A Security Analysis of Consumer Smart Plugs

Sammanfattning

As the number of Internet of Things (IoT) devices increases, so does their presence in smarthomes and other industrial environments. While these devices can benefit various applicationsor tasks through automation and remote control, they can pose a significant security and privacy risk as demonstrated by previous research. This thesis investigates the security of threeconsumer smart plugs from different market segments in order to contribute to the broader understanding of IoT device security. The evaluation was conducted through penetration testing,a process in which assessors attempt to mimic real-world attacks against the target device toidentify vulnerabilities. For this thesis the PatrIoT methodology was utilized. It was developedspecifically for penetration testing IoT devices and encompasses the following phases: planning,threat modeling, exploitation and reporting. The results revealed four previously undocumentedvulnerabilities across the three devices, as well as one previously reported vulnerability that hadnot been remediated. The main causes were insecure network communication, exposure of sensitive data during setup or authentication, and insufficient firmware integrity verification. Whileseveral attacks depended on conditions such as local network access, physical proximity of anattacker, or a limited pairing window, the findings demonstrate that consumer smart plugs canstill pose meaningful security and privacy risks. The thesis concludes that stronger encryption,secure firmware validation, and consumer-side measures such as network segmentation are important for improving smart plug security.