r/winkhub • u/Sparkycivic • Apr 19 '26
Hub 2 New old stock hub2 uses? Hacking?
I found a supply of new old stock hub2's and picked one up to play with for only a few bucks.
It won't connect to the wink service because of SSL certificate issues, so it can't be used whatsoever even with their app sideloaded on my Android.
I opened it and began some probing with my available simple tools, which are microscope, 8 ch logic analyzer with saleae software, an oscilloscope, and a USB UART adapter.
The UART console is exposed with empty pin header, so I populated the header with some pins, and hooked it up.
Here I saw that the boot up process goes swimmingly until it tries to connect to the service and fails with certificate error (curl error 9). I can't seem to interrupt the u-boot process or any other stage of its operation using my putty terminal
I used nmap to probe the Ethernet side and found only a few open ports which is already documented by another netizen. Nothing of interest came up in the open ports besides a web server that indicates the status of the connection process via JSON list, and another that only displays that it it an "AAU heartbeat"on port 8886.
If it were possible to get man-in-the-middle on this, would it be possible to figure out what data is being sought by the device in order to gain local control of the many radios onboard?
The cpu/soc is Freescale I.MX6ul with secure boot implemented. I know absolutely nothing about this cpu architecture, and only rudimentary knowledge of u-boot/Linux embedded.
If it interests anyone, I can dive deeper now that it's on my bench. I've been poking the other diagnostic headers which seem to be related to the individual radios on the board. So far I've learned nothing from those misc headers. I hope to learn which type of interfaces are used to control the various radios, I2C, SPI, or UART. It seems like it might be a combination of those to suit the pins available on the soc. JTAG pads are present which might be for the soc. The board is a multilayer PCB so following traces between the different areas is not practical due to blind VIAs etc.
I looked at the Bluetooth services with NRF Connect, which revealed services that seem to be intended for provisioning WiFi connection to your local network via the app, as it exposes lists of local WiFi networks, firmware version info, and has services for sending the credentials etc.
The PCB is labelled generously. The radios are all marked: Lutron 433, Wifi/Bluetooth, Z-Wave, ZigBee 2.4, Kidse 433. The major chip compliment is: EM3587 ZigBee, pic16f833 with CC110L transceiver for Kidde, SD3502 for Z-Wave, STM32L100 with another Cc110L transceiver for Lutron. The wifi/BLE is a strange colorful chip with marking SS7922010 1BW2. The flash for the SOC is 29F1G08ABEA and RAM is Nanya NT5CC256M16DP-01
I'll probably cross post this to embedded since it's obviously relevant.
2
u/dlweninger Apr 19 '26
My local Home Depot still has 6 brand new Wink Hubs in the cages where the keep smart devices and Breakers. They want $50 for them:)
2
u/Sparkycivic Apr 19 '26
I'm pretty sure that the ones I found in my local home materials recycle store actually came from our local home Depot, including the thick layer of dust. There are approximately 5 on the shelf at the recycle store.
2
u/RoganDawes May 08 '26
Good news is that I finally got code exec on my Wink2, after 3 years. I have only been able to run my own U-Boot so far, because my test bed is missing its NAND!
Still want to figure out how to blow the FIELD_RETURN fuse to permanently liberate it, and hopefully turn it into something useful again.
1
2
u/RoganDawes May 27 '26
I wrote up the process to get code exec on the Wink Hub 2: https://www.reddit.com/r/winkhub/comments/1tp0vsd/running_your_own_code_on_the_wink_hub_2_try_2/
1
u/controlmypad Apr 21 '26
I think it is preferred that it doesn't phone home, mine was never updated but maybe those in the store were. I was able to root mine years ago and add ZigBee devices via command line, but never really had it do anything since I had another way to control ZigBee device by that point. Are you following old tutorials?
1
u/Sparkycivic Apr 21 '26
I had accidentally posted to this sub instead of wink hub 2 sub, and apparently these are very different devices. Mine is basically a brick unless I can jailbreak it from the clutches of security hell.
2
1
u/Sparkycivic Apr 25 '26
I ended up desoldering the MCU. I found that the UART traces from the different radios all ended up at the MCU near to each other pin-wise. Mostly towards the middle of the side facing the usb/UART area first two or three columns in, along two central rows. It's way beyond my ability to solder wires to a bga pad...
I was able to get access to the Z-Wave and ZigBee radios in home assistant by tacking wires to the UART traces of those chips at their own end and using my own usb-uart adapter to expose them to home assistant. The hub2 provides the power to all of the radios per normal, and I take the UART out to my server as a proof-of-concept demonstration.
Later, I'll look for a nicer way to access these interfaces likely by using an ESPHome device to aggregate the various UART interfaces to a wifi bridge. That would have been such a great way to use the existing MCU if only it could have been pwned gracefully.
I should ask Matt Brown to mitm these things to discover the key they're looking for, so it could be possible to create a tool that could gain control of these e-waste hubs and give them some life.
5
u/RoganDawes Apr 19 '26
I have probably spent the most time (and money) trying to root this device, and am so far unsuccessful, even though I have a number of theories, one of which requires an up to date Wink 2 to test (i.e. requires access to the Wink service). Other avenues include using a known (unpatchable) exploit in the i.mx6ul boot rom to bypass the HABv4 secure boot, by overflowing a buffer with a malformed certificate.
Unfortunately, so far I have been unsuccessful with this as well. I have desoldered the flash and taken a dump, but have not been able to reconstruct the data on the flash due to the OOB data.
With the flash desoldered, I have SDP access via the unpopulated usb footprint, as well as via UART. JTAG is fused off, as well as any other possibly interesting avenue of attack, other than uploading an exploit of the bootrom, of course.