Aercus WeatherSleuth Weatherstation / MQTT / Security thoughts

I recently got my hands on an Aercus Weathersleuth Weatherstation. This is a fairly nice piece of kit. One of its benefits is it can talk to the internet or an arbitrary server. A bit of poking around revealed it communicates by way of an HTTP post request which looks as follows – http://ADDRESS.SPECIFIED.IN.CONFIG/weatherstation/updateweatherstation.php?ID=IDINCONFIG&PASSWORD=PWINCONFIG&tempf=64.8&humidity=79&dewptf=58.1&windchillf=64.8&winddir=48&windspeedmph=2.46&windgustmph=2.46&rainin=0.00&dailyrainin=0.00&weeklyrainin=0.00&monthlyrainin=0.00&yearlyrainin=0.00&solarradiation=152.45&UV=1&indoortempf=-9999&indoorhumidity=-9999&baromin=-9999&lowbatt=0&dateutc=20165-10-0%202:29:46&softwaretype=Weather%20logger%20V2.1.9&action=updateraw&realtime=1&rtfreq=5 On…

Read More