The Flume Water Monitor attaches to home water meters and transmits usage data via a 915 MHz RF link to a Wi-Fi bridge. The sensor–bridge connection uses 50-channel frequency hopping in the 902.5–927 MHz band with 2-FSK modulation at 200 kbps. Messages are whitened via the RFM69 transmitter chip and protected by CRC-16 (polynomial 0x1021).

The 16-byte payload uses AES-128 ECB mode encryption with a key derived from an 8-byte value via hardcoded mapping. Unencrypted header bytes leak 16 key bits, and half the last byte is a known constant, reducing the search space to 44-bit. An unoptimized Python script on a GPU brute-forced the key in roughly one day (<$10 cloud cost), aided by Steve Crosby's prior reverse-engineering work.

The author notes this security level is "not unreasonable" for a consumer sensor but warns that known parameters enable message spoofing, potentially allowing malicious OTA firmware updates. Flume responded promptly, sharing in-progress plans to strengthen privacy and security, and approved publication of the findings.