» ISP News » 
Sponsored Links

Security Researchers Find Vulnerabilities in UK WiFi Smart Plugs

Tuesday, May 18th, 2021 (9:33 am) - Score 7,840

The Head of Technical Cyber Security at A&O IT Group, Richard Hughes, has today warned UK consumers to be careful when buying cheap WiFi Smart Plugs from Amazon, eBay or AliExpress because some devices were found to harbour significant security vulnerabilities that could leave end-users exposed.

The research looked at two allegedly “popular” smart plugs, such as the Sonoff S26 and the Ener-J Wi-fi Smart Plug. The Ener-J is available with alternative branding and is believed to be a white labelled product from Tuya (the firmware seems to support this theory). Both devices retail for around the £10 mark and enable you to switch devices on and off by using a WiFi app on your mobile phone or computer, among other things.

After acquiring the devices for himself, Richard then proceeded to delve into the vulnerabilities of these plugs and discovered various “simple security errors“, such as passwords made publicly available in user guides (e.g. one device used a universal default password of.. wait for it.. “12345678“), unencrypted traffic (HTTP) between the smart plug and the mobile device that controls it, as well easy to capture WiFi credentials.

Additionally, Richard also managed to upload malicious firmware on the devices, something that costs less than £5 to do and provides exact locations of the smart plugs as well as allowing cyber criminals to launch cyber attacks from users’ WiFi networks without being caught,” said the announcement. The A&O Group’s cyber security division disclosed what they found to Sonoff but did not receive a response (yet).

NOTE: The UK Government’s new Secure by Design proposals aim to ban some poor practices, such as the use of universal default passwords.

Richard has also issued some advice for manufacturers and consumers on the subject.

What can manufacturers do to help prevent their devices being modified with malicious firmware?

• Glue or weld plastic enclosures so that it is more difficult to tamper with a device without leaving evidence in the form of cosmetic damage to the enclosure.

• Use hardware that requires a cryptographically signed firmware image.

• Coat components and connections required for dumping/flashing firmware with an epoxy resin, the removal of which would damage the components leaving the device inoperable.

• Use only approved distributors to form a trusted supply chain.

• Work with a security consultancy during product design to help ensure devices are as secure as possible before reaching production.

What can users do to protect themselves?

• Examine the device for any signs that it has been tampered with before connecting it to your network. Currently this will not be that effective as this research demonstrates it is possible to modify firmware leaving no traces.

• If possible, place untrusted devices on a separate network or VLAN.

• For the more technically savvy, monitor the communications of the device with a packet sniffer and try to confirm that all connections are valid. An organization may wish to have a vulnerability assessment completed by experienced security consultants.

Share with Twitter
Share with Linkedin
Share with Facebook
Share with Reddit
Share with Pinterest
By Mark Jackson
Mark is a professional technology writer, IT consultant and computer engineer from Dorset (England), he also founded ISPreview in 1999 and enjoys analysing the latest telecoms and broadband developments. Find me on X (Twitter), Mastodon, Facebook and .
Search ISP News
Search ISP Listings
Search ISP Reviews
20 Responses
  1. Avatar photo Bill says:

    Stating the blatantly obvious – but clearly not to the vast majority of people.

    Have you noticed how there are practically NO ethernet controlled smart sockets or even Powerline connected ones?

    The vendors would love to tie you in to their clouds . You are at their mercy…

    1. Avatar photo CarlT says:

      This might well be something to do with that most folks want to use handheld devices to control the sockets.

      This means connection to a hub across a wireless network.

      If you’re going that far may as well just put a cheap WiFi chip in the IoT stuff.

      Proprietary hub ties people in.

      An all wired solution for homes is rare because demand is pretty much non-existent.

    2. Avatar photo Connor says:

      Doesn’t help that if you want Google Home support it needs to be contactable from Googles cloud.

  2. Avatar photo Olly says:

    I thought the whole point of Sonoff devices was to flash them with your own firmware: Tasmota / ESPHome et al… Perhaps ‘Insecure by Design’ would be an alternative labelling.

    1. Avatar photo Daniel says:

      Exactly. This article is nonsense. Almost any device can be hacked/flashed with physical access.

    2. Avatar photo spurple says:

      @Daniel, how can the article be nonsense?

      To me, the takeaway was, If i buy one of these, I should consider putting my own firmware on it, because I can’t trust that the seller didn’t put some secretly malicious software on it.

  3. Avatar photo A_Builder says:

    I’d have been sprites if the headline had read

    “IoT devices found to be secure”

    1. Avatar photo A_Builder says:


    2. Avatar photo spurple says:

      oddly enough, “sprites” works quite well in the context too 🙂

  4. Avatar photo Morgan Christiansson says:

    • Glue or weld plastic enclosures so that it is more difficult to tamper with a device without leaving evidence in the form of cosmetic damage to the enclosure.

    • Use hardware that requires a cryptographically signed firmware image.

    • Coat components and connections required for dumping/flashing firmware with an epoxy resin, the removal of which would damage the components leaving the device inoperable.

    These recommendations would all stop you from securing the devices by flashing custom firmware on them 🙁

  5. Avatar photo Webstaff says:

    This articles a head scratcher.
    After skimming it quickly I feel like I’ve actually lost brain cells.
    It’s like saying you bought petrol to find out if it was flammable and would work in a car.. and you work in the car industry..
    In other important news I’m having steak for tea, which is good / bad for the environment.
    Good / bad for your health.
    But does taste nice.

    1. Avatar photo Webstaff says:

      You know what.

      Mark should know everything about whats been posted in the comments section looking at his bio.
      So is this Mark trialling some AI writers out?

      Let’s hope so. 😉

      If not let’s just stick to the ISP review stuff

  6. Avatar photo David Bayliss says:

    I liked the sonoff devices especially because you can easily/safely hack (including hardware)/program them yourself for home mains custom IoT. Their hardware seemed pretty good. Too many things are hard to cheaply customise as it is. At least leave us one hackable affordable example lol.

  7. Avatar photo Foxocube says:

    All these recommendations for securing the devices against firmware changes, Richard has clearly missed the reason why these particular ones are popular. People want to put custom firmware (such as ESPHome or Tasmota to bypass the manufacturers’ cloud services and mobile apps. Ironically those services are often far worse in terms of security than the firmware changes Richard wants to prevent. Not to mention much worse in terms of accessibility and interoperability.

  8. Avatar photo Connor says:

    I got a cheap plug a while ago from a shop locally for my tv and logged it’s connections to find it used a random Hetzner server contacted just by IP limiting that device by the availability of one server, was initially planning on rewriting their server solution locally to help but never got round to it and just ended up getting a Chromecast that had access to turn the TV off and on anyway.

  9. Avatar photo Mel says:

    I think the Eufy camera server bug just the other day, which gave users full access to other people’s Eufy cameras, including live footage, recordings, and their accounts and settings, is a good example of why being able to open something up and flash it with third party firmware, is a highly desirable feature, rather than a security risk.

    Are manufacturers going to start welding PCs shut and epoxying chips for security, so you can’t upgrade or fix them?

    One of the reasons Sonoffs are popular is that you can open them up and flash them, the only potentially semi-realistic security issue I can see that you’d try to solve by welding them shut et-al would be to stop some rogue trader flashing them with malware and selling them on ebay, and they could probably still get around it by ordering a custom version in bulk from china with firmware that uses and updates from their own server, allowing them to flash malware remotely.

  10. Avatar photo tonyp says:

    I don’t think the process of opening up a device and reflashing is a practical thing for non-techy Mr & Mrs Joe Public.

    Apart breaking open a mains bearing device, the process of downloading and configuring devices is not for the non-technical – these devices were not intended to be tampered with.

    In my case, I don’t trust the apps that the vendors want you to download to a smartphone. And for every different vendor’s device, there is a different app. I do use a few older IoT devices with Home Assistant servers running on my own network with firewalling to limit external access. These IoT devices initiate calling ‘home’ for updates etc. very regularly and these have to be watched.

    I also do not trust broker services to control my devices, who knows what they do!
    But then again, I happily use Google and so on. Ah well Caveat Emptor!

  11. Avatar photo Bump says:

    Sonoff design their devices to be easily flashable. I run them using custom firmware and with no access to anything outside their isolated network. I like being able to do this rather than having a cloud dependency.

    1. Avatar photo CTB says:

      I’m in full agreement with Bump. I have many IOTs on my home network all with the OEM code fully erased and my own home written firmware flashed instead. No Clouds, Servers or code I haven’t set up or written. SONOFF make sockets and devices for the likes of me. Please leave what you don’t understand alone.

    2. Avatar photo A_Builder says:


      By your logic SONOF should ship with no firmware rather than carp default firmware?

      Maybe just a firmware toolkit?

      I certainly have all IoT stuff on a separate set of VLAN’s if it is talking to the cloud as goodness knows what it is up to. What if the GRU knew when my milk was delivered: maybe they could do their polonium delivery at the same time or deliver the package of that ‘newcomer’ gel liquid from that nice Mr Putin?

      The mind boggles. Well it doesn’t really if you limit what the kit can see either physically or electronically.

      It is thinks like Alexa or smartphone hacking I have more of an issue with as they can get into really sensitive areas of your work or personal life.

Comments are closed

Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
Gift: None
NOW £25.00
Gift: None
Virgin Media UK ISP Logo
Virgin Media £25.00
Gift: None
Vodafone UK ISP Logo
Vodafone £26.50 - 27.00
Gift: None
Plusnet UK ISP Logo
Plusnet £27.99
Gift: None
Large Availability | View All
New Forum Topics
Cheapest ISPs for 100Mbps+
Gigaclear UK ISP Logo
Gigaclear £17.00
Gift: None
Community Fibre UK ISP Logo
Gift: None
BeFibre UK ISP Logo
BeFibre £19.00
Gift: None
YouFibre UK ISP Logo
YouFibre £21.99
Gift: None
Hey! Broadband UK ISP Logo
Gift: None
Large Availability | View All
The Top 15 Category Tags
  1. FTTP (5649)
  2. BT (3547)
  3. Politics (2578)
  4. Openreach (2327)
  5. Business (2304)
  6. Building Digital UK (2263)
  7. FTTC (2054)
  8. Mobile Broadband (2015)
  9. Statistics (1815)
  10. 4G (1703)
  11. Virgin Media (1654)
  12. Ofcom Regulation (1485)
  13. Fibre Optic (1414)
  14. Wireless Internet (1410)
  15. FTTH (1382)

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms , Privacy and Cookie Policy , Links , Website Rules , Contact