Recon Brussels 2018 - Reversing IoT: Xiaomi ecosystem

# Reversing IoT: Xiaomi Ecosystem

## Overview This presentation demonstrates comprehensive reverse engineering of the Xiaomi IoT ecosystem, with the primary goal of gaining cloud independence and adding custom functionality to devices through firmware modifications. The Xiaomi ecosystem comprised approximately 50 million connected devices in 2017, offering extremely cost-effective IoT hardware (vacuum cleaners from €260, light bulbs from €6-12). The researchers systematically analyzed vacuum cleaners, smart home gateways, light bulbs, LED strips, and various sensors, developing multiple rooting techniques and publishing open-source tools.

## Key Topics

### Cloud Architecture Xiaomi devices communicate with cloud servers through encrypted protocols using AES-128 in CBC mode. Two types of keys are employed: a 16-byte alphanumeric cloud key (burned into devices for cloud communication) and a dynamic token (regenerated during provisioning for local device-app communication). Device communication uses either UDP or TCP with JSON-formatted messages, Unix timestamps for synchronization, and checksums for integrity. The app-cloud interface uses HTTPS with additional SC4 encryption layers. A concerning discovery revealed that Xiaomi's cloud infrastructure tracks device locations by capturing GPS coordinates during the provisioning process, ostensibly for Wi-Fi access point discovery.

### Hardware Architectures Different device categories employ varying processors: - **High-power devices (vacuum cleaners):** Allwinner R16 quad-core ARM Cortex-A processors with 512MB RAM and 4GB MMC storage - **Smart home gateways/light bulbs/LED strips:** ARM Cortex-M4 MCUs with 512KB SRAM and 4-16MB Flash, plus integrated 802.11 BGN Wi-Fi cores - **Zigbee sensors:** NXP Zigbee chipsets - **Problematic for reverse engineering:** ESP8266/ESP32 (researchers advised against attempting reversal)

### Vacuum Cleaner Architecture Generation 1 and 2 vacuum cleaners run Ubuntu 14.04 with three processors: the main Allwinner R16 CPU, an STM32 for sensor management (lidar, bump sensors, ultrasonic), and a separate MCU within the lidar unit. The devices contained sophisticated sensors (3D lidar, accelerometer, gyroscope, electronic compass, cliff sensors) normally found in smartphones but included in a €250 device. The firmware update process involves downloading encrypted images from HTTPS URLs, checking MD5 checksums, decrypting with the password "Rock robo," and applying updates to passive OS partitions with automatic fallback on corruption.

### Rooting Methods

**Vacuum Cleaners (Physical Hardware Trick):** The researchers discovered a clever exploitation method bypassing BGA chip reheating risks. By placing a single layer of aluminum foil under the MMC chip to short its data lines, the device enters a bootloader mode accessible via USB. This allows dumping the entire firmware, modifying it offline, and rewriting it without physical damage—a single-use vulnerability rather than requiring permanent hardware modification.

**Light Bulbs/Gateways (Binary Patching via Firmware Modification):** Since these devices lack USB bootloader access, the team developed a binary patching framework to inject code into bare-metal firmware without physical hardware access. The framework involves: 1. Creating wrapper definitions specifying target hardware/firmware versions 2. Binary patching original branch instructions to redirect execution to injected code 3. Using SDK samples and Bindiff for function identification 4. Injecting code to extract cloud keys and send them to attacker-controlled servers 5. Reformatting patched binaries for OTA deployment 6. Hosting modified firmware on rogue CDNs and manipulating DNS to redirect OTA updates

## Security Findings

**Critical Vulnerabilities:** - Firmware encryption uses a hardcoded, trivially discoverable password ("Rock robo") - SSH is enabled by default on vacuum cleaners but blocked only via iptables rules (removable) - Firmware updates lack cryptographic signatures on light bulbs and gateways - No certificate validation on some device firmware updates - Debug interfaces (JTAG, serial) remain exposed on many devices

**Data & Privacy Issues:** - Vacuum cleaners continuously upload mapping data (multiple MB daily) regardless of cleaning activity - Maps include detailed tracking of people (color-coded as purple overlays) and movement patterns - Lidar data persists in 1024×1024 pixel maps with 5cm-per-pixel resolution - Factory reset does not delete stored logs, Wi-Fi SSIDs, or plaintext passwords - Second-hand vacuum cleaners sold on platforms like eBay retain previous owners' location history, network credentials, and movement patterns - Xiaomi cloud has remote command execution capabilities, including triggering tcpdump on Wi-Fi interfaces - The Chinese-only smart gateway exhibits suspicious behavior: sends extensive data to a Salt Lake City server that yields minimal public information

**Vendor Implementation Variance:** - **Rock Robo (vacuum cleaners):** Encrypted firmware updates over HTTPS with certificate validation, protected debug interfaces, device-specific root passwords - **Lumi/Lao Mi (smart gateway):** Completely unencrypted OTA firmware, no MD5 verification, all debug interfaces available via JTAG - **Yeelight (Philips ceiling lights):** Unencrypted firmware, HTTPS without certificate validation, available debug interfaces

## Exploitation Workflow

The researchers demonstrated end-to-end compromise: 1. Extract cloud encryption keys through physical access (vacuum) or firmware patching (light bulbs) 2. Obtain device tokens from unprovisioned devices (standard behavior) 3. Craft malicious OTA update commands using the cloud key 4. Host modified firmware on attacker infrastructure 5. Intercept or manipulate DNS/cloud communication to redirect OTA downloads 6. Achieve full device control with root access 7. Optionally replace cloud client with custom implementation or proxy cloud communication through local servers

## Mitigation & Cloud Independence

The team published an open-source Xiaomi cloud implementation (available at don'tvacuum.me) enabling users to: - Run complete Xiaomi ecosystem locally without contacting official servers - Proxy or intercept cloud communication for protocol reverse engineering - Suppress unwanted commands (e.g., firmware updates) - Forward legitimate commands to the real cloud if desired - Disconnect devices entirely from Xiaomi infrastructure

## Takeaways

- **Critical:** Obtain cloud encryption keys—this enables arbitrary command injection - **Firmware modification without physical access is feasible** via binary patching and OTA mechanisms - **Vacuum cleaners create extensive privacy-sensitive data** (maps, location history, network credentials) that persists across factory resets and device transfers - **Vendor fragmentation creates inconsistent security:** some vendors implement encryption and certificate validation, others offer zero protection - **Second-hand IoT device purchases carry significant risks** due to unwiped logs and credentials - **Device fingerprinting is difficult to prevent** when manufacturers can send arbitrary remote commands - **Open-source implementations enable users to regain control** over their devices and ecosystem data

Warnings: Never leave devices unprovisioned (attackers can provision malicious firmware); exercise extreme caution purchasing used Xiaomi devices due to persistent sensitive data.