NoLongerEvil-Thermostat

Making the Nest 2nd gen thermostat the Google recently bricked compatible with local setups like Home Assistant. I'm involved in 3 projects that are solving this problem from different angles: https://sett.homes/ https://github.com/codykociemba/NoLongerEvil-Thermostat https://github.com/cuckoo-nest

After you flash the exploit and SSH into the thermostat you can see it at https://github.com/codykociemba/NoLongerEvil-Thermostat/issu... It's a boot script called /bin/nolongerevil.sh that supplies its own trust material and redirects traffic intended for frontdoor.nest.com to a hard-coded IP 15.204.110.215. 99.9% of this image is the original copyrighted Nest image. Maybe it's enough for the bounty though? And I suppose you could change that IP to a local server. If you wanted to publish the server side Nest API discovered through WireShark . Just stand up your own http rest server.

> ...looks like they reverse-engineered the nest thermostat and wrote a firmware... Not to diminish what this project has done, but they modified existing firmware to make it communicate with a different server. They've also implemented a server for the thermostat API. It's pretty neat but, at this point, it's just a hacked firmware that talks to a different proprietary server. Edit: It's not even a modification to the firmware binaries. They're just injecting /etc/hosts entries into the firmware[0]. If the Nest device just uses DNS to resolve these names then you wouldn't even need to modify the firmware-- just point it at a DNS server that's authoritative for the necessary names. [0] https://github.com/codykociemba/NoLongerEvil-Thermostat/issu...

This comment says he is awaiting Louis Rossman’s acceptance of this code for the bounty he raised, pretty cool if this all works out! https://github.com/codykociemba/NoLongerEvil-Thermostat/issu...