Using chat demo to talk to danfoss link

[fasmide]

Hi guys

Im trying to establish communication with my danfoss link device as you've kind enough provided danfoss prod configuration in https://github.com/trifork/secure-device-grid/blob/master/demo/mdg_config.c#L153 however activating this configuration (in mdg_unix_main.c and compiling the chat app, makes it unable to connect:

10:35 $ make
cc -o unix_main -Wall -I../../include -DMDG_DYNAMIC_LIBRARY ../mdg_unix_main.c ../mdg_chat_client.c -L. -lmdglib -lm -lpthread -lrt
echo Launching runix chat demo, dynamically linked:
Launching runix chat demo, dynamically linked:
LD_LIBRARY_PATH=.: ./unix_main
Welcome to TDG-lib chat demo.
Please provide e-mail using "/email test@example.org"
Type "/h" for list of commands. All commands start with "/"
Callback: mdguser_control_status state=connecting
Callback: mdguser_control_status state=failed
... continues to fail ... 

In trying to debug the matter I've tried to compile with -DDEBUG_TO_UDP - this however makes the demo app unable to compile:

10:36 $ make
cp -p ../../binaries/sandbox/ubuntu/libmdglib.so .
cc -o unix_main -Wall -I../../include -DMDG_DYNAMIC_LIBRARY -DDEBUG_TO_UDP ../mdg_unix_main.c ../mdg_chat_client.c -L. -lmdglib -lm -lpthread -lrt
/tmp/ccOMtjDx.o: In function `main':
mdg_unix_main.c:(.text+0xa27): undefined reference to `mdg_debug_log_target_ip'
mdg_unix_main.c:(.text+0xa2d): undefined reference to `mdg_debug_log_target_ip'
mdg_unix_main.c:(.text+0xa37): undefined reference to `mdg_debug_log_target_port'
mdg_unix_main.c:(.text+0xa41): undefined reference to `mdg_debug_log_target'
collect2: error: ld returned 1 exit status
Makefile:13: recipe for target 'unix_main' failed
make: *** [unix_main] Error 1

I've also tried to enable the debugging with the methods described in the docs (mdg_set_debug_target and mdg_enable_remote_logging) - this does however not seem to output any debug messages - and it does not seem to send any udp packets as well

Is there any way to debug this ? - is the danfoss configuration complete or is more needed to communicate with the danfoss mdg?

[mortengrouleff]

Sorry, but you are not going to be able to communicate with "Danfoss Link" using this code.
Danfoss Link uses another variant of secure device grid, which is not compatible with the client code here.

[donnib]

@fasmide did you find another solution to this ? I decompiled the Android APK file to figure out the protocol but have not dig into it enough. @mortengrouleff Any hints maybe ? ;)

[mortengrouleff]

@donnib You need to reach out to Danfoss if you want a solution.

[fasmide]

@donnib i did not, i also had a go at reverse engineering the app but the communication between the device and app is very complicated with that lua thing in the middle creating a tunnel in a tunnel (or whatever the thing does) - i did manage to enable some debugging in the app and rebuild it, reveling some pretty sane json objects being transmitted between the app and the controller so once a connection is established it should be straightforward.

I did find traces in the app of a "local mode" where the app is supposed to talk to the controller directly over lan but i dont think they never turned it on

The apk i unpacked had a compiled lua thing in it (cant remember the name of it, but it was compiled specifically for arm processors) but it also had the complete "secure-device-grid" source code in plain lua, allthough i think the lua code was an older version somehow left over by some automated build system - if the lua code is still there check it out as it has lots of hints as to how to communicate with secure-device-grid and how to make the connection to your controller

Edit: just checked, the latest apk does not have the lua source files, but you can download an older version from apkpure or similar

[toini]

@fasmide I'm looking into the traffic being transmitted by a Danfoss Devi Smart thermostat in order to communicate with the device myself. I've been able to reverse engineer it so that I know it also is using the Secure Device grid Platform for communication. However, my MITM attack on Android 6 with a mitmproxy failed since the libmdglib does not seem to respect the phone's proxy settings. I've now been analyzing the traffic with Frida, but am having a bit troubles reading the C structures being sent to the library.

Could you maybe share details on how you managed to read the JSON objects being transmitted?

[ChristianHC]

@toini The MDG library uses certificate pinning so you won't be able to MITM it. The traffic being sent is Protobuffed and you need a .proto map to decode it

[mortengrouleff]

@ChristianHC @toini The SDG library used in DeviSmart and the app is not the same as the MDG used in the Link system. One uses Nacl (https://nacl.cr.yp.to/), the other TLS. Yes, both use certificate pinning.

[toini]

@ChristianHC I've previously bypassed certificate pinning with a Frida hook (see e.g. https://blog.netspi.com/four-ways-bypass-android-ssl-verification-certificate-pinning/) but the same method does not seem to work with the MDG library. Do you know why is that? Anyhow, since that didn't work, I'm now trying to intercept the MDG API calls (e.g. mdg_place_call_remote(), mdg_send_to_peer(), mdg_receive_from_peer()) with Frida. I can successfully trace them, and I can e.g. read the protocol name ("dominion-1.0") but reading any sensible payload from the buffers does not work yet.

@mortengrouleff So Devi Smart uses Nacl to encrypt the messages being sent using MDG library? I don't find any traces of Nacl in the decompiled Devi Smart Java app or in the libmdglib-java.so that's in the APK.

[fasmide]

@fasmide I'm looking into the traffic being transmitted by a Danfoss Devi Smart thermostat in order to communicate with the device myself.

@toini I have never heard of these devices before so im not sure if my observations are relevant :)

Could you maybe share details on how you managed to read the JSON objects being transmitted?

@toini I pull'ed the apk off my phone and recompiled it with debug flags enabled, once this was done the app does a lot of debug logging - this can be seen with adb's logcat where it outputs the data transmitted between the app and the Danfoss link controller though the SDG(MDG?) (tunnel?)

[mortengrouleff]

@toini Perhaps I'm wrong then.

[toini]

@ChristianHC I did find mentions of protocol buffers in the apk, but those seem to only about io.tpa.tpalib which seems to be used to send UDP packages to app analytics service running at ccms-danfoss.hosted.trifork.com (the service there seems to be this one: http://theperfectapp.com).

Here's an example of such UDP packet:
.PKG=com.danfoss.devi.smartapp TAG=RESUME APP=A12214 NT=WIFI devicePeerId=18a30135e2fe0ddb24f7d3373d6e76ff39000219cdccefc17190fdb04dede25c deviceWifiSignal=-61 thermostatPeerId=faf93a8a434e9f8368cef1af6e2318cd3491c4dcb19357a374b44d88107a5f10 thermostatWifiSignal=-68 C=547 P=1805 D=1838 ERR=0

Those are easily readable. However, do you know if the MDG lib messages being sent to Secure Device Grid (those messages are the interesting part) are also being protobuffed?

[ChristianHC]

@toini In the TLS version of MDG (The one used in Danfoss Link), messages to and from the CC controller and application is protobuffed. I suggest you DM me.

[syska]

This is fun ...

securedevicegrid is owned by Trifork and Trifork actually either helped or actually created the app ... this means that they should know how it works ... but I guess they can't really tell since Danfoss is a closed #)¤&%&/#( company ... always makes me so sad ...

[Laro88]

Trifork made the whole design for Danfoss with end to end security in mind - not rest api access to anything - also meaning that “monitoring as a service” was impossible, so they got as deserved :-)
It is not the only Danfoss product that does not have any apis.
I heard that the next generation controller will have some sort of api, but the thermostats you have won’t work with it :-(

[syska]

@Laro88

At the moment I'm just looking at what's out there and actually works and what the options is ...

I need thermostats for the radiators but also floor heating ...

It's a complete jungle out there ...

People online only seem to complain when it's not working ... That goes for tado, Danfoss and All the others ... Not many have anything for floor heating.

I can live without an option to pair it it my Google home ...

Most importantly it just needs to work ... 😁

Also the very very very old Grundfos pumpe needs to be replaced ...

The more information about all the systems I find the more indoubt I get about what to buy ... But the facts that I need floor heating seems to be that Danfoss is the best even though it's a closed system 🤐

So if you have anything good information, do let me know ... 😀