Scott wanted his Coway Airmega IconS to join an Apple Home bedtime scene without depending on Coway’s unreliable cloud. His investigation follows the device from network bootstrap to Bluetooth setup, ending with a local Home Assistant integration.
- Trace the trust chain. The purifier fetched a root certificate over plain HTTP. Substituting a lab certificate exposed the subsequent setup traffic and revealed a fragile security boundary.
- Find the control channel. Configuration returned a server and credentials for MQTT, a messaging protocol used by connected devices. Captured traffic helped map app actions to commands.
- Replace provisioning. Bluetooth logs and the decompiled Android app revealed that setup supplied the certificate and enrollment URLs. A custom setup flow could point the device at a local server directly.
- Keep the result usable. A Home Assistant integration provisions the device with Web Bluetooth, then controls it over local Wi-Fi and bridges it to Apple Home.
The author used AI tools extensively to build the test environment and analyze the protocol, while checking the reconstructed setup against captured logs. His result applies to the tested IconS; other models may differ.
A local interface removes a long chain of cloud outages, account changes and app rewrites from an ordinary household automation. The investigation also shows why a secure connection depends on how its initial trust is established.