Dev hacks Coway air purifier to cut it off from the cloud
A developer discovered a security vulnerability in the Coway Airmega IconS air purifier, allowing him to cut it off from the cloud and control it locally through Home Assistant.
The method took advantage of a security hole — the fan downloads the certificate over plain HTTP — and now his Home Assistant server stands in for Coway's cloud. The result: no more dealing with the unreliable integration that ran through Coway's IoCare cloud, which broke 'at least once or twice a year.'
Replacement device
Goldman detailed why and how he performed the hack, starting with replacing a dumb Airmega that was 'an overpriced box fan with a HEPA filter and an air quality sensor.' The replacement Airmega IconS, now discontinued but with Wi-Fi support, had inconsistent Home Assistant integration.
AI assistance
ChatGPT obliged and wrote the firewall rules, and an AI he doesn't name later rebuilt the fan's Bluetooth setup in about 20 minutes.
He decided to take matters into his own hands with AI, although he noted that Claude's guardrails blocked his request to set up his Raspberry Pi to intercept the fan's traffic under the cybersecurity category, 'not even for... uhh... testing purposes.'
Related
