Flume Water Monitor 915 MHz Signal Security – It’s Not Bad
Summary
A security researcher documents how a popular IoT water monitor uses a 915 MHz RF link with AES-128 in ECB mode and a partly discoverable key. The findings show practical weaknesses in the device's physical-layer security, brute-forcing the remaining key material within a day, and discuss potential risks like spoofed messages and OTA updates. The article includes responsible disclosure and signals a path for product security improvements by the vendor.