Skip to content

Update function polls over insecure plaintext HTTPΒ #317

Description

@molzy

Problem/Motivation

Noticed plaintext HTTP requests to http://hw.airgradient.com/sensors/airgradient:{serialnumber}/generic/os/firmware for firmware version from the Home Assistant plugin. Since #170.

These requests are leaking the unique MAC / serial of my unit(s) over the public internet, which is concerning as I do not want this sort of information easily monitored by whoever is listening - at least with HTTPS it would only be possible to tell that I probably have one or more units, not the specific count, and also not the specific unit identifier.

I haven't analysed the firmware on the unit itself to check whether it is sending any info to airgradient also over unencrypted HTTP, will check later and post an issue in the related repository if so, as that would be more concerning - all identifying communication should be over HTTPS these days.

Expected behavior

Unique hardware identifier not leaked in plaintext HTTP during firmware update check.

Actual behavior

MAC address / serial number leaked.

Steps to reproduce

Observe packet capture of Home Assistant instance with AirGradient device added in Wireshark, look for plaintext HTTP (port 80) connections.

Relevant line specifying HTTP URL and adding serial

Proposed changes

  • Replace self signed certificate on hw.airgradient.com server with lets encrypt signed certificate.
  • Request firmware update version over HTTPS instead of HTTP.
  • If serial number isn't required to report the latest unified firmware version, perhaps don't add it - the endpoint seems to respond with the same version if I omit the serial...

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions