homeassistant

Or the old fashion way, don't BUY them.

Upon installation LG's app helpfully informed me that to be notified that my LG refrigerator temperature is high or my washer's cycle is complete I am expected to inform a Korean company of my exact location at all times. The reason LG gives for this bullshit is "analytics". There is no way in hell.

I disconnected my LG appliances from wifi, deleted their spyware from my phone and duplicated the functions with Home Assistant. A couple of inexpensive sensors and a power monitoring plug provide almost all same functions without getting Korea (or the Internet) involved at all. Surprisingly this setup is much more reliable than LG's spyware too.

First thing I do when I get a smart appliance is scan it with nmap.

A wonderful habit. I will try to copy it from you :)

About your main question, I can only guess that it's for the initial setup of these appliances. Initially, they know nothing about your Wifi situation. So maybe they open up their own Wifi and connect their app so that you can enter some info. Afterwards, maybe some services continue to run there...

You mention it’s listening on port 53, but have you actually tried DNS queries to see how it responds? Will it resolve www.google.com or <reverse_ip>.in-address.arpa?

A port scan and then inspection of the ports is a great habit. Another fun thing to do is to set up WireShark to listen to what your fridge's IP address is doing. Who is it calling? How often? What services (ports)? While your fridge may have a DNS server, unless it's been pre-loaded with the internet, it'll need to query another DNS to reach the outside world. DNS is usually unencrypted, so you can see what it's asking to connect to.

Many of these devices announce their services via Bonjour or whatever protocol. It's a way for devices like Alexa to find out that you have a printer, interrogate the printer and then Alexa will tell you that your printer is low on ink and by the way, Amazon has a special sale, just for you.

If anything is unencrypted, check it out (with WireShark). If it is encrypted, there's a chance that you can hijack it with a proxy server. Set up a SOCKS proxy and add a DNS label (I can't remember what it is) to tell the devices in your network that you have a proxy. Block the fridge from the internet and see if it will autodetect the proxy. There are other ways to tell devices that your home network requires a proxy via autodetection & wpad.dat files in specific locations on your network. You can configure your proxy to log all traffic, like WireShark does and then see what's in the payload.

I've done this with limited success on various devices. More mature products like Alexa are locked down. Those cheap home cameras from China are pretty hackable.

Have fun!

For those who are saying I shouldn't have bought these half-baked smart appliances, I agree. But I wasn't always this aware of the privacy issues involved. The washer and dryer were purchased before I grasped how problematic cloud-connected always online IoT devices are, and as mentioned in the OP the ability to tell me when my laundry was done seemed like a genuinely useful feature. In the case of the fridge it was an emergency replacement and we took what fit the preexisting niche in our kitchen, and the complete lack of output on the fridge itself necessitated the app.

Most appliances connect using a cheap microprocessor like an ESP-32 which provides both WiFi and BLE.

If there's a DNS server running, it's usually for mDNS/ZeroConf service discovery. Usually so it can easily get provisioned via a smart speaker or hub.

More details here: https://circuitlabs.net/dns-server-and-dns-sd-implementation/

Maybe for mDNS so the app can discover the appliance.

The only thing LG makes that's of any value are OLED-panels. The TVs they build around them however suck ass now.

No one needs "smart" appliances. I know it's fun to get a message telling you your water filter needs replacing, but come on...

If you want your fridge to tell you its temp, just slap your own temp sensor in it. Put a mic by your laundry machine to detect the buzzer and alert you. DIY all the things, don't give these "smart" appliance companies money to spy on you.

None of the brands I considered when buying a new dishwasher had any spyware nor networking capability. Electrolux and Gram are both excellent and affordable. My last dishwasher was a Gram that I bought second hand for 300€, used for 12 years, and gave to the new tenant of my old apartment because I couldn't be arsed to remove it. Never had a single issue.