Developer builds local control for Coway purifier after finding certificate weakness

Image: Primary

Published Friday, November 13, 2026 · 10:19 AM EST

A developer reports building a Home Assistant integration that controls a Coway Airmega IconS directly over Wi-Fi, replacing its normal reliance on Coway's cloud. The developer found that the purifier downloaded its trusted root certificate over unencrypted HTTP, allowing replacement of that certificate and interception of subsequent traffic. Further investigation showed that Bluetooth setup messages specify the certificate and configuration server addresses. Reimplementing setup allowed the developer to point the purifier directly at a local server without intercepting traffic. The integration uses Web Bluetooth for provisioning and bridges the purifier into Apple Home. The demonstrated device is a discontinued IconS.

Sources

scottjg.com

In this story

Apple

Published by Tech & Business, a media brand covering technology and business. This story was sourced from scottjg.com and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Infrastructure AI

Nscale filing reveals $5.5B debt and larger Nvidia financing commitment

Nscale had $5.5B in debt in September, up from $137.4M in June, Bloomberg reported, citing an amended S-1 filing. Nvidia committed $2B of the data center developer's $3B+ convertible financing; Nscale previously disclosed $1B.

Products Infrastructure

Smartbird warns most convertible-note funding remains optional

Smartbird, formerly Allbirds, says only the initial $8.25 million of its convertible-note facility has been invested, while the remaining $91.75 million is solely at noteholders' option.

AI Capital

DeepX plans more than $100 million for chip using Samsung's 2 nanometer process

South Korean startup DeepX plans to spend more than $100 million developing its next artificial intelligence chip, Bloomberg reported.

Security

Uber notifies drivers of license data theft through Fireworks AI

Uber is notifying thousands of drivers that their personal and driver's license information was stolen in an October breach at Fireworks AI, TechCrunch reported. Notices filed this week say attackers stole internal credentials from the provider and used them to access Uber data.

Security

Check Point reports gateway exploit chain used to deploy backdoors and wipers

Check Point has disclosed attacks that chained PHP2Shell vulnerabilities in unpatched Security Gateways with a previously unreported Gaia OS flaw to install persistent backdoors.

Robotics Infrastructure

BYD demonstrates megawatt charging hub with prototype robotic connector

BYD unveiled a charging installation in Abu Dhabi combining rooftop solar panels, stationary batteries, megawatt charging and a prototype robotic connector.