There are many low-cost smart plugs based on ESP8266 that provide a convenient way to control lights or home appliances with your smartphone. But cybersecurity firm A&O IT Group found vulnerabilities in ITEAD’s Sonoff S26 and Ener-J Wi-fi (Tuya) smart plugs that would allow an attacker to easily access your wireless network.
The first security vulnerability is pretty common and hard to exploit since it’s only a concern during the setup. Sonoff S26 starts itself into access point mode with ITEAD-1001xxxxxx SSID, and is set up through the eWelink app with the user not needing to know the password. But with older firmware is was needed, so ITEAD still shares the default password: 12345678 in the user manual, and it can be used to connect to the smart plug by anyone. But once configured, it’s not accessible anymore as the smart plug should be in client mode connected to your router with your own credentials. So that’s not ideal, but not such a big issue.
The second issue is more concerning as the smart plug communicates over HTTP instead of HTTPS and shares some data that can be easily captured with tools like WireShark:
|
1 2 3 |
GET /device HTTP/1.1 {"deviceid":"1001xxxxxx","apikey":"e4afxxxx-xxxx-xxxx-xxxx-xxxxxxxx649a","accept":"post","chipid":"000xxxxx"} |
The data above could potentially be used to connect to the cloud, but what concerns Richard Hughes, head of technical cybersecurity, A&O IT Group the most is that the SSID and password of your router are also shared in plain text over HTTP. So an attacker within range of your router could capture the credentials to join the user’s WiFi network and attempt to exploit other connected devices within your home or launch bot attacks on the Internet.
A quick way to partially mitigate this is to set up a guest SSID for your IoT devices, so your other devices with important data are not accessible, and configure the firewall with only the service needed by your device such as MQTT. This is explained in detail on Tasmota website.
Talking about Tasmota, that’s another way to make your device secure: simply install the open-source firmware on your device and configure TLS if your plug supports it (mostly memory/storage requirements). In the past, you did not even have to open the device, but the trick may not work anymore, so the device may have to be open, and the firmware flashed through the serial port.
Having said that, A&O IT Group considers the ability to fairly easily flash the firmware to be a security vulnerability, but to many CNX Software readers, it’s more like a feature with Tasmota, ESPhome, and ESPurna open-source firmware offering more secure alternatives. ISPReview who first published the news, list some interesting “solutions” for manufacturers which include:
- Glue or weld plastic enclosures so that it is more difficult to tamper with a device without leaving evidence in the form of cosmetic damage to the enclosure.
- Use hardware that requires a cryptographically signed firmware image.
- Coat components and connections required for dumping/flashing firmware with an epoxy resin, the removal of which would damage the components leaving the device inoperable.
Hopefully, ITEAD will not follow those recommendations as it would negatively impact users who want to flash their own firmware or repair the device, but will instead work on fixing the firmware and the first two vulnerabilities listed in this post. We contacted ITEAD for comment yesterday, but have not received a reply yet. I’ll make sure to update the post when/if we get a reply.
Thanks to TLS for the tip.
Jean-Luc started CNX Software in 2010 as a part-time endeavor, before quitting his job as a software engineering manager, and starting to write daily news, and reviews full time later in 2011.
Support CNX Software! Donate via cryptocurrencies, become a Patron on Patreon, or purchase goods on Amazon or Aliexpress
Tasmota doesn’t work on Tuya devices anymore as they do not use espressif devices.
And before that Tuya updated the firmware to avoid easily flashing tasmota which had the lovely side effect of breaking realtime power monitoring as well.
A properly segregated IoT wifi network should always be used, period. It’s unfortunate that it’s a pain to set up with the correct settings and repeaters that it’s out of the realm of the average user, let alone grandma and grandpa.
This was never a Sonoff issue or Tasmota solution. They were players but there were many other much bigger doing just as bad things today. Smart devices are chatty to not necessary IPs all the time. It’s a manufactured in a foreign state run country who loves spying through the tech we consume so heavily. So now they have access to every house. Who needs nukes when you can blast Rick Roll from all my devices!!
Bloody circuit breakers are smart too! Pull the cord