I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a REST API which costs a lot of money to access, besides I would like to keep my data locally anyway; not too keen on web-scraping.

The key problem is that it sends its data encrypted through TLSv1. I've managed to trick its DNS client into thinking I am the remote server, but I'm stuck at setting up a TLS connection. When using my own certificate, it will error 'Unknown CA'. I've sniffed its communication and found its certificate, and its desired ciphers.

Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)

Am I correct in thinking this is a dead end?

Is there a way to "redirect" it to accept plain TCP?

Since I've got physical access to the device, is there any hope in gaining anything useful from opening it up?

Am I just wasting my time here?

Asides from this, the device also has a SOAP service that I can access. But besides metadata such as serial number and model number, there doesn't seem to be much actual data to find. I don't have the WSDL, so far I've only found two actions.

Lastly, it's also got two-wire a serial port with no documentation on what protocol it might use. Keeping that one as a last resort.

  • 2
    If certificate checking of the TLS connection (the ciphers seem to indicate that the power meter wants to establish an TLS 1.2 connection) works as supposed intercepting the connection will be next to impossible unless you can modify the power meter to trust your certificate.
    – Robert
    Nov 7 '21 at 20:48
  • What is the manufacturer and type of the meter? Nov 7 '21 at 21:34
  • You say "reverse engineer" but are you planning to obtain the actual software running on the meter to decompile/disassemble? If there are any holes you may need to do that in order to find them. Nov 7 '21 at 22:43
  • @Robert Alright that's clear, not gonna happen. I'll try another attack vector.
    – Breina
    Nov 8 '21 at 7:48
  • @LjmDullaart It's Schneider Wiser Energy ER31800.
    – Breina
    Nov 8 '21 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.