Pairing with Switchbot

Third party integrations
1

Hi,
My current configuration is an Ubuntu 20.04 running on an Intel machine. Home Assistant is running in Docker.
I want to control a switchbot switch, which is too far from HA server for Bluetooth to be effective. Looking around the most viable solution is to have a Bluetooth enabled RPI (I have an RPI4 nearby), paired with the switchbot, and running switchbot-mqtt.

The issue I’m having is getting the thing to pair. RPI4 is running raspbian headless, and I’ve installed bluetooth/bluez software.
RFkill is off, and using bluetoothctl I’ve powered on BT, made it the default agent, put it in discoverable and pairing mode.
Pairing to the BLE MAC address of the switchbot eventually fails with a bluez authentication error.
Making the switchbot trusted and trying to connect or pair fails.
So at this point any other suggestions would be great!
Thanks.

2

This is using ESP32 not RPi4, but might add to the conversation:

3

thanks for the shout out. yes this is the exact reason why I wrote the esp32 code. my switchbot is far away from my smarthub

4

Thanks for that, sure looks interesting, but it doesn’t really answer my question as to physically pairing the switchbot to bluetooth rpi4 using bluetoothctl. I’m not being prompted for a passcode (if there is one), and anything I’ve read about it says that the agent can deal with connecting to non passkey devices.

5

ble and standard bluetooth work differentely but there are command line commands. u dont pair with the bot

these are the low level.command line commands for a press/push

using switchbot python ble api command line… (not HA integration)

sudo bluetoothctl
power on
scan on
exit
sudo python3 switchbot_py3.py -d xx:xx:xx:xx:xx:xx -c press

the actual ble commands for a push/press that are being sent are

gatttool -b XX:XX:XX:XX:XX:XX -t random -I
connect
char-write-cmd 0x0016 570100

if u are dedicating an rpi just for switchbot, esp32 is cheaper and cheaper on power

6

Hi,

Thanks for the info, I’ll definitely try that out. The RPi4 is running Docker with some containers focused around entertainment and media, so adding the additional functionality of the bluetooth control seemed like a good idea.

7

Sorry for the late reply, but if you are referring to my tool switchbot-mqtt · PyPI with “switchbot-mqtt” then pairing is not needed.

If you need help setting up switchbot-mqtt or found a bug, please create an issue here: Issues · fphammerle/switchbot-mqtt · GitHub

8

I‘m using a couple of Switchbot curtain devices together with an ESP32 and your code, @devWaves.
First of all thanks for the great job, works like a charm!

Before I could pair the curtain bots to the Switchbot smartphone app (for initial setup and calibration) I had to bring the bots into pairing mode (regardless of BLE), however the ESP32 did not require being paired and only „knows“ the BLE-MAC-addresses to control them. (The Switchbot Bots do have a password option but the curtain-bots do not although they have a much longer range…)

This makes me wonder about security: What would prevent a neighbor or stranger nearby to scan with an App like nRF Connect or BLE Scanner, easily find the BLE-MAC-addresses of my devices and then control them? I don‘t see an option for a password or any authorization option for the Switchbot curtain…

1 Like
9

hey @anon94216691 you are correct. switchbot curtains do not have a password. In my first esp32 implementation for curtains (I didnt own curtains at the time) I assumed they would have a password like the bots and I coded that way. turns out they dont so I removed that code

So yes for curtains, if someone knows what to look for they are very easy to control

This is why I do not auto search for switchbot devices in my esp32 code and require them to be manually configured. If your neighbour had switchbot devices you wouldnt want them auto added to your setup

10

Thanks for your quick response, @devWaves
As they announce themselves as „WoCurtain“ in the BLE-scanner apps they are not hard to spot. I‘ll send the Switchbot guys a change request for adding a password in a future firmware update for the curtains. In the end it‘s just a curtain someone could close or open, so some annoyance but no harm from that

Makes me wonder which other BLE-devices don‘t have security applied, I used a BLE scanner for the first time today and found more than 100 BLE devices, partly from the neighbors around….

Regarding the Switchbot bots: Do they support just a password or is the communication also encrypted?
(Password only would probably still be easily sniffable. (I was planning to put one one my garage door opener but I’m sceptical now as this would breach security way too far.)

11

ya no encryption I believe. I don’t know how to sniff out those commands though, so I wouldn’t say it’s “easy”, but yes possible. if I did then humidifier would be supported by now in my esp32 code

12

@devWaves BLE-Sniffing is fairly easy with an Adafruit Bluefruit LE Friend stick and Wireshark, see BLE sniffing

Regarding the ESP32: My unit controlling the curtain bots became unresponsive after two days and also the webinterface had died.
Powercycling brought everything back.

As this is my first ESP32-experience: is that to be expected to happen with these devices?
I now have connected the power supply of the ESP via a Shelly Smart socket/plug and programmed the plug to powercycle it for a minute each night at 4 o‘clock, hope that will help…

13

I am looking at if I introduced a bug in v6.7. No it shouldn’t crash like that

ya so you would need a specific device for sniffing BLE, not possible with just an android phone or something. Easy with the right hardware for sure. I would definitely not trust a switchbot with anything too secure

14

Updated: Thanks for looking but the WebIf says I‘was running version 6.6.
I now flashed 6.7 onto the ESP and have disabled the nightly Shelly reboot.
I‘ll keep watching it for a few days and report back here.
Best, Andreas

15

No crash with v6.7 in the last 2 days. Maybe it was 6.6 related or some hiccup. :+1:t3:
I‘ll keep having an eye on it but looks good for now.