Lockly WiFi Hub

Third party integrations
41

Decoding the Authorization: Bearer with base64decode returns my email address, role, userid, and some other stuff.

42

yes, I saw that too and it expires after 24h. Unfortunately, there’s not much we can do with this as we wouldn’t be able to successfully sign them and because they expire, we couldn’t just let integration user find one of their JWT tokens to authenticate their calls

43

Isn’t that like oauth where you just have to submit for a new token for each call or every couple hours or something?

44

Did you manage to control your lock on Android Virtual Device routing your traffic via Burp?
I can only log in, locking/unlocking is not working, fails connecting.

45

It is. Since the token is valid for 24h, you can use it to authenticate as many calls as you want for the next 24h.
And this is obtained by the app in the /login call which tradditionally (at least in most of the apps I have worked on) is passed in clear text over HTTPS.
In this case, it appears we are passing a hash of what I can only guess it the username/password.

Come to think of it, it may be 2 hashes stuck together as the Server can make the difference between an existing account with an invalid password and a non existing account. So it must have a way to get the username by itself

46

You’re quite right.
The lock beeps (as in it’s being talked to by the Cloud/Dongle) but the unlocking actually doesn’t happen…
Strange

47

Actually I lied, it can get that part working. (unlocking the lock AND logging traffic in Burp)

48

FYI my hope was to decode the BT so I wouldn’t need the lockly hub at all which I currently don’t have. So perhaps slightly different objective ;p

49

mate, I hear you but:

  • I know nothing about BT communication and wouldn’t know where to start
  • It would require having your HA hardware being in BT proximity to your lock, which could be difficult for some

But yeah, also realise that this means reliance on a cloud which is meh

50

This decompiled Java looks to me like it could be part of what hashes the credentials. Thoughts?

image
image1030×872 44.7 KB

51

If you want to talk me through how you got to where you got to with your screenshot above (with bluetooth), I could take a look

52

I mean if you want sure, but I understand I’m doing things slightly differently, and being on the HA forum, getting it to work with HA is the goal. So feel free to keep focused on that.

I’ve purely been grabbing the BT logs from my device into wireshark and also grabbing characteristics and services via python etc so that I can see if I can send some commands directly from any IoT type device.

53

Looks promising ;p

54

Then I might have some issues with my burp configurations. Looks like some certificates fail, since I’m not able to log into play store either. I had to sideload the apk.

55

Sideloaded the app too. Didn’t want to bother adding my Google Account to the Virtual Device

56

Did some sniffing with one of my rooted android devices and analyzing the dump with wireshark, I managed to find some recurring packets.

a1f2c3b4 2800 c6694a5b6926426b12666c34c3a9
a1f2c3b4 1900 0a22557d35ea49c30813e9b19dc7
a1f2c3b4 2800 c6694a5b6926426b12666c34c3a9
a1f2c3b4 1900 0a22abcd991f303f03601e56f30a
a1f2c3b4 2800 c6694a5b6926426b12666c34c3a9
a1f2c3b4 1900 0a22abcd991f303f03601e56f30a
a1f2c3b4 2800 c6694a5b6926426b12666c34c3a9
a1f2c3b4 2900 0a1e8612e2f6a1538f73123b3a01
57

could be the auth to your door and we’d have no idea? ;p
Ye I have no idea how to decrypt this stuff, or if its even possible.
I also noticed some reoccurring packets via the dump from my phone, especially when I did a an action 3 times in the app and was able to locate it in wireshark, but still can’t figure out how to combine/decrypt the packets currently.

58

Just expressing my interest in this integration as well.

1 Like
59

Looking for answers myself.

1 Like
60

Sold the house and I left the Lock on the door. Bought an Eufy lock which is integrated in HA.