Possibly, I completely forget ARP exists most of the time. I didn't pay much mind to it anyway, I was too bemused at the constant requests from/to its own IP rather than using loopback
the "cotton" (delicates) program on this machine is a 3hr 4min program by its own preset, so usually stuff like bedding or softer clothing, or generally just things that I want to be washed same-day (that also won't survive one of the more rapid washes, or just requires an actual thorough wash) because it'll prevent me doing something otherwise. Issue is the machine is constantly recalculating how much time is left, seemingly based on stuff like the temperature or weight of the load or something like that, so when it starts on 3 hours, it can be four hours until it's done in 30 minutes, and then it sits on the last 5 minutes for over 45 minutes. I've waited six hours for my bedsheets, a blanket, and some pillowcases to wash before! It truly is one of the washing machines of all time.
"The author was able to build on top of work that had been done by others, but if you're ever faced with a situation where nobody else has done that work, don't just give up." If I couldn't strike lucky with an xor brute force, my next plan of attack was to start poking at whatever android app they had. It was only because my friend happened to find that someone else had already done it on github that I managed to take the shortcut. If we hadn't found that github I'd probably have a far more detailed writeup so that other people could follow on with their own appliance, if they happen to have the same/a similar one.
Sorry about that, the screenshots were taken after I'd already done everything and was writing up the blog, since I didn't have the original data to hand. I forgot to include this in the post, but at some point after rebooting the washing machine (I still can't get over how insane that sounds) while writing my notification script, the machine started returning unencrypted yet still encoded data, which is why in the script's poll loop attempts to deserialize the bytes as JSON first, only on failure trying to run it through decryption.
Sometimes it's returning encrypted data, sometimes it isn't, and sometimes it's just spitting actual garbage down the wire. I did also modify the screenshots to blank out some bytes, but you can probably see where that is. None of this was faked, it's just an incredibly dumb smart appliance.
If I can capture it sending encrypted data again, I'll update the post with corrected screenshots.
Hey, blog author here. It only had access to the internet for a brief second, and even then it was on an entirely separate network because of how I just set up my openwrt router as a client to the main network. Our guest network is completely isolated, an explicit firewall rule had to be added so that my script could communicate with the washer while it's on this network. It has no access to anything but itself, and occasionally hears the screams of my script demanding it serves up data.
It has access to nothing, only my script has access to it - I don't see a risk here. I still have the heebie jeebies knowing it's connected to anything at all, or even the fact that it can do that, but also spending a night hacking a washing machine was incredibly funny to me and totally worth it. Plus, got some useful notifications out of it.