This website uses cookies to make the content more user-friendly and effective. By using this website, you agree to the use of cookies. You can find additonal information about the use of cookies and the possibility of objecting to the use of cookies here.

26 - 28 February 2019 // Nuremberg, Germany

Conferences and supporting programme

back to day overview
Session 02 - Hacking

Reverse Engineering the TP-Link HS-110 Wi-Fi Smart Plug Vortragssprache Englisch

The HS-110 is a cloud-enabled power plug that can be turned on and off remotely via app and offers energy monitoring and scheduling capabilities. As part of ongoing research into Internet of Things security, we performed a security analysis by reverse engineering the device firmware and Android app, sniffing communications between device-to-cloud and app-to-cloud and fuzzing the proprietary protocols being used. While cloud communication were found to be reasonably secure for an IoT device, we discovered two insecure proprietary local configuration protocols: A human-readable JSON protocol 'encrypted' with an easily reversible autokey XOR cipher and a binary DES-encrypted configuration and debugging protocol (TDDP ? TP-Link Device Debug Protocol). TDDP is in use across most of the TP-Link product line including routers and access points and thus merits further research. Summary: The Good: -Cloud functionality can be turned off -Cloud communication uses HTTPS and CA pinning -Stores energy monitoring data locally -Firmware update checks signature against RSA keys The Bad: -Useless encryption for local communication -No authentication: Anybody on the local network can turn the Smart Plug on and off, reset it or render it inoperable -TLS cloud connection could be intercepted with any valid Symantec EV certificate (only Root CA is checked) -Phones home even if set up as local-only -Undocumented configuration and debug service (TDDP)

--- Date: 27.02.2018 Time: 3:00 PM - 3:30 PM Location: Conference Counter NCC Ost



The selected entry has been placed in your favourites!

If you register you can save your favourites permanently and access all entries even when underway – via laptop or tablet.

You can register an account here to save your settings in the Exhibitors and Products Database and as well as in the Supporting Programme.The registration is not for the TicketShop and ExhibitorShop.

Register now

Your advantages at a glance:

  • Advantage Save your favourites permanently. Use the instant access – mobile too, anytime and anywhere – incl. memo function.
  • Advantage The optional newsletter gives you regular up-to-date information about new exhibitors and products – matched to your interests.
  • Advantage Call up your favourites mobile too! Simply log in and access them at anytime.