Connect headless device to WiFi network

So, I have an Air Conditioner with a wifi module that is ready to be controlled remotely.

I'm trying to understand, how this AC is able to connect to my network as it does not create any self hosted Wifi network nor my phone is connected anywhere else rather than my Wifi network.

Facts:

• My phone's bluetooth is disabled.
• My phone does not connect to any other network (as the icon in the status bar indicates)
• I reset the AC and the AC is not able to connect to my network anymore - until I use the application again.
• The android application I use is the "AC Freedom"

From my inspection via packet sniffing with an android application named "Packet Capture", my phone sends many UDP packages to the multicast(?) of my network when trying to talk to the AC.

Some of the packets are dispatched to the socket addresses: 224.0.0.251:80, 224.0.0.251:16680, 255.255.255.255:15000

Somehow the AC connects magically to my wifi. How is this possible? Is any WiFi protocol that I'm not aware of? Also the AC is able to "talk" with the external server (their server) and I'm able to manage the AC remotely - without being connected to local network via Wifi.

Guess: AC scans wifi networks and captures trafic and is able to identify packets - decrypt them (as the payload is known) and connect to the wifi. This is a little bit sci-fi by it's the only method I can think of.

1 Answer

Check of your Smartphone and the AC use something called Wifi Direct. This connects them directly and doesn't use "your Wifi" (i.e., your Wifi access point on your home router)

Ok, so I downloaded the "AC Freedom" APK (some random version, there seem to be several versions around), unpacked it with apktool, and had a look.

There are a number of libBL*.so libraries, and one libNetworkAPI.so. Looking inside those libraries finds references to the "Broadlink API", and one can google various Java libraries for that that are apparently ports of this Python library.

The description there mentions a "device in AP" mode.

There also seems to be some DES encryption stuff, "BLJSON", and so on.

So all of this looks like your Air Conditioner is based on this Broadlink technology (and your last comment confirms this), has its own access point, and there's an encrypted and authenticated exchange using this AP.

Nothing points to "let's just hack the user's Wifi" (not that this would be possible).

As to why your Android apps don't pick up this AP, I have no idea - maybe it's a hidden SSID.

There is a really simple test to find out if your Air Conditioner is using "your wifi":

Completely power off your home router. If your Smartphone can still communicate with your Air Conditioner, then it's not using your home router. Even if you cannot see what it is using to communicate.

Reading through the Python library documentation again:

Setup

In order to control the device, you need to connect it to your local network. If you have already configured the device with the Broadlink app, this step is not necessary.

• Put the device into AP Mode.
• Long press the reset button until the blue LED is blinking quickly.
• Long press again until blue LED is blinking slowly.
• Manually connect to the WiFi SSID named BroadlinkProv.

Connect the device to your local network with the setup function.

broadlink.setup('myssid', 'mynetworkpass', 3)

Security mode options are (0 = none, 1 = WEP, 2 = WPA1, 3 = WPA2, 4 = WPA1/2)

So what that does is tell the Broadlink device to setup it's own AP, then it connects to this AP, and then you give it the SSID and password of your wifi. Along with the encryption method. And after it has the SSID and password of your wifi (because you gave it voluntarily), then yes, it can connect to your wifi.

And the sentence "If you have already configured the device with the Broadlink app, this step is not necessary." seems to imply that this is what the Broadlink app is doing, too. Either by asking for your SSID and password, or by getting it from the Smartphone data.

So have you gone through these steps with the Broadlink app? If yes, then your AC is connected to your Wifi, and can communicate normally in your home network, and yes, then it can do it via multicast on 224.0.0.251.