I hacked my washing machine | Hacker News Reader

I hacked my washing machine

nexy.blog

371 pointsJadedBlueEyes166 comments

First up: this isn't criticism of the original post in the slightest, it's a wonderful journey through figuring out how a weird device that wants to be on your wifi works.

If you have a device that speaks to an Android app, you want https://github.com/niklashigi/apk-mitm - it'll strip pretty much every known certificate pinning implementation from an apk, and it'll also rewrite the manifest so it'll trust the user-installed certs without having to root your device to modify the system store. Uninstall the original app, sideload the output of apk-mitm, and then you can use mitmproxy on a stock device.

The other thing is that if a device is providing encrypted data to an app, and the app is displaying the decrypted data, then the app inherently either contains the decryption key somewhere or downloads it from somewhere. https://github.com/skylot/jadx will turn an apk into something that approximates Java, and digging through that will often let you figure out what the key is. But some vendors will decide that the appropriate way to handle this is to kick the cryptography out to native code, at which point you're into having to RE something in Ghidra. Depending on your mindset this is either incredibly tedious or incredibly fun, but it's generally possible.

The author was able to build on top of work that had been done by others, but if you're ever faced with a situation where nobody else has done that work, don't just give up. It's worth spending time trying to figure out how code running on a device you own works, and even if you don't succeed in the end you're probably going to learn a lot in the process.

Even if it's not for a device. I have an app that like most apps only gets worse every update. I stopped all auto updates, backdated, all good. Eventually it stopped being able to connect to the servers. I heard about cert pinning, saw this repo, and tried it. Flawless victory.

And because its ad URLs are out of date or something, I see no ads. Which I don't feel bad about because again, all their development effort was in turning something working into something not working.

not to overshadow apk-mitm, but i find PCAPdroid and its MITM plugin (which uses mitmproxy under the hood!) to be convenient, if you want to look at things on the device.

"The author was able to build on top of work that had been done by others, but if you're ever faced with a situation where nobody else has done that work, don't just give up." If I couldn't strike lucky with an xor brute force, my next plan of attack was to start poking at whatever android app they had. It was only because my friend happened to find that someone else had already done it on github that I managed to take the shortcut. If we hadn't found that github I'd probably have a far more detailed writeup so that other people could follow on with their own appliance, if they happen to have the same/a similar one.

+1 on this... I was actually surprised this wasn't one of the earlier efforts, as to me it would have been one of the first things I tried. Given the webview aspects of the app, I wouldn't be surprised if it was using something webcrypto was capable of int he app ui, with the key relatively obvious to yank out.

I'm a big fan of using web rendering for UI apps, but most devs are less interested in how to implement real security. Or add theatrical additions that just don't work with reality.

I did something with my Bosch washing machine (not like the OP). My washing machine is at the other end of the house from my home office. Sometimes I would put a load of washing on, and despite setting an alarm, might forget (perhaps I am in an important meeting etc).

So I decided to solve it.

Using the Bosch API - I can tell both when a cycle is complete, and if the door is open. Currently I use their default version, but there is a local hosted option I'll be switching too now the proof of concept works.

So using Home Assistant I have a simple script that detects when a washing machine cycle is complete AND the door has NOT been opened. This implies my washing machine has wet clothes still in it.

So Home Assistant will alert my phone (and my wife only if she is home based upon presence detection) once every 15mins that there are wet clothes waiting in the washing machine.

Very simple - works perfectly.

Yeah I tried to use the builtin sensor on my LG one but it turns out, there's no 'door open' sensor per se, only the 'locked successfully' signal. So I had to add an external Zigbee reed switch door sensor..

I occasionally do a washing load before bed that I know I might not wake up for to put into the dryer. Fortunately, my machine has an "extended tumble" cycle of sorts that will keep the clothes fresh all night at the expense of a bit more water, but while saving my bedtime routine. We end up with a lot of these nighttime loads because we're toasted all day watching kids and we prioritize laundry off-peak electricity hours. Love my Electrolux, but I imagine many brands have a comparable feature.

The equivalent on mine (a Bosch) is to wait to start anything at all until 1 cycle-time less than ten specified number of hours. Churning all night instead seems a peculiar design choice.

I use the Delay feature. It will wait to start the wash for a settable amount of hours.

Ooooh, I need to see if I have this one! There's a companion app, but I've opted not to set it up yet. Don't really need my appliances in wifi.

Does your machine not have a delayed start function? I’m standing in front of about 40 washing machines right now and they all appear to have this function.

Often a button labelled ‘Ending in’.

Australian market.

My Chinesium washer uses 0.4kWh per load. 4 cents worth of arbitrage.

My washing machine is a "dumb" machine from the '90s. The wash cycles run based on the position of a glorified timer knob: it doesn't have a computer or sensors to detect if it needs extra time aside from the water fill stages. Thanks to this consistency, I just set a 40 minute timer on my phone, and it's always done by then. Can't get much simpler than that. If I need reminders, there's always the alarm snooze function.

... Do they not still make these?

I miss old machines. My wife’s Bosch takes 90min to 2.5 hours for most cycles. Tho there is a 30 minute super quick cycle

But the fast cycles of olden day cames at a price in terms of power draw and water usage, so it’s unfortunately similar to missing incandescent light bulbs.

Keep that dumb washing machine from the 90s, I can almost guarantee you that a new washing machine is not meant to last as long. Maybe 6-7 years if you are lucky.

Miele.

Miele from my grandmother still running here, 1988 machine! No defects, still pristine inside. No guarantee though that today's Miele is the same quality.

They are. Bought a washing machine more than a decade ago, still going strong, and a dishwasher more recently and it was every bit as solid as the rest.

So, maybe. And also maybe not.

https://www.forskning.no/forbruk-ntnu-partner/er-vaskemaskin... (in Norwegian) quotes research from the Norwegian University of Science and Technology.

The article says that a washing machine used to last 20 years, and now only lasts 10 years. However, it also says that machine usage has doubled, from four to eight times a week. So, the new machine lasts the same number of cycles, but the number of cycles is reached much faster.

An article from 2025 is pulling data from a 2003 study that compares usage from the 1960's to what I assume is 2003, right when He and CPU controls were starting to become popular.

My 1990's Whirlpool lasted for 25 years before a barrel support rusted out. It had a mechanical timer and did a good job cleaning my clothes. Now I have this awful HE LG thing that I ALWAYS use the bedding mode otherwise it just mashes the shit out of everything destroying my clothes. HE feels like a conspiracy by big clothing to sell you more clothes, destroying the environment while fooling you into thinking you're saving it by conserving water.

There's an easy fix for that, put your clothes in these 'washing bags' that was always good to prevent wear but sounds like that might be what you need

Mashing the shit out of it is what actually washes your clothing without high temperature and minimal amount of detergent. I can't stand top loader washers that are ubiquitous here in NZ - they are so useless.

I solve this problem by only wearing burlap sacks.

We’ve had a few scares. Last year, it didn’t stop filling and caused some flooding across a few rooms before we caught it. Earlier this year, the plastic on the knob mount was so brittle it snapped off. We’ve been servicing it, and we’ll keep it going as long as we can.

That works great if you are the one turning the machine on. But not is someone the turns it on

Checked my privileg.. still humming

It's actually really, really easy to get the state of a "dumb" washing machine (or any other electric machine) into Home Assistant using a smart plug. You can use something really basic like "power draw for > n seconds followed by no power for > m seconds" to detect when a cycle is finished. You can get way fancier and look at power draw curves to determine what part of a cycle it's in, or which cycle, if you really want to. You can add a door sensor (recommend Samsung) if you want to know if the door's been opened.

Unfortunately it's much harder to do the same for an electric dryer, since there's no inexpensive or good smart plugs for 240V last I checked.

I know nothing about US 240V power circuits — what plugs do you use, could you get by with a Euro system?

I use Eve Energy smart plugs, which seems to be supported in Home Assistant through the matter integration. Local first, no bullshit remote account requirements, good quality, around 40€ / USD 45.

https://www.evehome.com/en/eve-energy

I believe that US 240V is 2 hots, neutral, and ground. EU 240V is one hot, one neutral and ground. EU 400V (380V) is 3 hots, neutral and ground.

None of this is cross-compatible.

Pity - thank you!

> I believe that US 240V is 2 hots, neutral, and ground.

Correct. Its called split phase, a 240V transformer is center tapped and that tap is grounded to create the neutral. Either end of the transformer to neutral is 120v and end to end is 240V.

> EU 400V (380V) is 3 hots, neutral and ground.

Three phase 230/400: 400V is line (hot) to line with 230V line to neutral. More for industrial use but I hear some homes can have this service for whatever reason.

> None of this is cross-compatible.

Not really. A 230/400 volt system also supplies 230v single phase. A 230 volt European device will work fine on 240V split phase unless it has a motor which will run faster on 60 Hz which could overload it. Though I have a machine with a three phase 380 volt 50 Hz motor running happily on 230/400 60 Hz from an autotransformer supplied by 120/208 60 Hz. Just runs 20% faster.

> > EU 400V (380V) is 3 hots, neutral and ground.

> Three phase 230/400: 400V is line (hot) to line with 230V line to neutral. More for industrial use but I hear some homes can have this service for whatever reason.

It varies from country to country in Europe. In the UK you'll almost never find 3-phase in a home, in Sweden even apartments usually have 3-phase supply. In my Swedish apartment the only thing connected to more than one phase is the induction hob.

Or just pay 10€ for an ikea plug (INSPELNING). I do not understand people always paying a x10 premium for eve.

This is (largely) what I have for my "dumb" washer. What makes mine unique is the washer is in my apartment building's cellar, too far for Wifi. So I have a LoRa transmitter that routes the message to a LoRa receiver on my home network.

Unfortunately, as you noted, I haven't figured out how to handle the dryer as the load is too much for all the smart plugs I've found. I wish there was a clamp-style monitor on an extension cord, but it seems that is something which doesn't exist.

Thankfully, the dryer isn't as much of an issue since dry clothes can sit there until I remember to get them.

You can use a vibration sensor for the dryer.

I considered that, but the washer and dryer are stacked (limited space) so the vibrations of the washer would be picked up in a dryer vibration sensor.

Is that really a problem though? If you're washing another load at the same time as the dryer is running, wouldn't you generally want to wait until both are done anyways so you can swap the wash to the dryer after getting the dry load out?

Also at least in my experience the dryer takes longer to run than the washer, so if I've just rotated a previous load and started both at the same time I'm always waiting on the dryer to be able to do the next one.

Not always. I only put sheets and towels in the dryer, everything else gets hung up. So I may do two or even three washing loads in the time of a single dryer load (it can be very slow). So I'm much more interested in when the washer finishes than the dryer.

I tried that, and found dryers actually vibrate so little that most sensors have a hard time reliably detecting it.

I wonder if it would be practical to McGyver a solution into place by coiling some wire around / next to the dryer's power cable - to detect flowing current - and connecting the coil to an Arduino / Raspberry Pi

Maybe? I'm not super great with electrical work.

My understanding is that detecting an electrical current through a power cord typically doesn't work when measuring all the wires together, because the current in the live wire is canceled out by the return current in the neutral wire. This is why clamp-style meters are usually put at the electrical panel, where individual wires are accessible. Since I live in an apartment, that isn't an option for me.

Seems like it's not really a great plan, but could maybe be made to work:

https://electronics.stackexchange.com/questions/634852/exter...

It's also possible that your machine lets off some elecromagnetic noise you can detect directly.

The other thing you could try is put some sort of a microphone / vibration on it, then train a small NN on the waveform to distinguish between the washer and dryer.

You can use a vibration sensor on the dryer.

What’s the actual amperage of your dryer? A Sonoff Pow can take 20A. Add a fuse or breaker.

You might be able to set something up using a current clamp connected to an esp32, though it might have to go over a point where the wires are separated so possibly inside the machine. Might not be too hard depending on how you feel about opening up your dryer.

I do this for my washing machine, drier, dishwasher and also 3D printer, in the UK. Have some Z-Wave Greenwave PowerNodes, hooked into Home Assistant. Works great. I also have Alexa hooked into Home Assistant so I was able to make it announce through our Echo Dot when a cycle for any of those devices completes.

For the dryer think even simpler: get a Esp32 with a SW-420 vibration sensor, stick it on top of the machine somewhere, and look for vibrations. Since most dryers don’t have cycles, it’s really easy to detect if they’re running or not. There’s even a potentiometer on the SW-420 so you can adjust the sensitivity without reprogramming the ESP32.

I use an AI agent running on an old Android phone to monitor the position of the switch with the camera and let me know when it's straight up and down or side to side, since those are the four off positions of my knob. (kidding but maybe not by this weekend)

CT clamp could work, but dunno if there are inexpensive ones.

How about using sound?

Extra credit for discerning washer vs dryer, recognizing "done" buzzer/bell, etc. Might be useful if your dryer has a "wrinkle guard" feature; buzz and then keep tumbling on low heat.

For the washer, you could probably also discern portion of the cycle (fill, agitate, spin, drain).

I have been planning to implement something similar with my countertop oven - however having no API or other connectivity, I was planning on simply plugging it via a smart plug, and using the power draw measurements to determine whether it's idle or not (that is, arm when power draw transitions to above idle, then alert once it drops back to idle).

That's actually a super elegant solution: simple logic, real-world impact

I have a G-Shock 5600 watch that can alert me when my washing machine is finished. At the start of the cycle I take note of the total time it takes, I set that time on the timer of the watch and hit start. It will beep once the washing machine is finished. Been doing that for about 15 years now.

It works with all brands regardless of API.

Of course this doesn’t work with variable cycle times.

Then you'll just add 15-30 minutes, and it will still work ;)

Respect, but this is kinda the hard way - I just plugged mine (dumb machine, not smart) in via an energy metering plug, and when energy use drops to less than 10W for more than 2 minutes, it’s done - very simple homeassistant automation. Convenient for me as the machine is 500m from the house.

Now I want to know why your washing machine is half a kilometer from your house.

Seriously, me too. I also want to know how they transport the laundry to/from the machine. I'm hoping for a conveyor belt of sorts.

The factory must grow!

Vacuum tube system like a bank drive through.

A well aimed wind-compensated tshirt cannon.

A backpack, currently, although one of my myriad projects is a rack railway for when I am old and feeble.

Them living on a farm is the only explanation I can come up with.

Correct. Have several houses on the land, and it made more sense to put the machine where it was both equidistant between them and where the washing line is.

No, the obvious over engineered solution would be to mount the machines on a train (or tracked vehicle for bonus points) that can come when called and go where needed!

The problem (scratch that, "the most interesting challenge") with that is that a washer needs a water supply line, water release outlet (if not for chemicals, might not be the issue on a farm) and electricity (perhaps a simple problem to get power connections to it through the rail like trains).

I’m envisioning docking stations - power is relatively easy with pantographs and similar things, water could be gravity fed into holding tanks …

Nah, you just put a 5-10kwh battery on there, along with a small water tank and pump - a load of washing (in Europe) only uses 50L and about 2kwh tops - up to 5 with drying. The rest of the battery powers the drive train for the vehicle. Then you just have a dock for charging and water replenishment. We only use zero phosphate eco detergent, so waste can be dumped wherever. Maybe position it to water some plants when it drains.

You know, my whole life is madcap projects (today is running half a km of fibre down the inside of a live water main) so I’ll update you when I have a mobile laundromat.

Sounds cheaper to just get multiple washing machines instead :D

One reason I can think of - in some places where houses are small (like in cities the UK) you might not have a garage on your property and might rent one nearby (they are often in little rows, e.g. [1]). So they might have that kind of situation and have the washing machine there if it's a very small house?

1. https://www.alamy.com/stock-photo-row-of-private-car-garages...

It's tough times: their villa has a washing room in the servants block away from the house, but now they had to release everyone but the valet, housekeeping, masseur and hairdresser, so the washer role has been eliminated and now they need the notification for their valet to go pick it up.

Yeah this is my approach too. Though I need to revisit the thresholding.

I do the same,works great. I liked it so much that im doing the same with my microwave, after removing the annoying beeper it had. Now i get a decent single short beep and can monitor how often I've used it.

Couldn't you just set a timer for 45 minutes, or whatever? Is there that much variance in load times?

Some washing machines (mine at least) have some "smart" features that adjust the wash time depending on some factors. Nothing more annoying than coming to the laundry after my phone alarm goes off, and seeing the timer on my washing machine go UP(!!!) from 0:01 to 0:02 ...

Eliminating any unneeded manual steps adds reliability. The load done thing goes off when the load is done, you don't forget to start it.

Smart plugs are cheap enough where it doesn't take a lot of convenience to justify it.

Nex is a cybersecurity student in a house of similar people, they're gonna take every way :3

quote:

> The plan is, in future, since we can't hack something that doesn't have a brain, to instead attach a brain to it. The dishwasher is easy, we can just whack that on a smart plug and monitor when the power use surges and drops. The dryer is a bit more difficult, since they pull a LOT of power, and smart plugs typically either don't support that much power, or are incredibly expensive. So that's likely going to be some fancy vibration sensor-based thingy

Vibration sensor is exactly what I did, for exactly that reason. Zigbee sensor + home assistant and a little bit of timer logic to manage the state

Shelly has power meters with clamps, so that the meter is not in-line. There are probably Zigbee variants out there.

This is what I do - when the washer finishes, a light turns on in the kitchen letting us know. Then, when the dryer has drawn power for 10 seconds, the light turns back off, because that’s a good indication that someone dealt with the wet laundry. (Sometimes things get out of sync but not often!)

That's also my approach and works great.

I used Shelly plugs for for the washer and the dryer. Put little Go application on my server in the basement and get Telegram notifications + HTTP interface updates about the different states (running, finished, standby).

This saved a lot of forgotten loads .

I have a magnetic Zigbee vibration sensor on my washer and dryer connected to Home Assistant. I hadn't thought of monitoring smart outlet current/voltage instead, that's a good idea too.

That's how I do it. I have a smart plug on the washer dryer and the power consumption gets sent via MQTT to Node-RED where some simple monitoring and trigger conditions update a dashboard and send an email to myself when the washing machine starts and when it stops. That's good enough for our needs.

The machine does have an app and Bluetooth, but I can't see the point of spending the time reverse engineering the protocol, and the app is never going to be activated on my phone because it wants access to camera, sound, phone and my contacts list.

Edit: It seems some integration work has been done for HA: https://github.com/home-assistant-HomeWhiz/home-assistant-Ho...

This is what Hacker News posts should be.

YES. More actual hacking (as in tinkering), less LLM bullcrap that recently beat some metric I don't give a fuck about

lots of interesting LLM posts on HN

I should probably look into filtering out the LLM stuff with uBlock Origin rules or something.

That's https://hackaday.com/ :)

Unless you are using a rooted Android, putting your own certificates on your phone is annoying. They need to be in the system certificate store which is, as far as I know, only possible with a Magisk module.

An easier way is to run an Android virtual device with an older Android version on your computer. You can then use some scripts to add the certificates and proxy the traffic to Burpsuite or mitmproxy. That way you also don't have to switch devices.

It would also be interesting to use APKLab or Jadx to look at the code of the app. Maybe you can find the key derivation algorithm. The app and the washing machine must somehow generate keys or have pre-shared secrets.

If I understand correctly, the app only works if both devices are in the same network? I like that

Im hacking my fridge, its not software but a hardware hack, its an expensive motorhome fridge, runs on gas, 12vd, and 220v, it had an internal fire on the electronic controller, so it fried the cables and internals but the fridge is still more or less ok. the idea, is to rather than buying a new control board (250usd) which would need extensive work to refit as all plugs cables are shot, to replace this with a new system that i basically cobble together out of parts from an old gas boiler, so the gas boiler has all the parts on the motherboard to make the spark generator, for the gas burner, then all i need is the logic and safety, and i might be able to have it run on gas only with some different logic and control, it saves me a new fridge, and its a fun project to show my 9 year old boy about electronic engineering. I know its not a job for everyone as there is gas involved etc. but normally I get a lot of resistance on my similar hacks but when there finished the blowback normally dies down. It's a fun job, if anyone is interested in hearing how it will go, let me know and ill consider making a full post about it.

I started "hacking" my propane grill (OK just trying to cludge some repairs) and decided after a few hours that I am not confident enough in my own work to muck with anything around flammable fuel.

The washing machine REALLY liked talking to... itself? I don't think whoever engineered their networking stack knew what a loopback interface was, because it was sending a lot of traffic from itself to its own IP address. I didn't think this was relevant, so I ignored it. It really liked sending traffic to 255.255.255.255 every second, for some reason. Again, ignored

Are those gratuitous ARPs? This is a common behaviour.

That was my exact thought. I've seen this a lot on IoT devices, to detect IP collisions/changes.

Possibly, I completely forget ARP exists most of the time. I didn't pay much mind to it anyway, I was too bemused at the constant requests from/to its own IP rather than using loopback

> when your "three hour" (usually like 4-5 hours) load finishes

What kind of laundry cycles are we running here?

My machine finishes a normal "eco" cycle in <30 minutes. It also beeps really loudly when it's done. The combination of quick cycles and simple notification signal keeps me out of the weird tech solutions rabbit hole.

I'm guessing you're in the US?

European washing machines take longer due to requirements around lower water and electricity usage. Plus, it looks like that device is a combined washer and dryer, and they take even longer.

My washer normally takes 104 minutes on the regular cycle, but if it decides I've overloaded it, it can take as long as 3 hours! And mine is just a washer.

At what point is it taking too long regardless of other factors? Laundry is uniquely hellish in that you have an entire pipeline of it that need to be processed. Getting barely 3 loads done per day seems comical to me. This might be acceptable in a dishwasher but not a laundry machine.

Many people in Europe don't even have a dryer, so they're often not doing more than one load a day. And really, unless you have a really large family, you probably don't have to do laundry every day anyway.

In Norway they also structure your electricity fees to discourage running multiple appliances at once. --For example, to keep my flat delivery rate as low as possible I have to keep my peak usage under 2KWh. That is, for each day of the month they take the hour when you used the most electricity and average the 3 top values. Yes, it's annoying to think about if I want to wash and dry at the same time, and whether or not I'm going to use the oven or something else while doing laundry.

Are people really running three loads of laundry a day?

Most of the time (i.e. when you don't stuff it full of stuff) a fast cycle (30-40 mins tops) is just as effective...

I live in Europe, too. I cannot find the pictogram right now, but the one that resembles a feather lasts ~45 minutes and it goes through everything.

My dryer takes three hours because it is ventless (aka worthless). A regular load of laundry takes 4.5 hours to wash and dry. It’s the worst appliance I have ever had the displeasure of operating. It has no redeeming qualities. Sometimes it doesn’t even dry the laundry.

Some ventless dryers work really well. We have a Bosch 800 series and it works nearly as well and almost as quick as the electric vented dryer it replaced. On the other hand, we owned a Siemens ventless and I don't think it ever dried a piece of clothing.

Thanks, this is a rental so I didn’t get to shop around. I’ll give ventless dryers another chance if I am ever in a purchasing position.

For anyone else in the market avoid Blomberg. Specifically never buy https://www.blombergappliances.com/products/24-ventless-heat....

Bosch and Siemens is the same company (BSH, Bosch Siemens Home Appliances).

I also have a ventless, but it is a washr/dryer all-in-one unit.

It probably also takes 4.5 hours to wash and dry, but I wouldn't know because it happens when I'm sleeping (which just happens to be the same time as the ultra-low time-of-day electricity rates where I live) . It's pretty great. Definitely recommend.

My laundry room is under my bedroom so the noise is disruptive. Especially when the anti-wrinkle setting runs for three hours on a load of towels.

Longer cycle does better job with microbes removal, especially with enzyme and activated oxygen bleach based detergents. In 30 min your machine just "rinses" the laundry to get a scent.

https://pubmed.ncbi.nlm.nih.gov/25207988/

The dryer kills the microbes.

Only in high temperature.

Again, Europe. Different from the US. European dryers generally don't heat above 45-60C, which isn't very effective at killing microbes. They do, however, use less electricity and are gentler on fabrics. Personally, though, I hang up my clothes and only use the dryer for sheets and towels.

European dryers do not get that hot. You need over 75C consistently for a minimum of amount of time so the fabrics can heat through and hold that temperature. The sterilization process is basically the same as Tyndallization.

the "cotton" (delicates) program on this machine is a 3hr 4min program by its own preset, so usually stuff like bedding or softer clothing, or generally just things that I want to be washed same-day (that also won't survive one of the more rapid washes, or just requires an actual thorough wash) because it'll prevent me doing something otherwise. Issue is the machine is constantly recalculating how much time is left, seemingly based on stuff like the temperature or weight of the load or something like that, so when it starts on 3 hours, it can be four hours until it's done in 30 minutes, and then it sits on the last 5 minutes for over 45 minutes. I've waited six hours for my bedsheets, a blanket, and some pillowcases to wash before! It truly is one of the washing machines of all time.

Image link after "For now, I plugged this key into CyberChef, and was able to decrypt the data." is broken.

Specifically this element:

<a href="https://nexy.blog/2025/07/27/how-i-hacked-my-washing-machine..." class="hoverZoomLink"><img alt="CyberChef decrypting the washing machine's response" src="https://nexy.blog/0006-How-I-hacked-my-washing-machine/cyber...

Thanks for the catch, fixed now. Might need to clear your cache.

I am contemplating hacking my washing machine "smart" module into its original silicon dust and replacing with a dumb interface.

Anybody interested in this write up? Might even include a "Office Space"-esque montage of the smart module destruction.

Hmm, I don't see any encryption. In the first screenshot 'cyberchef.avif' in the 'input window, the data is just unencrypted hex ASCII. I can fairly easily read the hex: even judging only from the first byte 7D, it is most probably JSON:

    7D   = { 
    0D0A = CRLF
    09   = TAB
    22   = "
    73   = s
    74   = t
    61   = a
    74   = t
    75   = u
    73   = s
    4C   = L
    74   = a
    ....

So that is just the 'decoded' text. Where's the mentioned XOR encryption?

Also, the 'key' in the second screen shot is a nibble (=one hex character) out of alignment of the listed bytes. It also is not cut from the gap that is in the input text now, as suggested by the visual presentation: the 'key' is 'D0A097D0D0A7D' which is 13 hex digits, and again, a nibble out of byte alignment. It looks like a 0 must have preceeded to make it '0D0A09...' = CRLF TAB, and it total that's 'CRLF TAB { CRLF {'. But the gap was originally '24F70...', which, aligned to bytes, was '224F70...' = '"Op...'

So, the screen shots appear to be bogus or fake or edited.

Why? What's going on here?

Sorry about that, the screenshots were taken after I'd already done everything and was writing up the blog, since I didn't have the original data to hand. I forgot to include this in the post, but at some point after rebooting the washing machine (I still can't get over how insane that sounds) while writing my notification script, the machine started returning unencrypted yet still encoded data, which is why in the script's poll loop attempts to deserialize the bytes as JSON first, only on failure trying to run it through decryption. Sometimes it's returning encrypted data, sometimes it isn't, and sometimes it's just spitting actual garbage down the wire. I did also modify the screenshots to blank out some bytes, but you can probably see where that is. None of this was faked, it's just an incredibly dumb smart appliance. If I can capture it sending encrypted data again, I'll update the post with corrected screenshots.

I suggest pushing washing machine metrics to Prometheus, it just asks for it.

I'd say laundry is more Sisyphean than Promethean in my experience.

One must imagine the washing machine user happy.

I'm surprised you let your washing machine into your network. I now get the appeal of just an alert the washing machine is done. But I could not for the life of me allow any of these kinds of devices onto my home network. Even in isolation...

Why wouldn't you allow it in isolation?

How isolated are we talking? A device that only has access to the internet can still get botnetted and send malicious traffic from your IP. Or burn your data cap, or spy on you for the vendor.

But the comment said "I wouldn't allow it on my local network", not "I wouldn't allow it on the Internet".

LAN is being used in an under specified way. To my reading, a separate VLAN or standalone LAN for the washing machine wouldn’t be on “my (main/primary LAN is assumed here) local network” if I mean that “my local network” doesn’t have untrusted devices on it. I tend to read these kinds of comments with a bit of wiggle room because sometimes folks disagree about if VLANs are actually isolated enough to consider them separate local networks, as the same device may do routing and firewall or VLAN tagging, so there is isolation in principle, but bad actors can’t be expected to comply with network security policies.

I guess I can see how each of you could be right to their own reading.

I agree otherwise, but they said "even in isolation", which removes the ambiguity.

By they, do you mean that you said that?

They said it here:

https://news.ycombinator.com/item?id=44704593

But when you responded, am I bound by their context or yours? For clarity, I am responding to you both in a good faith steelman manner, so please respond in kind.

I thought the ambiguity remained, because different people have different opinions about network isolation, what it entails, how it may be implemented securely, and how different implementations have different implications regarding failure to maintain isolation in the event of a security breach that compromises networking equipment. Most folks aren’t running diodes at home. If your isolation relies upon configuration of reconfigurable equipment and/or VLANs, that isn’t isolated to readings that require or imply a highly secure computing environment.

https://en.wikipedia.org/wiki/Unidirectional_network

For untrusted IoT devices I’ve found that sticking them on the IoT VLAN (so no device-to-device communication, and either no or extremely limited internet access; but I let my trusted clients punch through to IoT devices) has allowed me to retain all functionality whilst being confident they’re not up to anything I don’t want or expect.

This is my setup. I find this to be a reasonable balance for comfortable life. Except my printer, that gets no Internet so it cannot update to some crappy firmware that nags about supplies.

Why?

It's fairly simple to keep these devices isolated and if you have a decent firewall, you shouldn't have much to worry about. Keeping them in a separate, internet-only VLAN with peer to peer isolation is typically the standard protocol. That said, in a lot of cases, even keeping the isolated doesn't resolve any privacy concerns. Also, with some devices, you have to open up mDNS.

My dryer doesn't have a delay function accessable via the front panel, it's been "app gated", and the only way the app can talk to it is via WiFi, so if I ever need to set a delay, I have to use the app. All IoT devices are on their own VLAN though, and where possible firewalled off too. I can easily imagine more features being locked behind the app for future models.

Creating an IoT wifi that is one way is reasonably possible.

Someone shared this pdf written by someone that had a nice overview that is transferable to any router.

https://github.com/mjp66/Ubiquiti

Hey, blog author here. It only had access to the internet for a brief second, and even then it was on an entirely separate network because of how I just set up my openwrt router as a client to the main network. Our guest network is completely isolated, an explicit firewall rule had to be added so that my script could communicate with the washer while it's on this network. It has no access to anything but itself, and occasionally hears the screams of my script demanding it serves up data.

It has access to nothing, only my script has access to it - I don't see a risk here. I still have the heebie jeebies knowing it's connected to anything at all, or even the fact that it can do that, but also spending a night hacking a washing machine was incredibly funny to me and totally worth it. Plus, got some useful notifications out of it.

I have all IoT devices in a VLAN, with a traffic rule that they can’t respond to any external requests unless they initiated it.

Good enough for me, but everyone’s level of comfort is different.

For some folks the "just let it talk and see what it says" curiosity wins out

Reminds me of when I hacked my (and your?) water heater! https://www.linquist.com/tech/waterheater

> As mentioned in one of the opening paragraphs, this washer has a tendency to take longer than it says it will.

I feel like that's true for every washing machine that has ever existed

Assuming the only reason this works is because the washing machine and app don’t use TLS 1.2 and instead some homegrown Caesar cipher?

Otherwise, you would need some MitM style attack?

The washing machine doesn't use TLS at all and instead opts to just XOR data, explained later in the post.

I understand. I was saying how this could have been avoided by the manufacturer

Many of these consumer IoT devices use either plaintext protocols or implement weak encryption with hardcoded keys in the firmware, making packet capture and analysis possible without traditional MitM techniques.

I understand. I am asking whether if the certs were in the device and the app would this have fixed it

Practical engineer in me screams: SIMPLIFY, SIMPLIFY, SIMPLIFY.

Just plug the washing machine into a smartplug and alert when power draw drops to idle for more than X minutes.

but where's the fun in that :P

True, we all find enjoyment in different things

The fun is that you can reuse the setup for a japanese toilet, monitor energy use and use the data to play applause sounds in the bathroom after use.

Pretty sure Japanese toilets support this use case natively.

They DO have extensive settings on the LCD on the back of the remote if you pull it off the wall...

Our previous washing machine had a mechanical rotating switch, sort of like an egg timer, built into it. I seriously thought about just gluing a pair of metal bits onto it to make a physical connection when it was done, which would either do something clever like trigger a RasPi into sending me a text, or something stupid like physically triggering a doorbell chime.

Some models do have an end-of-cycle chime on one of the timer contacts.

My washing machine also makes a stupid chime melody thing. A microphone that listens for it would also be a simple way to do it.

I would go for the "monitor a number" before "sound recognition", unless you're talking about just using an amplifier to bring the chime into the entire house.

I'd dump cut the mic and wire it to some input before actually trying to check for the sound. But it's probably inconvenient to get to and monitoring overall power draw would be easy.

Or a current sensing transformer around its power cord.

Can confirm this is super easy. It has the additional advantage of monitoring power usage and it allows you to cut power if the leak sensor under it goes off

Not all washing machine appliances are same, unfortunately

Does your machine run on petrol or manual labor? In that case, listen for an engine or someone complaining.

I'm certain 99% of washing machines are powered by electricity, and if you live in 120V town and need 3 phase you can monitor power using the magnetic field on one of 3 conductors.

This is the kind of nerdy homebrew problem-solving that makes tech fun again

If you like these kind of posts, maybe you should go to https://hackaday.com/ it is all articles like this every day, though usually more on the hardware side.

Here is one in the same vein: https://hackaday.com/2023/04/15/internet-of-washing-machines... => https://tratt.net/laurie/blog/2023/displaying_my_washing_mac...

that was a very easy to read article. I really enjoyed it and now want to start poking around my "smart" appliances.

this guy needs a Clapper

Reply on news.ycombinator.com