H1 Thermostat Flag0 -- Found Communication is key Have you looked at what the app is sending to the server? Flag1 -- Found Doesn't the MAC seem interesting? Access to the source code would help Check out the Android Quickstart video from Hacker101