(Digitally) Stumbling upon Tuya's testing facilities

Felix Kohlhas
Tags: WiFi OSINT

While playing around with kismet recently, I noticed that there were some devices in my vicinity sending probe requests for a wifi network called tuya_mdev_test2.

tuya_mdev_test2 displayed in kismet

I searched for the SSID on wigle.net and found two locations: One in the Netherlands and one (as expected) in Shenzen, China. The coverage of wigle.net in China is limited, so I was happily surprised, that this network had been discovered.

map showing network in Shenzen, China

Upon researching a bit further I found this documentation by Tuya describing how networks with the name tuya_mdev_test1 and tuya_mdev_test2 are used to put devices into a test mode in the factory.

I only realised later, that the devices in question were the three smart plugs I had recently bought, but not configured yet. (I had plugged them into a high load device, to test if they would spontaneously catch fire, as they seem to have done in some reviews on AliExpress.)

Burnt smart plug
Photo from AliExpress review