The user attempted to bypass the Coway IoCare cloud service for the Airmega IconS air purifier. The device relies on cloud connectivity for remote control, which has caused issues due to server outages, account bans, and breaking changes in the manufacturer's mobile application.
To intercept traffic, the author set up a Raspberry Pi as a Wi-Fi access point in a transparent proxy configuration using mitmproxy. The setup involved routing traffic through a laptop to bridge the isolated Wi-Fi network to the home internet connection.
Analysis revealed that the air purifier downloads its root certificate via unencrypted HTTP from an Amazon S3 bucket. This security vulnerability allowed the user to replace the legitimate certificate with a custom one generated by mitmproxy.
By serving a custom certificate during the device's bootstrap process, the author successfully intercepted the encrypted traffic. This enables the potential development of a local control server to replace the manufacturer's cloud infrastructure.
