Attacking My Landlord's Boiler

videah — Tue, 22 Apr 2025 00:00:00 +0000

Please do your due diligence and check local laws before attempting anything I do in this post. Transmitting radio signals can become legally problematic very quickly</em>, and the band I specifically transmit on here (868Mhz</code>) is illegal</strong> in the United States without a license. I'd rather you didn't have men in suits knocking on your door on my account. You've been warned!</p> </div> </div>

</div> </div> </div> </div> </div> A little while ago I moved into an apartment to live on my own for the first time. This has given me a decent amount of newfound freedom to sculpt my living environment to my liking, but not enough where I could start knocking down walls. I have a landlord (and a deposit!) to think about, after all. 🙂</p> While it isn't near the level of knocking down walls, I was finding heating my apartment rather frustrating. The boiler's thermostat installed by my landlord is a single radio-controlled unit that uses a built-in temperature sensor to modulate the heating on and off to meet a target temperature. This presents a few first-world problems:</p> The temperature sensor can only sample a single room in the apartment, which heats unevenly.</li> That room is dependent on the physical proximity of the thermostat's controls, which can be annoying to use if I might be in bed and the controls are in the living room or vice versa.</li> If I forget to turn the heating off before I leave the apartment, I'm wasting a lot of costly energy.</li> </ul> I automate things around my apartment with Home Assistant</a>, and I wanted to be able to do the same here. There are a lot of off-the-shelf solutions for this, obviously, but to get back to the knocking-down-walls comparison, they would require my landlord's cooperation and likely a visit from an electrician. I don't want that!</p> Instead, here's how I figured out how to control my apartment's heating in a way that leaves no trace using the existing thermostat already fitted by my landlord, and maybe learn a bit about radios along the way.</p> I knew that the thermostat communicated with the boiler through some kind of radio protocol. We could try to reverse-engineer the protocol from scratch, but as I'll get into later, that turns out to be very involved</em> and way beyond my minimal radio skills.</p> I eventually decided it was a lot easier to attempt something called a Replay Attack</a>. This involves cloning the signals sent between the boiler and the thermostat, and then pretending we</em> are the thermostat by re-broadcasting the signals. This way we don't need to understand the protocol, just replay it.</p> </div> </div> This approach requires some degree of luck and crossing your fingers. Replay attacks can be pretty easily thwarted by using an incrementing counter in the communications to nullify previous signals, ignoring signals with a counter value you've already seen. I was lucky the thermostat does not do this—your mileage may vary!</p> </div> </div> </div> </div> </div> </div> </div> The first thing I did was check to see if there was any information online about my specific thermostat. I came across a listing for the exact model I had</a>, along with a datasheet in the attachments section. The section on RF Communication</em> is exactly what I was looking for:</p> </picture> </figure> From this, we know the thermostat communicates around the 868Mhz</code> range. The Protocol: Encrypted</code> part was initially a bit concerning, but it turned out to not be a problem.</p> The first issue I'm running into here is that there are shockingly few resources on cloning a 868Mhz</code> signal online. Most beefy resources were about using LoRa/Meshtastic. I would come across a lot of Reddit posts of people trying to do the same thing as me for things like ceiling fans and garage doors, but nobody seemed to have any answers... 😭</p> </div> </div> </div> </div> I suspect</em> this is because unlicensed 868Mhz</code> transmission is illegal in the US and nobody cares about Europe, but who really knows. My life would be so much</em> easier if it were 433Mhz</code> instead, as there is a plethora of consumer-facing tools for communicating on that band.</p> </div> </div> </div> </div> </div> So without much to go on, I thought the first thing to do would be to actually see</em> the radio packets and inspect them. I'd read about Software-Defined Radios</a> in the past and guessed it'd be my best bet. Most SDRs are really</em> expensive, so I went with the budget RTL-SDR V4</a> off of AliExpress. (This actually ended up being somewhat unnecessary for reasons we'll eventually get to!)</p> </div> </div> You might have heard of the infamous Flipper Zero</a> and its ability to clone and replay signals. Maybe you're like me and consider using it in this situation, but be warned that the Flipper is NOT</strong> an SDR. The Flipper is very stingy about what frequencies it can operate on. I found this out the hard way when I borrowed one and assumed all was hopeless when it wouldn't work.</p> </div> </div> </div> </div> </div> </div> </div> After it arrived, I hooked it up to my laptop with the SDR++</a> software just to see if it worked and get an initial glimpse of my thermostat yapping. After pressing the thermostat's buttons a few times, I managed to see the waterfall light up!</p> </picture> The "waterfall" at 868Mhz showing long horizontal blips. </figcaption> </figure> </div> </div> </div> </div> Ignore the solid vertical line on the waterfall—this is just a common byproduct of using a really cheap SDR, and for me it appears nearby to any frequency I'm inspecting.</p> </div> </div> </div> </div> </div> This step isn't super important, but we can then try to use the rtl_433</a> tool (it works on other frequencies despite the name) to see if the thermostat is speaking a known protocol. More obscure devices might not work here!</p> </picture> </figure> It seems like this thermostat speaks the same protocol as another Honeywell one. The demand attribute sets whether the boiler is on (1) or off (0), and then the boiler responds with an acknowledgement (presumably so the thermostat can determine if it's out of range).</p> Now that we've actually seen the back-and-forth communication, we want to be able to send some packets ourselves and puppeteer the boiler as if we were the thermostat.</p> </picture> Using a 868Mhz Challenger Dev Board, first failed attempt... </figcaption> </figure> This was the step I got stuck on for months</em>. I was trying the "smart" route of attempting to reverse-engineer and reconstruct the packets by hand</em> using URH</a> and then broadcasting them with very cheap 868Mhz</code> microcontroller boards. I can safely say this was all wayyy outside of my skill set. None of the boards were really designed to talk to anything other than the exact same board</em>, and going any further than that required poking at radio registers in ways I wasn't comfortable doing.</p> I decided to then go for the sledgehammer</strong> approach: use a full-blown SDR to just replay the exact same signal without a care for what the signal actually contains. But the cheap RTL-SDR I got earlier only supports receiving, not broadcasting. SDRs that can broadcast are usually hundreds of dollars</em>.</p> I say usuallyyy</em> because one of the most common broadcast-capable SDRs, the HackRF One</code> (usually upwards of $400), had numerous clones available on AliExpress for a fraction of the price—just $40.</p> </div> </div> And then I say haddd</em> because, writing this months later, AliExpress has removed pretty much every listing you could find just searching "HackRF". From my understanding, they were getting nabbed at customs in a lot of countries that were getting pissy about importing a scawy hacking tool, so they just decided to nuke all the listings rather than deal with it. Newer clones can be bought from here</a>, but they aren't nearly as cheap as they used to be... 😭</p> </div> </div> </div> </div> </div> </div> </div> There are some obvious ethical (and probably a few technical) problems with cheap clones of what is meant to be open-source hardware, but I figured it'd be fine for my small use case. Please support the original hardware project</a> if it's within your means to!</p> </div> </div> </div> </div> As I kinda alluded to earlier, this makes the need for the RTL-SDR sort of redundant? But I guess it's always good to have another SDR just to confirm that we're not polluting other frequencies.</p> </div> </div> </div> </div> </div> With the HackRF in hand, we can use the hackrf_transfer tool</a> to record signals and, most importantly, replay</em> signals. I perform these commands and then press the appropriate controls on the thermostat to write the signals to individual files:</p> # We set the frequency to 868.3Mhz and the sample rate to 2000000. </span>hackrf_transfer -r turn_off.raw -f 868300000 -s 2000000 </span>hackrf_transfer -r turn_on.raw -f 868300000 -s 2000000 </span></code></pre> And then we can try and turn the boiler off and on from CLI like this:</p> # We use -a to turn on the amplifier and -x to increase the gain a tad. </span>hackrf_transfer -t turn_off.raw -f 868300000 -s 2000000 -a 1 -x 23 </span>hackrf_transfer -t turn_on.raw -f 868300000 -s 2000000 -a 1 -x 23 </span></code></pre> After doing this, I could hear the physical relay inside of my boiler turning on and off!</p> I have the HackRF plugged into a powered USB hub connected to my Home Assistant server. I wrote a very basic web server that simply shells out to the transmit commands above in a Docker container.</p> Then with an Average Sensor Plugin</a> and the config YAML below:</p> command_line</span>: </span> - </span>switch</span>: </span> </span>name</span>: </span>Boiler </span> </span>command_on</span>: "</span>curl http://docker-vm:1111/api/on</span>" </span> </span>command_off</span>: "</span>curl http://docker-vm:1111/api/off</span>" </span> </span>sensor</span>: </span> - </span>platform</span>: </span>average </span> </span>name</span>: "</span>Average Temperature</span>" </span> </span>entities</span>: </span> - </span>sensor.bedroom_thermostat_temperature </span> - </span>sensor.kitchen_thermostat_temperature </span> </span>climate</span>: </span> - </span>platform</span>: </span>generic_thermostat </span> </span>name</span>: </span>Boiler Thermostat </span> </span>heater</span>: </span>switch.boiler </span> </span>target_sensor</span>: </span>sensor.average_temperature </span></code></pre> </video> </div> We have a working controllable thermostat! 🤯</p> At this point I was just happy to have the thing working</em> after so many months, so I'll be the first to admit this setup with Home Assistant is a bit slapdash and could use some cleanup. It'd be better to write a proper plugin and control the radio directly instead of shelling out to the CLI. Relying on curl</code> to heat my apartment is maybe a bit cursed?</p> I've been using this setup to control the heating of my apartment since the beginning of December and haven't had any issues since! It's super convenient to dial in the temperature from my phone, and the automations I have make me feel like this project was really worth the work.</p> I have some basic automations like having the temperature go down when I'm sleeping and then up in the morning in time for me waking up, but I also have it so the heating turns off when I go into town and turns back on when I'm just a few train stops away so my place is nice and toasty for me getting home!</p> The only thing I'm not happy with is needing to use a very powerful and versatile radio like the HackRF for something as simple as a boiler on/off switch. But I'd rather use something overkill and have it work than spend ages trying to force smaller radios to do my bidding.</p> The important thing is I'm not as cold as I used to be! 🐺</p>

My E-Reader Setup

videah — Thu, 10 Aug 2023 00:00:00 +0000

I bought an e-reader recently, specifically the Kobo Libra 2</a>. I felt like I wasn't reading books/manga as much as I wanted and I think the convenience of being able to carry my entire library around with me will help with that. I own an iPad Pro but I wanted a device I didn't need to think about charging that often and wouldn't give me eye strain.</p>

This post is a bundle of notes about my current reading setup.</p>

</div> </div>

</div>

I had owned a Kindle Paperwhite before but it was so locked down that I couldn't find any joy out of using it since I was forced to use it how Amazon product managers wanted me to.</p> </div> </div>

</div> </div> </div>

I spent several hours doing research and I think the Libra 2 is the best device on the market at the moment, at least for my needs.</p>
I picked it up in white to try and make an important psychological distiction. I wanted it to differ from every other electronic rectangle I own and treat it more like a nice book rather than a computer that will inevitably make me angry. Which all things considered is quite funny with all the computer nonsense I ended up doing to it.</p>
It's got a 7-inch screen which is a little shy of the perfect Tankōbon volume</a> size, but close enough that manga is comfortable to read. I remember reading somewhere that the screen has one of the best contrast ratios in an e-reader and it is indeed very good.</p>
</picture>
The lineart of Junji Ito's Uzumaki looks very crisp on this display. </figcaption> </figure>
Navigation buttons are a dying breed in the e-reader space but I really can't live without them. Using a touchscreen to navigate is hateful</em> and is really fake skeumorphism. You can pretend all you want but it does not feel like you are flipping a page! Thankfully the Libra 2 has two buttons on the side where you hold it so you can go back and forth with just one hand.</p>
I got the very overpriced official SleepCover</a> case in orange. Matches my iPad case. Stops the plastic from making flexing sounds. It can let your e-reader stand upright for some reason.</p>

The only real book management software in town for e-readers is Calibre</a> but it's stuck in the late 2000's UNIX school of UI design and I reaaally don't want to deal with that kind of thing anymore. I want organising my books to feel comfy. I also don't want it to depend on having my laptop with me, constantly wiring it to my e-reader to sync new books.</p>
</picture>
Calibre on macOS. It is very noisy. </figcaption> </figure>
It's not perfect but Calibre-Web</a> works better for me. Despite the confusing name it's a completely distinct project that just happens to be compatible with Calibre's database format. I have it hosted on my personal VPS so I can access it anywhere and can give friends access if I need to. It's not quite Plex for books but it is close. The bootstrap UI is a little dated but it works for what I need.</p>

</div> </div>

</div>
</div>

I'm keeping my eye on a relatively new project called Librum</a> that's in its infancy. If it matures it promises some nice features like syncing reading positions and its own dedicated client.</p> </div> </div>

</div> </div> </div>

The default reader software the Libra 2 comes with is called Nickel and it's fine. It looks and runs ok enough and the built in Kobo Sync functionality can be tweaked to work with my Calibre-Web instance by replacing the endpoint in a config file, which I have to give Rakuten props for letting you do.</p>
But sideloaded files can be very broken. I was half way through a book before I realised Nickel was just throwing all of my notes and highlights into the void whenever I closed it, which was very rude. This is apparently a common problem that's been around for a while and it seems Rakuten have no plan to fix it anytime soon.</p>
I went looking around for some open source alternatives. Most people reach for KOReader</a>. It runs on pretty much everything and is packed with an ungodly amount of features and has a steady community built around it.</p>
</picture>
Comparing library views for KOReader and Plato. </figcaption> </figure>
But if I'm being honest I just can't find any enjoyment using it. The user interface just isn't up to snuff. It feels impossible to navigate and there is no real library view, only a file manager. When I'm holding my e-reader I don't want to be reminded that it is a computer all the time. It's meant to be a book!</p>
I came across Plato</a> which is made exclusively for Kobo devices and worked on by the guy responsible for bspwm. It's really fast and responsive, more so than Nickel even. The UI is pretty much exactly what I'm looking for. It's not nearly as feature complete as KOReader but it's written in Rust which is a language I feel confident enough in to tweak and implement things to my hearts desire. I've already made a small change that got merged upstream too!</a></p>

Originally I was using Kobo Sync with the endpoint changed to point to my Calibre-Web instance to sync my books wirelessly. But it was buggy and slow and could only pull in KEPUB files.</p>
Plato has a built in hook system</a> that lets you run arbitrary binaries when a directory is opened. Using this I wrote a small CLI tool that just pulls every book that hasn't been downloaded yet from my Calibre-Web instance using the OPDS protocol</a>.</p>

</div> </div>

</div>
</div>

I've stuck the code for this tool up on my Github</a> if anyone else is interested in using it!</p> </div> </div>

</div> </div> </div>
In the future I would like to take advantage of this hook system to also sync reading positions and other metadata Plato stores.</p>

I love plugging as many of my devices into my Tailscale network as I can and I thought it'd be a fun little project to try and get it running on the Libra 2. Someone had already done most of the work by getting it to run on the Kobo Sage</a>.</p>
It turns out it's a little harder for the Libra, I had to spend a ridiculous amount of time compiling some missing kernel modules in a horrendously slow emulated x86 emulator just to get this thing running. The joys of owning an ARM laptop. I think being able to type `ping kobo</code> and have it Just Work makes all the hours spent worthwhile though ☺️</p>`
</div> </div> </div> </div> I packaged all the work I done up nicely in an install script</a> so it should be dead easy to get this working on your Libra 2 as well.</p> </div> </div> </div> </div> </div> Tailscale has a built in AirDrop-esque file transfer feature</a> that I find really useful for quickly sending PDFs to my e-reader that I don't necessarily want to be a permanent part of my library.</p> </picture> Sending a PDF remotely with one click with TailDrop. </figcaption> </figure> Unfortunately I couldn't get Tailscale SSH working which was one of the main reasons I attempted this in the first place 😢 I'm not sure why but my first guess would be that I need iptable packet filtering but that would require swapping out the whole kernel which I don't feel comfortable doing at the moment. Maybe some day though.</p> The Libra 2 only has telnet support out of the box behind a developer cheat code (typing devmodeon into the search bar) which is fine because I'd be using it over a Tailscale wireguard connection anyway. My threat model doesn't exactly involve people bruteforcing telnet over public WiFi just to steal my furry books. But for completions sake I stuck the Dropbear SSH server</a> on mine and then disabled telnet.</p> The Libra 2 has 32gb of internal storage which is pretty huge for books considering how small EPUBs usually are. But I like reading manga which can be pretty hefty. An average volume is 200mb, with stuff like Uzumaki coming in at 800mb. What if I need to store every uncompressed volume of One Piece for offline reading in the event of the apocalypse?</p> Most e-readers treat manga as secondary to books and rarely offer higher storage options or mini-SD card slots anymore. Thankfully the Libra 2 has a mini-SD slot... it's just an internal one not meant to be user accessable 🫠</p> </picture> Libra 2 internals, SD card highlighted in the red circle. Image taken by MobileRead user 'supermighty'</a> </figcaption> </figure> This is better than not being able to upgrade the storage at all though and was actually one of the main things that pushed me in the Libra 2's direction when doing research. Someone on the MobileRead forums replaced the SD card and posted instructions on how to do so.</a></p> I haven't done this for mine yet but I plan on giving it a shot and sticking something utterly ridiculous like 512gb or 1tb in there. It seems like a pretty risky/messy mod to do though, the slot and card are caked in waterproofing glue that you'll need to reapply afterwards if you're like me and enjoy reading in the bath.</p> Even if this seems excessive it does let me sleep easier at night knowing I can replace the internal storage in the event it somehow fries itself.</p> This is a feature I didn't know I wanted till I used it. It's a pretty big leg-up over reading physical books when I can easily hold down on a word I'm not sure about.</p> I'm using the ebook-reader-dict</a> project which is based on Wiktionary since that's the one Plato recommends and is designed to work with. Unfortunately it's a bit hit or miss. I'm not too happy about the quality of the definitions sometimes, I'll probably look at alternatives at some point.</p> </div> </div> </div> </div> Plato renders the definitions without any padding which looks a bit weird. I can probably fix this easily in the code later though. Feels good using open source software sometimes.</p> </div> </div> </div> </div> </div> For reading, I use the font Atkinson Hyperlegible</a> which you might know from Cohost</a>, but it's also used by the very blog you're looking at now! I've fallen in love with it as it's really easy to read even when the text is very small. Very pretty and accessible.</p>

Some of the art used around this blog are by other people. Here is a list of them:</p>

Smug Videah by Kelevtov</a></li>
Rantsona Sidebar Videah by ScruffKerfluff</a></li>
Callout Pixel Art Videah by lockedsdcard</a></li>
Videah Mutant Standard Emoji by Caius Nocturne</a></li> </ul>

For reading, I use the font Atkinson Hyperlegible</a> which you might know from Cohost</a>, but it's also used by the very blog you're looking at now! I've fallen in love with it as it's really easy to read even when the text is very small. Very pretty and accessible.</p>

videah's blog

Plex Might Be Indavertently Bottlenecking You

Attacking My Landlord's Boiler

Credits

My E-Reader Setup

Web Push Pitfall

Howdy, Is This Thing On?