● Covered by 1 source · 1 reportLow impact1 neutral
Flume Water Monitor 915 MHz Signal Encryption Defeated Through Reverse Engineering
Key points
- Flume Water Monitor uses 915 MHz RF for sensor-to-bridge communication.
- The signal employs 2-FSK modulation at 200 kbps and AES-128 ECB encryption.
- The encryption key was derived from an 8-byte key with a hardcoded mapping.
- Reverse engineering reduced the brute-force key search space to 44 bits.
Flume Water Monitor Communication Overview
The Flume Water Monitor is a consumer device that attaches to a home's water meter to transmit near-real-time usage data. This data is sent to a companion bridge device over a 915 MHz RF signal, which then uploads the information to the cloud for access via the Flume app.
Signal Demodulation and Structure
FCC documentation indicates the device uses a 50-channel frequency-hopping approach in the 902.5–927 MHz band. Analysis revealed the signal uses 2-FSK modulation at 200 kbps, with a portion of the ~25-byte messages whitened. The Cyclical Redundancy Check (CRC-16) values were validated using the generator polynomial 0x1021.
Encryption Defeat Details
The 16-byte payload is encrypted using AES-128 Electronic Codebook (ECB) mode. The 128-bit key is derived from an 8-byte key via a hardcoded mapping. By utilizing unencrypted message header bytes and an inferred constant from existing data, the effective brute-force search space for the key was reduced from 64 bits to 44 bits, allowing for its eventual defeat.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
A researcher successfully reverse-engineered and defeated the AES-128 encryption on the Flume Water Monitor's 915 MHz RF signal, reducing the key's brute-force search space from 64 bits to 44 bits. This demonstrates a potential vulnerability in the device's communication security, though it required significant effort and prior research.