A developer discovered a clever way to cut his Coway Airmega IconS air purifier off from the cloud with the help of a root certificate, allowing local control. The method took advantage of a security hole — the fan downloads the certificate over plain HTTP — and now his Home Assistant server stands in for Coway’s cloud. The result: no more dealing with the unreliable integration that ran through Coway’s IoCare cloud, which broke “at least once or twice a year.”
The developer, Scott J. Goldman, detailed why and how he did it, starting with replacing a dumb Airmega that was “an overpriced box fan with a HEPA filter and an air quality sensor.” The replacement Airmega IconS, which is now discontinued but has Wi-Fi support, had inconsistent Home Assistant (HA) integration. He decided to take matters into his own hands with AI, although he noted that Claude’s guardrails blocked his request to set up his Raspberry Pi to intercept the fan’s traffic under the cybersecurity category, “not even for… uhh… testing purposes.” ChatGPT obliged and wrote the firewall rules, and an AI he doesn’t name later rebuilt the fan’s Bluetooth setup in about 20 minutes.
The fan’s inconsistency had a reason: the IconS has no official HA support, so the route around that relied on a community integration that logs into Coway’s IoCare+ cloud. Coway originally banned the integration for overloading its servers before allowing it after a community dispute. Coway also rebranded its app and cloud from IoCare to IoCare+, which forced a rewrite. Even small HTML layout changes on the pages the integration scraped could break it. On top of that, the company’s servers went offline here and there.
Worse, the developer’s account was banned for running an old integration version, and he lacked remote control for weeks. Originally, all he wanted was for Apple Home’s Good Night scene to switch the purifier on. A common complaint about Internet of Things (IoT) devices like this is that you’re at the mercy of the manufacturer, and support can later evaporate. AI has helped some users like this take back control.
His method involved using the purifier’s security lapse against itself. At setup, it fetches the certificate it trusts over plain, unencrypted HTTP, which can be intercepted and replaced using mitmproxy/mitmweb with nftables port redirection. The request he saw was a plain HTTP GET for AmazonRootCA1.pem from an S3 bucket in AWS’s Seoul region. He then had his proxy serve its own CA to the fan, and the fan made HTTPS requests to Coway’s cert server, which included downloads of a device certificate and private key. Another proxy plugin then swapped his own key into that response.
The fan’s commands ran over MQTT, a lightweight messaging protocol common in smart-home devices, secured with TLS on port 8883 and routed through AWS IoT. The proxy doesn’t decode MQTT, but it showed the raw stream, which the unnamed AI mapped to his app button presses.
He had first considered exploiting eMudhra, a certificate authority whose private keys turned out to be trivially weak last month, which would have involved forging a certificate. That wasn’t necessary because of the plain-HTTP download. Self-signed certificates are nothing new to enthusiasts; this just took a little extra work and avoided the eMudhra plan’s reliance on several things lining up.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Doing the Bluetooth work by hand would have taken hours or even days, he estimated. The unnamed AI also drove an Android phone over adb to read its Bluetooth logs and reconstruct the protocol.
The project is offered as coway-local, which allows the fan to be connected to HA directly, and from there to Apple Home. A Web Bluetooth page, openable in Chrome on a Mac or Android device near the fan, sends the Wi-Fi details. That Bluetooth setup also carries the fan’s certificate URLs, so coway-local points them at the HA server and no traffic interception is needed. The Wi-Fi password goes to the fan over Bluetooth; HA never stores it, and the setup link expires after 15 minutes. The integration runs its own MQTT broker, so the fan now talks to HA instead of AWS.
HA Core 2026.10.2 or newer is needed with a fixed LAN address and 2.4 GHz Wi-Fi. There’s a catch: using it disconnects the fan from Coway’s cloud, so Coway’s app is no longer able to control it. It’s also experimental and tested only on the IconS (AP-1022K), and other Coway models may get through Bluetooth setup without actually working.
The features list is incomplete: PM10 and other air-quality metrics, filter alerts, and firmware updates aren’t implemented yet. He suspects Coway’s cloud could eventually be discontinued or come with a service fee, and a local path is insurance against that. At least for him, this brings satisfaction, as “Now, I can finally click Good Night.”
1 hour ago
2
English (US) ·