Decrypting Flume Water Monitor Traffic

In my previous post, I tore apart a Flume water monitor and traced its communication path from the sensor, through the bridge, and up to Flume’s cloud MQTT server. I identified the encryption library (LibHydrogen), extracted a firmware ELF, and even managed to coerce the bridge into sending plaintext by corrupting the public key in flash. But that approach was destructive; the bridge couldn’t…