MITM'ing the My BMW app

[rikroe]

Hi all,

With the old backend gone, we need to reverse engineer/MITM the new My BMW app.
If anyone manages this and is able to provide some kind of network dump, it would be greatly appreciated! (beware of your passwords & tokens!)

A quick summary on what I found out on the new My BMW app:

• it seems to be built as a Flutter app
• using frida and the steps from here I was able to capture some traffic, but then the app crashed
• One doesn't need to go into Flutter, as the login is just an external webbrowser so as long your phone accepts your certificates, it should be good

Beginning of next week I should be able to provide you with more info of what I did, curre tly don't have access to my PC.

I tried to do this on an (unrooted) Android device. Maybe somebody with a rooted Android/jailbreaked iOS device is more lucky.

Let's try to figure this out!

EDIT 2021-08-07
Thanks to @TA2k's work, I've pushed #300 that should fix login for rest_of_world.
We need someone from north_america and china who can go through their login flow and give us some specifics (used URLs etc).

EDIT 2021-08-08
Again thanks to the amazing TA2k, the required values for north_america have been dugged out as well. When #303 is merged, I'll try to push a new release and integrate it in the existing Home Assistant PR.

[Rep-Hueman]

New setting MINI CARDATA in portal...

SMART HOME
MINI CarData offers scope for innovative smart home applications. For example, third parties could in future use telematics data from MINI vehicles, such as the charge status of the high-voltage battery, to optimize the charge control in the garage at home – resulting in more convenience.

[cmnaac]

Hi,

It seems that the new API will be payed (Pricing), :( ...
More information about the API can be seen here.

Best regards

[dicarsio]

No, that's an old service, available since 2017 (at least). That's for the CarData dump (not the same thing).

[dicarsio]

@rikroe I believe I am able to get a dump on the calls currently being done. please drop me an email (from my public profile) and we can coordinate this. thanks

[TA2k]

I already implemented the current oAuth flow for an ioBroker Adapter maybe you can adopt this.
https://github.com/TA2k/ioBroker.bmw/blob/54a47a4bae6f97c6380a97d64734bb3a17d7fec6/main.js#L64

[dicarsio]

@TA2k that’s great work! are the actions (lock/lights/etc) working as well with your code?

@rikroe yep, will put a put on that until we try this out. thanks

[toini]

Wow nice! How were you able to disable cert pinning on a Flutter app?

[TA2k]

Yes old endpoint working normal. Only to get the access token is a new flow. Login Flow is an external website and not protected by the flutter network layer

[toini]

Yep i confirm i can call the old endpoints with token from the new auth flow.

[rikroe]

Ah, so everybody who is able to MITM a normal website should be able to get us the information for the login flow? Thats great news!

[phantomsphorever]

Maybe of interest:

The BMW Alexa skill still works!
I can for example ask for the status of my battery.

This means that whatever API Amazon is using still works?!?

Maybe the HA integration developers could gain some info through that approach?

[rikroe]

The Alexa skill is developed by BMW themselves, so unfortunately we cannot look into the code or create a dump there.

[rikroe]

Just pushed #300 containing a fix for rest_of_world thanks to @TA2k!

Unfortunately, the login flow at least for north_america (where I have an account without cars) seems to be little different at the first call to `:

• for rest_of_world, the first call to .../oauth/authenticate returns a redirect_to value similar to this (auth code changed, but style kept):

  redirect_uri=com.bmw.connected://oauth?client_id=31c357a0-7a1d-4590-aa99-33b97244d048&response_type=code&scope=openid profile email offline_access smacc vehicle_data perseus dlm svds cesim vsapi remote_services fupo authenticate_user&state=cEG9eLAIi6Nv-aaCAniziE_B6FPasdfjukilYw&authorization=jkPGR4km1rcgPnig3BgPn7yr-7U.*AAAIUZPNLABw5b1JBcnJSUlQwV2U3ZmFWdkQ3NEx2TGJFE78R0eXBlAAFDElMxAAIwMQ..*
  

• the same call against the north_america endpoint (where I'm not sure if it is actually the correct one returns something similar to this:

  https://customer.bmwgroup.com/gcdm/static/authorize.html?redirect_uri=com.bmw.connected://oauth&client_id=31c357a0-7a1d-4590-aa99-33b97244d048&response_type=code&scope=openid profile email offline_access smacc vehicle_data perseus dlm svds cesim vsapi remote_services fupo authenticate_user&state=cEG9eLAIi6Nv-aaCAniziE_B6FPoobva3qr5gukilYw&authorization=4JzQ534TIuL:a5e236af-7d75-402f-929d-8f9b002232d4
  

The authorization value from north_america then returns invalid_client: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). when calling .../oauth/authenticate the second time.

@TA2k: Can you maybe share how you where able to collect the login flow data?
@users from north_america: Would you be willing to step up and help us figure out the OAuth flow for you?

[danfulton72]

I've installed your branch manually into my home assistant docker container, and I am back up and running, rest_of_world user, working :)

Thanks!

[cmnaac]

I've installed your branch manually into my home assistant docker container, and I am back up and running, rest_of_world user, working :)

Thanks!

I've done the same, and the result... was also the same, :): the homeassistant is again connected to the bimmer, :).
I'm also a rest_of_world user.

Good work, ;)

[Rep-Hueman]

How do i install your branch manually into my home assistant??
in the custom_components ?

[rikroe]

How do i install your branch manually into my home assistant??
in the custom_components ?

#299 (reply in thread)

The custom component currently is not up-to-date to the component shipped with HA.
If you cannot upgrade by the method mentioned, we can have a look at updating the custom component as well.

[Rep-Hueman]

I am back up and running
I found the temporary solution :-)

copy homeassistant/components/-> bmw_connected_drive (from HA https://github.com/home-assistant/core )

change manifest.json in bmw_connected_drive

{
  "domain": "bmw_connected_drive",
  "name": "BMW Connected Drive",
  "documentation": "https://www.home-assistant.io/integrations/bmw_connected_drive",
  "requirements": ["bimmer_connected==0.7.18"],
  "codeowners": ["@gerard33", "@rikroe"],
  "config_flow": true,
  "iot_class": "cloud_polling",
  "version": "1.0.01"
}

save manifest.json!

copy folder bmw_connected_drive to the custom_components folder!

restrat HA

[dicarsio]

Same here. Works like a charm RoW

On Sun, 8 Aug 2021 at 02:50, cmnaac ***@***.***> wrote: I've installed your branch manually into my home assistant docker container, and I am back up and running, rest_of_world user, working :) Thanks! I've done the same, and the result... was also the same, :): the homeassistant is again connected to the bimmer, :). I'm also a rest_of_world user. Good work, ;) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#299 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAB7TK5XACAWOX55SMI3JTDT3XPG7ANCNFSM5BRVWV3A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email> .

-- Cumprimentos, Carlos Silva +351 919 508 311 Octet Stream, Unipessoal LDA.

[ccspack]

Not sure where to post, or how to fix. But when this integration stopped working last week, I deleted it from HA, now I’m unable to install again even though I’m in the rest of the world zone. Don’t know how to manually install latest ver or how long until HA will take to recognise the latest release of the integration? Any advice is appreciated.

[scstraus]

Would be great to know when this will make it into the official release cycle. If it's relatively soon, I may just wait it out.

[rikroe]

The Home Assistant pull request has been created home-assistant/core#54261

It should be included with the next minor version (if any) but it's not been accepted by a HA dev yet.

If you cannot wait, you can update the dependency version to 0.7.17 in components/bmw_connected_drive/manifest.json in your home assistant installation.

[scstraus]

Looks like it was released in 2021.8.5! Look forward to trying it tonight! Thanks for all the hard work and quick turnaround!

[rikroe]

@lwy197809 can you send a link to the My BMW version you are using in China (and where to get the iOS app/Android app from)?
I've only seen the three following variants:

• row (rest of world)
• na (north america)
• kr (korea, which wasn't on our schedule at all)

[rikroe]

Could you create an empty test account for the chinese My BMW (just login & password) with no vehicles and send me the credentials to rikro@gmx.net?

[nichwang88]

it seems to have login issue for "china" again, after i upgrade to HA 2021.8.5.
Fix login to BMW services for rest_of_world and north_america (@rikroe - #54261) (bmw_connected_drive docs)
when i downgrade to HA 2021.8.4, it works again.

[rikroe]

Oh. This is strange. Are you as well using the My BMW app?
It may be that the login procedure for china is still the "old" one. However I thought that this has changed as well based on the comments.

[nichwang88]

Yes, i use the My BMW app. But i'm sure it works fine on version 2021.8.4

[lwy197809]

Could you create an empty test account for the chinese My BMW (just login & password) with no vehicles and send me the credentials to rikro@gmx.net?

already sent to your mailbox. tell me if it doesn't work. @rikroe

[heyepic]

Killer work everyone involved! Resolved for me as well in NA.

[dazole]

You guys are awesome thank you! I've taken the previous version (before BMW deprecated the old API) and rewritten is as iOS shortcuts. Obviously, they don't work now...yet. Generally, I transcribe the python code to shell scripts, then convert that to shortcuts. I'm having a helluva time getting it working with this new auth flow, though. Here's what I have so far ( I know I need to updated some of the variables, like URL, etc):

#!/bin/bash

# Put your username here
user=''
# Put your password here
pass=''

# uncomment the correct regionspecific URL here:
# North America
url='login.bmwusa.com'
# China
#url='b2vapi.bmwgroup.cn:8592'
# Rest of world
#url='b2vapi.bmwgroup.com'

enc_user=$( echo "${user}" | base64 - )
enc_pass=$( echo "${pass}" | base64 - )

auth_basic='NTQzOTRhNGItYjZjMS00NWZlLWI3YjItOGZkM2FhOTI1M2FhOmQ5MmYzMWMwLWY1NzktNDRmNS1hNzdkLTk2NmY4ZjAwZTM1MQ=='

curl -c cookies.txt -X POST \
	-H "Accept: application/json, text/plain, */*" \
	-H "Content-Type: application/x-www-form-urlencoded" \
	-d "client_id=54394a4b-b6c1-45fe-b7b2-8fd3aa9253aa" \
	-d "response_type=code" \
	--data-urlencode "redirect_uri=com.bmw.connected://oauth" \
	--data-urlencode "state=rgastJbZsMtup49-Lp0FMQ" \
	-d "nonce=login_nonce" \
	-d "scope=openid+profiler+email+offline_access+smacc+vehicle_data+perseus+dlm+svds+cesim+vsapi+remote_services+fupo+authenticate_user" \
	-d "grant_type=authorization_code" \
	--data-urlencode "username=${user}" \
	--data-urlencode "password=${pass}" \
	"https://${url}/gcdm/oauth/authenticate?"
echo ""
echo "Got cookies, starting next session"
echo ""

authorization=$(tail -1  cookies.txt | awk '{ print $7 }')
echo ""
echo "authorization = ${authorization}"
echo ""
curl -b cookies.txt -X POST \
	-H "Content-Type: application/x-www-form-urlencoded" \
	-d "client_id=54394a4b-b6c1-45fe-b7b2-8fd3aa9253aa" \
	-d "response_type=code" \
	--data-urlencode "redirect_uri=com.bmw.connected://oauth" \
	-d "state=rgastJbZsMtup49-Lp0FMQ" \
	-d "nonce=login_nonce" \
	-d "scope=openid+profiler+email+offline_access+smacc+vehicle_data+perseus+dlm+svds+cesim+vsapi+remote_services+fupo+authenticate_user" \
	--data-urlencode "authorization=${authorization}" \
	"https://${url}/gcdm/oauth/authenticate?"

The first curl call succeeds and I get cookies and this response:

{"redirect_to" : "redirect_uri=com.bmw.connected://oauth?client_id=54394a4b-b6c1-45fe-b7b2-8fd3aa9253aa&response_type=code&scope=openid profiler email offline_access smacc vehicle_data perseus dlm svds cesim vsapi remote_services fupo authenticate_user&state=rgastJbZsMtup49-Lp0FMQ&authorization=cookie_string"}

However, the second curl fails and I can't figure out why. This is the error I get:
{"error": "invalid_token", "error_description": "The presented token is invalid or expired."}

I've put debugging statements in accounts.py to get all the URL, header and data info for every post that happens, but for the life of me, I can't figure out what I'm missing. Any idea or help with what I'm doing wrong? Thanks for any tips/help that can be given.

p.s. I'm not a python guy at all. And if this should be a separate discussion, I'm good with that, too.

[rikroe]

It seems that something with your cookie is breaking it. If I am not sending exactly the same value for GCDMSSO that I recieved from the first auth call, then I get this error message.

You also only to send GCDMSSO=cookie_string as cookie, so you could try curl -b "GCDMSSO=${authorization}". Also, is GCDMSSO always the last line in your cookies.txt?

[dazole]

I figured it out. Turns out "profiler" is not the same as "profile". Stupid fat fingers are my greatest adversary, lol!

[nottledim]

I'm not having much success with this. I've updated home-assistant (2021.8.5) and bimmer-connected (0.7.18) and I still get the auth error.

I do notice that although bimmer-connected 0.7.18 is installed, in deps/lib/python3.9/site-packages the info dir is called: bimmer_connected-0.7.16.dist-info

Secondly the bimmerconnected cli program works fine - returning no errors and all the values.

I think I've fixed it now. I've no idea how.