Burning down the house! Consumer champ Which? probes smart plugs to find a bunch of insecure fire-risk tat
- Reference: 1601539031
- News link: https://www.theregister.co.uk/2020/10/01/insecure_smart_plugs_which/
- Source link:
Which? bought 10 smart plugs available from popular online retailers and marketplaces, ranging from vendors such as TP-Link and Hive to "more obscure" brands such as Hictkon, Meross, and Ajax Online.
Smart plugs, as the Luddites security-conscious among our readers know, are items plugged into wall-fitted electrical receptacles that convey electricity to an appliance. They interact with things like Amazon Echo Dots and Google Nests so you can bellow at your always-on audio surveillance device to turn a desk lamp off. Many in the modern world find the convenience outweighs security concerns multiple times over.
Working with [1]security consultancy NCC Group , Which?'s researchers found 13 vulnerabilities among nine of the plugs, including three rated as "high impact" and a further three as "critical".
One device, the Hictkon Smart Plug with Dual USB Ports as bought from Amazon, had been "poorly designed, with the live connection far too close to an energy-monitoring chip," according to Which? "This could cause an arc – a luminous electrical discharge between two electrodes – which poses a fire risk, particularly to older homes with older wiring."
Amazon is said to have taken this smart plug off sale pending an investigation, with Which? urging owners to unplug them immediately.
Several of the products tested had a critical vulnerability that could allow malicious types to steal the local Wi-Fi network password "and use that to hack not only the plugs and any connected smart hub, but also any other connected products, such as a thermostat, camera or potentially even a laptop," Which? claimed.
Such concerns are realistic if the malicious person is physically close enough to the target's home to set up a fake Wi-Fi network using their home SSID and man-in-the-middle their internet traffic, a scenario that is not impossible but also quite unlikely. It has much greater importance in a shared office building, however.
In another case, Which? found a flaw that meant an attacker could seize total control of the plug, and of the power going to the connected device. The org said: "After gaining access to the TP-Link Kasa, available at Amazon, Argos and Currys, the attack itself is straightforward. Once compromised, the hacked plug could remain on the network undetected, and provide a way in for cybercriminals to mount further attacks on your data and devices. TP-Link also shares the email address used to set up the plug unencrypted with potential hackers, which could be used in phishing scams."
It appears the latter sentence means your email address is transmitted to TP-Link's servers without encryption, though we have asked for clarification.
Amazon said in a statement "safety is important" and that it likes people to contact it directly with concerns about products sold through its website. "When appropriate, we remove a product from the store, reach out to sellers, manufacturers, and government agencies for additional information, or take other actions."
Hive said in its own statement: "From what we have seen to-date, and as verified by Which?, the risk to our customers brought about from this scenario is extremely low due to the small window of opportunity, the customer interaction required and the need to be in close proximity to the devices."
TP-Link said a patch would be available for its Kasa smart plug in October. Meross told Which? its own patch could take up to six months, bringing in [2]echoes of Netgear's response to security vulns . Ajax Online didn't respond to Which and hasn't replied to The Register by the time of publication.
The UK government has [3]previously promised to pass laws making it illegal to sell Internet-of-Things devices with hard-coded default passwords. Those pledges built on [4]previous pleas from GCHQ for manufacturers to at least pretend to secure their cheap 'n' cheerful IoT crapware. ®
Get our [5]Tech Resources
[1] https://www.theregister.com/2020/08/14/crest_investigates_ncc_group/
[2] https://www.theregister.com/2020/07/30/netgear_abandons_45_routers_vuln_patching/
[3] https://www.theregister.com/2020/01/28/uk_government_cracks_down_on_iot_security/
[4] https://www.theregister.com/2018/10/15/iot_security_gchq_ncsc/
[5] https://whitepapers.theregister.com/
Re: The stupid, the lazy and the first mover
"They are great for the perfect murder"
Re: The stupid, the lazy and the first mover
A person I know has his Echo connected to his lights. Sounds great: "Alexa I'm home" and the lights in the hall, living room go on. He has the same thing at night "Alexa Goodnight" turns the lights in the living room off, and the Hall, Stairs and Bedroom lights on.
He thought this was great until we left the house together "Alexa, goodbye", and all the lights went out. When I pointed out to him that he had just told Amazon and everyone who can hack its IoT that the house was now empty, he was all "No, it's from Amazon, that makes it secure".
Re: The stupid, the lazy and the first mover
Obligatory https://xkcd.com/1807/
What for anyway?
Voice operated kit can have other side effects too. Years back (I think in the .80s), Dave Allen delivered a comedy sketch where an enthusiast is demonstrating his automated home to a friend. Amazed by the technology, the friend flops into a chair exclaiming "Well bu**er me!" The home owner shouts "NO! Cancel!"
Re: What for anyway?
Was that Dave Allen? Sounds like his humour, but I thought it was Eric and Ernie (but I was just a kid)... Either way a very apt cautionary tale.
Re: What for anyway?
Home automation always makes me think of the classic Frank Spencer - Some Mothers Do 'Ave 'Em episode I first saw as 10 y/o back in 1978. Still makes me laugh whenever it is repeated 40+ years later.
It was supposed to be a slapstick comedy, not a prophecy.
BOING!
You forgot to mention the comedy sound effect that followed!
Viz had a Top Tip many years ago, advising people to label their house keys with their address so they could be returned more easily if lost, and to maybe include a note of when the house is occupied to prevent a wasted journey for the finder.
And we laughed at the thought of a world where people have such a preposterous approach to home security. It could never happen here, right?
Re: top tip
Never put address or car reg.
If anything a tag asking they are given to police / garda etc with a code number. NOT your phone number. The code number helps convince the authorities that they are your keys.
Media is full of stupid advice.
Re: top tip
@Mage, you do know Viz is a satirical comic, don't you? The advice was meant to make you laugh, not take it seriously.
Re: top tip
Give Mage a break - that was at least a useful tip.
Re: top tip
You have heard of Viz haven't you...?
Re: top tip
I'm guessing you're not familiar with Viz magazine
Re: top tip
Didn't they have Viz in your part of town?
Not just smart plugs!
The biggest cause of accidental domestic fires outside the kitchen might now be chargers for phones, laptops and tablets. Next is other power supplies.
The small SMPSU are too small and badly made compared to the old heavy transformer based units.
Also they often don't meet RFI standards, too much radio interference that can even affect DSL broadband.
Unplug them when not in use. Don't replace wall sockets with models that have built in USB chargers.
Amazon even supplies their own branded US pinned chargers for years to European customers with some products, which is illegal.
Re: Not just smart plugs!
Scary. But citation please.
Re: Not just smart plugs!
A search through the usual souks will usually turn up something although these days it will usually be a Euro plug. A few weeks ago I bought a desoldering iron which was only available with a Euro plug. SWMBO has just bought a Clover mini iron and close inspection of the photo on Amazon showed a Euro plug although it appears they're selling it with a UK adapter.
It always pays to check the pictures of what's being advertised.
Re: Not just smart plugs!
This analysis of various USB chargers is always worth a link. It's a bit out of date now, but gives an idea of the problems they can have. http://www.righto.com/2012/10/a-dozen-usb-chargers-in-lab-apple-is.html
The OP is incorrect that such chargers are inherently dangerous simply because they're small; there's absolutely nothing wrong with the ones made competently to standards. But even genuine branded ones can be pretty terrible in terms of power quality. And no, power isn't simply power, as that article notes, sufficient noise on the input can cause problems such as having your screen completely fail to work while the charger is plugged in. The real problem is, unsurprisingly, counterfeits, which can be a serious danger. And are probably the most common things people buy because they don't understand why it would cost more for something that is "just a plug".
Re: Not just smart plugs!
This situation will only get worse now manufacturers (e.g. Apple, Samsung) no longer provide chargers "as everyone's got one". So there will be fewer properly-designed chargers, and more three-quid tat ones.
When it comes to plugging stuff into the mains, I prefer a manufacturer who has a reputation to lose.
Re: Not just smart plugs!
"Don't replace wall sockets with models that have built in USB chargers."
Just to note that any socket made to BS1363 is safe with USB ports built in. This primarily a problem for cheaper 2 pin type sockets not permitted in the UK.
Re: Not just smart plugs!
"Just to note that any socket made to BS1363 is safe with USB ports built in."
This is excellent advice, and thankyou. But how do I verify that any socket labelled as having been made to BS1363 actually has been?
Re: Not just smart plugs!
I looked at installing some of those recently since they seemed a pretty handy thing to have. None of them had a separate switch to disconnect the USB circuitry from the mains and that was enough to put me off. It is still a potential fire hazard in case of circuit failure, small though the risk might be, I can't see what difference BS1363 makes to that.
Re: Not just smart plugs!
Really? But how do you know it really does conform when almost everyone self-certifies these days. Yes there's BS1363 part 2 that pertains to USB, but various investigations by people like Electrical Safety First show that a lot of "compliant" sockets available for purchase don't even conform to Part 1 for the standard 13A bit, let alone the Part 2 for the USB stuff.
Fundamentally for me, until there is a socket available which gives the USB ports their own separate mechanical on/off switch, not going to be fitting any.
EDIT: For typos and to add that two others above clearly have the same concerns and got in before me!
If you have an alexa
and it's plugged into a smart socket, will it turn itself off when told to?
I think the second law trumps the third...
Re: If you have an alexa
[1]https://m.youtube.com/watch?v=aqAUmgE3WyM
:-)
[1] https://m.youtube.com/watch?v=aqAUmgE3WyM
Re: If you have an alexa
Superb!
Extra...
I don't currently have any Internet of Tat stuff, but when I set up my network, I dedicated an extra VLAN for IoT devices. It has its own SSID and it has only access to the Internet, no access to the other VLANs, just like the guest network.
Are these certified?
Can they legally carry BS1363?
All my plugs and sockets are decent ones and chargers are NEVER left powered up
"It appears the latter sentence means your email address is transmitted to TP-Link's servers without encryption"
Whether or not its encrypted is a secondary concern. What do they do with it when they've go it?
More money than sense
I could see the benefit of a smart plug / light to simulate activity in a house for anyone who is away and wants to give the appearance that it is occupied.
I absolutely do not see any day to day purpose in decking out a house with smart plugs / lights. It wastes power, wastes internet, invades privacy, lessens security and costs a fortune. All because someone is too fucking lazy to turn on a switch even though they're probably stood by it.
Re: More money than sense
I totally agree. Anyway, what was wrong with burning torches? Last forever, provide excellent light and can be used to ward off marauding zombies?
I think El Reg should adopt the terminology used by Youtuber aVe (an amusingly potty mouthed, very smart canadian engineer). It is not "electricity", rather it is "angry pixies" what provide the scootch to the thingummy.
skookum
Tasmota
The first thing you do with smart plugs is replace the manufacturer's spyware with the open-source Tasmota firmware that is cloud-free. Unfortunately, that won't protect you from electrical engineering flaws in the device.
The stupid, the lazy and the first mover
I know a surprising amount of people that use smart plugs:
'I can turn my xmas tree lights on when I'm not home.'
'When I see my dog looking sad I turn on the radio.'
'It's great for vacations because I can make it look like we're really at home.'
'They're brilliant, I have one where I can turn the TV on by clapping.'
That's it. Enjoy.