Amazon Smart Plug

Security Grade

A-

Calculator v1

Amazon Smart Plug

   Brand: Amazon (Parent: Amazon.com, Inc.)

   Category: Smart Plug • Model / Gen: 2 B089DR29T6 (Current US Model)

   Release Date: 2018-09-12 • Status: In sale

   Classification Date: 2025-10-17 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	No public reports of specific hardware tampering vulnerabilities. As a simple, sealed device, physical attacks are not a primary threat vector for remote exploitation.
Known vulnerabilities	Rare	🔗 Proof	A vulnerability was discovered in 2020 that could expose the user's Wi-Fi password. Amazon patched this via an automatic firmware update. This demonstrates a history of vulnerabilities that are addressed by the vendor.
Prior attacks	None	🔗 Proof	While vulnerabilities have been found by researchers, there are no documented cases of these being used in widespread, successful attacks against users.
Updatability	Very common	🔗 Proof	Firmware updates are pushed automatically by Amazon over-the-air. The user does not need to take any action, ensuring security patches are applied in a timely manner.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Full	🔗 Proof	Deeply integrated into the Alexa ecosystem. Authentication is handled via the secure Amazon account and can be used in routines and commands with other Alexa-compatible devices.
Communications	Encrypted with up-to-date encryption	🔗 Proof	The plug connects to the local network using WPA2. All communications with the AWS (Amazon Web Services) cloud are encrypted using Transport Layer Security (TLS).
Storage	Encrypted with up-to-date encryption	🔗 Proof	The device itself stores minimal data. All configuration, schedules, and state information are stored securely and encrypted in the AWS IoT Core cloud platform.
Category Score	Score: 1 / 3

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Managed entirely through the user's Amazon account, which provides robust options like password management, viewing logged-in devices, and enabling Two-Step Verification (2FA).
Authentication	Secure	🔗 Proof	Access is controlled via the Amazon account login. Enabling Two-Step Verification (2FA) on the account provides a secure authentication method for controlling the device via the app.
Brute-force protection	Exist	🔗 Proof	Protection is handled at the Amazon account level. Multiple failed login attempts will trigger CAPTCHAs, account lockouts, and notifications, effectively protecting against brute-force attacks.
Event logging	Partial logging	🔗 Proof	The Alexa app's Activity section logs voice commands used to control the plug. However, it does not provide a specific security log detailing which user or device triggered a manual on/off event via the app.
Passwords	Require change after setup with complexity requirements	🔗 Proof	The device itself has no password. It is controlled by the Amazon account, which requires a user-created password with certain complexity rules upon registration. There are no default credentials.
Category Score	Score: 2 / 3

Property	Details
Operating System & App	Proprietary (Companion App: Amazon Alexa App)
Hardware (CPU / GPU)	CPU: • GPU: N/A
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: None • Power: Plugs into a standard electrical outlet • Charging: N/A
Display & Camera	Display: None (has a single LED indicator) • Camera: None
Sound & Connectivity	Sound: None • Connectivity: Wi-Fi IEEE 802.11 b/g/n, 2.4 GHz, Bluetooth Low Energy (for setup)
Physical (Dimensions & Mass)	Dimensions: 76.2 x 38.1 x 55.9 mm • Mass: 86g