How secure are tp link kasa devices?

Question

When setting up a kasa smart device, say a wifi smart plug, it asks for the wifi credentials and then it connects to the network.

Since these devices can be controlled remotely via the kasa app, one must assume central tp link servers in the cloud are part of the command and control so a user can operate these devices remotely.

How secure is this setup? With the device on the wifi network and connected to the to the tp link cloud, there must be some risk of a rogue tp link employee sniffing around the network looking for hosts to compromise. That is if we believe tp link doesn't do that as matter of course to at least scan for connected devices on the wifi network.

Will it be correct to assume that by using these devices, we entrust that tp link can do evil but doesn't do it because that would be bad for business? Additionally do we entrust that their systems are secure enough to defend against compromise from outside sources trying to penetrate people's networks?

Answer 1

How secure is this setup?

No one knows. It depends on lots of things like your use case, quality of the software, adversary, threat model. Do you need to connect the device to the WAN/TP Link Cloud in order to use it? Why do you use it in the first place?

Will it be correct to assume that by using these devices, we entrust that tp link can do evil but doesn't do it because that would be bad for business?

Generally yes. You are trusting your ISP not to be evil, this website, your OS/hardware manufacturer etc. However, if you are a billionaire or some other kind of juicy target (like TP Link competitor, enemy of the state, ...) it might be different. Maybe it is worth the risk in this case. How would you know it would be TP Link themselves? Maybe some adversary gained access to their network and started to target you specifically. Or TP Link just claimed someone else did while they did it themselves.

Additionally do we entrust that their systems are secure enough to defend against compromise from outside sources trying to penetrate people's networks?

The "S" in IoT stands for Security. People could attack you via TP Link or through knowing you are using TP Link devices. There are regularly CVEs for all kinds of devices and software. TP Link is no exception. Companies also get breached regularly (sometimes without being aware of it). TP Link is not Fort Knox, neither is their software.