Just plug the washing machine into a smartplug and alert when power draw drops to idle for more than X minutes.

An easier way is to run an Android virtual device with an older Android version on your computer. You can then use some scripts to add the certificates and proxy the traffic to Burpsuite or mitmproxy. That way you also don't have to switch devices.

It would also be interesting to use APKLab or Jadx to look at the code of the app. Maybe you can find the key derivation algorithm. The app and the washing machine must somehow generate keys or have pre-shared secrets.

If I understand correctly, the app only works if both devices are in the same network? I like that

So I decided to solve it.

Using the Bosch API - I can tell both when a cycle is complete, and if the door is open. Currently I use their default version, but there is a local hosted option I'll be switching too now the proof of concept works.

So using Home Assistant I have a simple script that detects when a washing machine cycle is complete AND the door has NOT been opened. This implies my washing machine has wet clothes still in it.

So Home Assistant will alert my phone (and my wife only if she is home based upon presence detection) once every 15mins that there are wet clothes waiting in the washing machine.

Very simple - works perfectly.

Here is one in the same vein: https://hackaday.com/2023/04/15/internet-of-washing-machines... => https://tratt.net/laurie/blog/2023/displaying_my_washing_mac...

Otherwise, you would need some MitM style attack?

Anybody interested in this write up? Might even include a "Office Space"-esque montage of the smart module destruction.

Are those gratuitous ARPs? This is a common behaviour.