IoT and Smart Home Devices: Part 1

 

Source: https://www.sparkfun.com/products/17146            

 

This is going to be a multi part post going over a little IoT smart plug I picked up on clearance at Walmart. I'll make it clear I'm generally very skeptical about these types of devices so much that I don’t even want my roommates Alexa on the same network as mine. However with these things being so prolific it is best to understand them so we can better protect our networks. Ill start with a little background of the device, how I acquired it, and my research on the brand. I will then do my best to uncover any (hopefully) FCC filings and their documentation. From there we will explore a bit of the theory on how the majority of these cheaper devices connect to our networks. Lastly Ill do my best to capture packets during the join process but we will see how that goes with my limited setup. 

I was looking to purchase a new Roku and since Walmart was the closest store that would have one I went in to see if I could get it. Unfortunately they were out of the model I wanted but something else caught my eye on the clearance shelf. An outdoor smart plug from Merkury Innovations. It was marked down from $15 to about $8 and with my natural distrust for IoT devices I decided to buy it and see if I could learn more about it. Now I wont be reviewing this product in a conventional sense and I cant speak for security of the associated app but we can take a look at how it operates on your home network. 

My first question: Who is Merkury? A quick Google search will lead to your their main page along with their LinkedIn profile. It lists them as located in New York but not much else. They appear to operate 3 different brands all dealing with smart home/IoT and other small electronic devices. The brands are Merkury, Geeni and iHome. I was surprised since even as a long time Android user, I knew what an iHome (or atleast the original inception) was. Poking around a bit it seems that Merkury is the over arching brand that also sells Geeni and iHome products. I know this info dosent directly pertain to how it operates but I feel its good to know what your buying, especially when it comes to IoT devices. 

If you have ever taken a look around the Useful Tools page on here you might have come across the FCC’s ID search page. This allows us to take the FCCID on the back of your device (provided it conforms and has passed validation) and enter it to find out more details. The FCC ID is 2AC2CDR-017 and using this page we find a host of fun facts. For integrators and installers the DoC (Declaration of Conformity) is probably the most important. For the nerds and engineers the internal photos and test report pages are of interest. With the internal photos we can generally identify the RF module in use. Here we find the ubiquitous ESP8266 chip on a TYWE3S board. On the modules page we can see all the specs it has to offer, we know all of its capabilities now and have an idea of the performance we can expect. 

Since this type of device will be used outside we can take a look at the RX performance of the radio. We see that it has a Receiver Sensitivity of -91dBm for receiving data at 1Mbps DSSS. But we also see it requires potentially in the high 60’s or low 70’s for receiving OFDM data. This could present an issue if you disable CCK rates (you should) and do not provide an additional IoT SSID with these rates enabled. We can crudely test these numbers (and we will!) though. 

The TX performance will also give us an idea about how far we can have this device so it can reliably report back its status. If it can't report back what its operational status is and we are not near the thing being powered there is no feedback for us to verify whether or not it is working. 

Ill stop here since Im hoping you'll pick up one of your devices laying around and visit the FCCID page to find out more about what your using. In the next post we'll go over the theory of operation on Wifi Direct since it has been around longer than the recently released Wifi Easy Connect method.