most electricity and average the 3 top values. Yes, it's annoying to think about if I want to wash and dry at the same time, and whether or not I'm going to use the oven or something else while doing laundry.
- ash_091 1y agoAre people really running three loads of laundry a day?
- KolibriFly 1y agoThis is the kind of nerdy homebrew problem-solving that makes tech fun again
- steven555 1y agoIm hacking my fridge, its not software but a hardware hack, its an expensive motorhome fridge, runs on gas, 12vd, and 220v, it had an internal fire on the electronic controller, so it fried the cables and internals but the fridge is still more or less ok. the idea, is to rather than buying a new control board (250usd) which would need extensive work to refit as all plugs cables are shot, to replace this with a new system that i basically cobble together out of parts from an old gas boiler, so the gas boiler has all the parts on the motherboard to make the spark generator, for the gas burner, then all i need is the logic and safety, and i might be able to have it run on gas only with some different logic and control, it saves me a new fridge, and its a fun project to show my 9 year old boy about electronic engineering. I know its not a job for everyone as there is gas involved etc. but normally I get a lot of resistance on my similar hacks but when there finished the blowback normally dies down. It's a fun job, if anyone is interested in hearing how it will go, let me know and ill consider making a full post about it.
- darknavi 1y agoI started "hacking" my propane grill (OK just trying to cludge some repairs) and decided after a few hours that I am not confident enough in my own work to muck with anything around flammable fuel.
- beeforpork 1y agoHmm, I don't see any encryption. In the first screenshot 'cyberchef.avif' in the 'input window, the data is just unencrypted hex ASCII. I can fairly easily read the hex: even judging only from the first byte 7D, it is most probably JSON: 7D = { 0D0A = CRLF 09 = TAB 22 = " 73 = s 74 = t 61 = a 74 = t 75 = u 73 = s 4C = L 74 = a .... So that is just the 'decoded' text. Where's the mentioned XOR encryption? Also, the 'key' in the second screen shot is a nibble (=one hex character) out of alignment of the listed bytes. It also is not cut from the gap that is in the input text now, as suggested by the visual presentation: the 'key' is 'D0A097D0D0A7D' which is 13 hex digits, and again, a nibble out of byte alignment. It looks like a 0 must have preceeded to make it '0D0A09...' = CRLF TAB, and it total that's 'CRLF TAB { CRLF {'. But the gap was originally '24F70...', which, aligned to bytes, was '224F70...' = '"Op...' So, the screen shots appear to be bogus or fake or edited. Why? What's going on here?
- timedout_uk 1y agoSorry about that, the screenshots were taken after I'd already done everything and was writing up the blog, since I didn't have the original data to hand. I forgot to include this in the post, but at some point after rebooting the washing machine (I still can't get over how insane that sounds) while writing my notification script, the machine started returning unencrypted yet still encoded data, which is why in the script's poll loop attempts to deserialize the bytes as JSON first, only on failure trying to run it through decryption. Sometimes it's returning encrypted data, sometimes it isn't, and sometimes it's just spitting actual garbage down the wire. I did also modify the screenshots to blank out some bytes, but you can probably see where that is. None of this was faked, it's just an incredibly dumb smart appliance. If I can capture it sending encrypted data again, I'll update the post with corrected screenshots.
- mjg59 1y agoFirst up: this isn't criticism of the original post in the slightest, it's a wonderful journey through figuring out how a weird device that wants to be on your wifi works. If you have a device that speaks to an Android app, you want https://github.com/niklashigi/apk-mitm https://github.com/niklashigi/apk-mitm - it'll strip pretty much every known certificate pinning implementation from an apk, and it'll also rewrite the manifest so it'll trust the user-installed certs without having to root your device to modify the system store. Uninstall the original app, sideload the output of apk-mitm, and then you can use mitmproxy on a stock device. The other thing is that if a device is providing encrypted data to an app, and the app is displaying the decrypted data, then the app inherently either contains the decryption key somewhere or downloads it from somewhere. https://github.com/skylot/jadx https://github.com/skylot/jadx will turn an apk into something that approximates Java, and digging through that will often let you figure out what the key is. But some vendors will decide that the appropriate way to handle this is to kick the cryptography out to native code, at which point you're into having to RE something in Ghidra. Depending on your mindset this is either incredibly tedious or incredibly fun, but it's generally possible. The author was able to build on top of work that had been done by others, but if you're ever faced with a situation where nobody else has done that work, don't just give up. It's worth spending time trying to figure out how code running on a device you own works, and even if you don't succeed in the end you're probably going to learn a lot in the process.
- Neywiny 1y agoEven if it's not for a device. I have an app that like most apps only gets worse every update. I stopped all auto updates, backdated, all good. Eventually it stopped being able to connect to the servers. I heard about cert pinning, saw this repo, and tried it. Flawless victory. And because its ad URLs are out of date or something, I see no ads. Which I don't feel bad about because again, all their development effort was in turning something working into something not working.
- f4ye 1y agonot to overshadow apk-mitm, but i find PCAPdroid and its MITM plugin (which uses mitmproxy under the hood!) to be convenient, if you want to look at things on the device.
- 1a527dd5 1y agoImage link after "For now, I plugged this key into CyberChef, and was able to decrypt the data." is broken. Specifically this element: <a href="https://nexy.blog/2025/07/27/how-i-hacked-my-washing-machine/0006-How-I-hacked-my-washing-machine/cyberchef-2.avif https://nexy.blog/2025/07/27/how-i-hacked-my-washing-machine..." class="hoverZoomLink"><img alt="CyberChef decrypting the washing machine's response" src="https://nexy.blog/0006-How-I-hacked-my-washing-machine/cyberchef-2-small.avif"></a> https://nexy.blog/0006-How-I-hacked-my-washing-machine/cyber...
- timedout_uk 1y agoThanks for the catch, fixed now. Might need to clear your cache.
- klinquist 1y agoReminds me of when I hacked my (and your?) water heater! https://www.linquist.com/tech/waterheater https://www.linquist.com/tech/waterheater
- Mo3 1y ago> As mentioned in one of the opening paragraphs, this washer has a tendency to take longer than it says it will. I feel like that's true for every washing machine that has ever existed