Flume Water Monitor 915 MHz Security Is Pretty Good
3 hours ago
- The Flume Water Monitor uses 915 MHz encrypted RF between sensor and bridge, which the author defeated with weeks of effort.
- The signal uses 2-FSK modulation at 200 kbps with frequency hopping; the message structure includes a 16-byte AES-128 ECB encrypted payload.
- The AES key was weakened to 44-bit effective security due to unencrypted header bits and a constant byte, allowing brute-force in about a day on a GPU.
- The author informed Flume, who acknowledged the issue and are already improving security; the post was released with their consent.