So I bought a WiFi enabled personal weather station from Acurite. It was a bit pricier than some other personal weather stations available from Acurite and others, but I feel it had the better specifications overall than what was available otherwise.
Since this was going on my network, I wanted to make sure things looked on the up and up, so create a test network and packet sniff it is. And what I difference I found between the weather station and the Hello Birdie camera.
Quick little primer on the Atlas weather station: It uses a 900 MHz radio to connect from the sensor assembly to the local display. The local display has a ESP-WROOM-02 (datasheet here) to act as a bridge from the display to the WiFi connection. You don’t need the WiFi connection, and the local display will work fine without it. The purpose of the WiFi is to send data to WeatherUnderground.
When you first power up the display, it creates an open AP. You join this AP to set the SSID and password so the display can join the network and send its data. The config webpage is very simple: just a pulldown for found WiFi networks and a password field.
Running Nmap, the only port active at the setup stage is a http daemon at port 80. Once the display is configured on the Wifi, that port goes away and no open ports were found. It doesn’t even repond to pings.
Snooping the traffic, the only sites the display accesses is pool.ntp.org and three sites within the myacurite.com.domain. This is all done a clients where the display makes the requests. All this thing does is get the current time, look for firmware updates, try to send the weather data to your myacurite account (if you create one, not mandatory). All this traffice is sent via TLS ver 1.2.
Since I’m only playing with this inside the house right now, I haven’t gotten a WeatherUnderground account yet, but if what I see holds, I expect that will be just one more domain and comms over TLS.
Big difference in the privacy aspect of this weather station and the Hello Birdie camera is like day and night.
I downloaded a copy of the firmware from the site indicated in the traffic capture, but really expect no surprises whenever I get around to looking at it.
The only bummer that I see right now is that short of using a SDR to pull the weather data off the 900MHz signal, there’s no way of getting the data out and using for my own purposes locally.