This video announces a significant breakthrough for the Xiaomi thermometer custom firmware project: the discovery of an exploit that bypasses the signed over-the-air (OTA) update mechanism. This allows users to flash custom firmware like version 2.1.1_0159 over-the-air, eliminating the need for a USB-to-serial converter. The process involves first adding the thermometer to the Mi Home app, then using a Python-based "token extractor" to obtain necessary security keys (device ID, bind key, Mi token). These keys are then entered into a web flasher to perform a "VR login," which enables the flashing of the specially crafted custom firmware. The presenter demonstrates the successful flashing, highlighting the collaborative effort behind this exploit and emphasizing its importance for making custom firmware updates more accessible and user-friendly by avoiding common issues with wired methods. The specific firmware is not yet publicly released to prevent Xiaomi from quickly patching the vulnerability.
Summarizing the Xiaomi Thermometer Firmware Update Breakthrough
0:00 Project Revisit: The video discusses the Xiaomi thermometer custom firmware project, which started 5-6 years ago.
0:14 OTA Update Exploit: A major breakthrough has occurred: a new exploit bypasses the signed over-the-air (OTA) firmware update, allowing custom firmware (e.g., 2.1.1_0159) to be flashed without a USB converter.
1:06 Initial Setup Requirement: To use this method, the Xiaomi thermometer must have been added to the Mi Home app at least once. The device now communicates via a secured connection.
1:29 Secure Key Extraction: The web flasher requires a "bind token key." This key, along with the device ID and Mi token, can be extracted from the Mi Home app using a Python script called "token extractor" by P. Marski.
2:29 Web Flasher Connection: After closing the Mi Home app, connect to the thermometer using the "Telling Flasher" web interface.
3:00 Secure Login Process: Instead of activation, perform a "VR login" within the web flasher by inputting the extracted Device ID, Bind Key, and Mi Token. A "Login successful" message confirms the connection.
3:57 Custom Firmware Flashing: Once logged in, a "special" unsigned firmware can be selected and flashed. This process takes a few seconds and can be monitored via current draw.
4:27 Acknowledging Collaboration: The presenter credits "Victor" for his significant contributions to finding this exploit and developing the custom firmware.
4:57 Successful Update: The flashing process completes, the thermometer reboots, and upon reconnection, the custom firmware is detected and running.
5:18 Delayed Public Release: The custom firmware is not being immediately released to the public to prevent Xiaomi from quickly fixing the underlying vulnerability.
5:35 Key Benefit: This OTA update method is significantly more convenient and user-friendly than wired updates, which were prone to problems and led to many user questions, thereby facilitating the project's wider adoption.