Ethical hacking of a Smart Wi-Fi Plug

Sammanfattning

This bachelor’s thesis paper investigates the security of a smart Wi-Fi plug a power outlet remotely controlled by a smart phone, the Deltaco Smart Home SH-P01. In order to raise the security standards of the numerous new digital products produced every year, the possible security flaws of these devices must be exposed and made official to the general public. Especially since these flaws could be exploited by an adversary. By the means of ethical hacking, this paper aims to contribute with a security assessment of a device with components from a globally leading actor, Tuya. This is done by picking up where a previous study of the same device left off; penetration testing of the smart plug’s Android mobile application and its related cloud service, following the guidelines based on years of previous tests in the field. The final security assessment is that Tuya has made a real effort to securing the smart plug’s systems. The Android app, Tuya Smart, does contain some sensitive information and lacks two-factor authentication, but this did not allow for critical exploits. The cloud is deemed well-protected, and overall, there were no severe security flaws exposed by this investigation. Through more extensive penetration testing and by targeting the device’s firmware, future work could perhaps render an even more substantial assessment.