Hacking the Atomi Smart Wifi Plugs and How to Identify Whether IOT Firmware Can be Flashed

The ESP family of wifi chips is manufactured by Espressif. The chips are ubiquitous in Chinese manufactured IOT devices. The firmware on many of these devices can be replaced by open source alternatives like Tasmota or Esp Home. So how do you know if a device advertised as being Wifi-enabled is able to be flashed ? You can try to find reviews but the average reviewer doesn’t flash firmware. In addition, many devices are popping up all the time so that it may be some time before some hacker opens up the device to find out.

I was in Aldi’s a few days after Christmas and saw a package of two outlet plugs branded “atomi” and marketed as WiFi-enabled Christmas light timers:

The package was marked down to $12. One was an indoor plug with two 2.4 integrated USB ports as shown above, the second was a heavy duty black outdoor plug:

 

 

A quick search revealed that Amazon was selling the inside plug alone as the “Atomi Smart Wifi Plug” for $20.

 

 

The biggest question was were they able to be flashed with Tasmota ? Based on the little known name I guessed these were probably ESP8266 type chips but none of the reviews mention being able to flash the device firmware. A google search did not reveal anybody flashing either of these plugs.

 

 

Looking at the back of the package reveals that the plugs are ETL certified for the United States (equivalent to UL approved, good!) with an Intertek Number of 5001673.

 

 

There was no FCC ID but the bar code stated it was “13820-Smart Plug Holiday Pack”.

 

 

Going to the Intertek website for ETL Listed Products and typing in “5001673” revealed nothing. But plugging in the model number “13820” produced a couple of listings with the first being by “SHENZHEN FENERGY TECHNOLOGY CO., LTD” conforming to  a UL standard.

 

After some googling to find the FCC ID number, I tried “fcc model AT1217 SHENZHEN FENERGY TECHNOLOGY CO., LTD. – Shenzhen, Guangdong CHINA” and came up with the listing.

Photos and other information confirmed it was the same plug:

 

There’s also a “Letter of Declaration Model Difference” stating that AT1217 and At1249 models are the same (google reveals that AT1249 is sold at Home Depot also as an Atomi Smart Wifi Plug )

 

Clicking on the “internal photos” link in the FCC document shows the inside of the plug and reveals this interesting photo:

And another photo of the other side of the chip showing the four contacts required to flash:

 

 

Here’s a drawing found online:

So I bought the outlets, brought them home and opened up the interior one (removed the four screws on the bottom and wedged open the case).  I found the TYW2ES chip but the contacts were oriented down and not exposed: 

 

A quick google of “TYWE2s” shows a tutorial on the Tasmota website flashing an outlet having the same wifi module using the hard wired method.  I tried to grind through the bottom of the white outlet with a rotary tool to expose the contacts ( a dangerous and unnecessary [as explained below) step – do NOT do this!):

 

 

 

and to flash it with an FTDI usb/serial tool.  But since I didn’t want to take the time of properly soldering the contacts and/or using a jumper, it was an exercise in frustration. I finally remembered that there were some successful OTA (over the air) methods of flashing these chips, did a google search and found TUYA Convert. I quickly confirmed that the TYWE2S chip is a TUYA and proceeded to flash using the TUYA Convert instructions. Since you need to do this in Linux, I first tried running TUYA Convert in Windows’ WSL but kept getting an error questioning whether my Wifi adapter could be used as an access point. I then ssh’d in to a headless Raspberry Pi I had in the other room and ran the scripts on that machine.  I got the same error.

 

 I then found this note on prerequisite steps for  a pi, followed those steps, then the main installation steps, and it worked like a charm!

Here is the linux session running TUYA Convert:

Both outlets were easily flashed within 30 minutes without attaching any wires or having to open the devices!

 

The Configure Module in Tasmota should be set as follows to allow the manual switch on the plugs to work:

 

 

 

 

 

 

Please follow and like us:
error0

Leave a Reply

Your email address will not be published. Required fields are marked *