A False Sense of Home Security — Exposing the Vulnerability in Away Mode of Smart Plugs

With smart and connected IoT systems becoming increasingly prevalent in homes and businesses, ensuring that their `smartness' is up to the mark in making our lives secure is vital. This paper reveals the inadequacy of the `away mode' of smart plugs-which is a feature meant to safeguard a user's home security by mimicking the on-off pattern of appliance usage when a user is away, e.g., on a vacation. Using statistical methods, we show that a third party attacker can easily extrapolate sensitive usage information by analyzing accessible data gained from these commercial, off-the-shelf smart plugs. We recommend that the developers of these smart plugs should focus on implementing rule-based, coordinated, and/or learning-based models to enhance the away-mode behavior of these smart plugs to improve their performance in obfuscating user absence.