Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A 2014 hack of the Kankun KK-SP3 showed that a cheap Wi-Fi plug could contain a small OpenWrt computer—and that local shell access could control its relay without decoding the phone app’s apparently encrypted UDP protocol. The project is a useful embedded-Linux case study, not a dependable modern smart-plug recipe: the hardware is old, support is limited, and opening a mains-powered device can cause fatal shock or fire.
What was the $20 plug?
The device in the 2014 Hackaday report was a Kankun Wi-Fi smart plug, commonly identified as the KK-SP3 and also associated with names such as Huafeng WiFi Plug and Small K WiFi switch. Its stock purpose was straightforward: switch an outlet remotely through an Android or iOS app. The factory workflow offered little obvious local integration, which made the inexpensive hardware more interesting to hackers than its app experience. Hackaday’s November 13, 2014 report describes the original discovery.
Names, outlet enclosures, and regional versions varied. A community guide documents one KK-SP3 configuration, but that does not establish that every Kankun-branded plug or visually similar clone has the same board, firmware, electrical characteristics, or GPIO mapping. Identify the exact unit before applying any technical detail.
Recommended Free Tools
How did the original hack work?
Local discovery, not a demonstrated Internet exploit
The Hackaday account describes finding the plug on a local network with network scanning, recognizing an OpenWrt/Linux environment, and discovering that the reported login credentials were root/admin. Treat that as a historical finding about the reported device, not a universal password for all models. The article does not publish a complete scan transcript or port list, so one should not infer either from it.
#1 Best Overall
- Stability Upgrade Quick Connection:Supports Bluetooth or WiFi connection.The improved WiFi technology let you quick connection and stay stable,no disconnection worries. Please keep the smart plug connected to your stable 2.4GHz network.(Note: Only 2.4Ghz WiFi)
- Hand-Free Voice Control:Smart plugs that work with Alexa and Googel Assistant. Just give a simple voice command to Alexa or Google Assistant to control your connected home devices. Enjoy the joy of smart home devices.
- APP Remote Control From Anywhere:You also can control your outlet timers anywhere anytime via the APP directly when you are away. Monitor and control connected electrical equipment in your home.The smart outlet plug compatible with GHome APP, Smart Life App and Tuya App.
- Schedules and Timer Function:Easy to set timers and add schedules to connected smart home devices circularly or randomly, making them work as scheduled like auto-off and auto-on to save energy and money. Such as lamps, fan, humidifier, Christmas light timers etc.
- Group Control and Sharing:You can set a group for some wifi smart plugs and control connected appliances with one tap. Also you can share your wifi outlet plug by App with your families and enjoy the smart life together.
This is evidence of local-network access, not proof that the plug was remotely exploitable over the public Internet. Internet reachability would depend on router configuration, port forwarding, firmware behavior, and other conditions not established in the report. Testing should be limited to devices and networks you own or are authorized to assess.
They bypassed the app protocol
The original mobile app reportedly communicated using UDP packets that appeared encrypted. The hackers did not document a completed protocol decryption. Instead, after gaining device-side access, they controlled the relay directly through Linux GPIO and exposed that operation through a CGI/HTTP route. A Windows utility sent requests to the script. That distinction matters: the achievement was local relay control through the plug’s own Linux environment, not a general-purpose decoder for the proprietary app protocol.
What was inside the documented KK-SP3?
A later community reverse-engineering guide describes a particular hardware setup with an Atheros AR9330 system-on-chip at 400 MHz, 4 MB of flash, 32 MB of RAM, 802.11 b/g/n Wi-Fi, and OpenWrt 14 “Barrier Breaker” build r39365. It lists no native Ethernet or USB ports. These are community-documented specifications for that configuration, not a current manufacturer data sheet or a guarantee about other revisions. See the KK-SP3 community guide.
Rank #2
- Stability Upgrade Quick Connection:Supports Bluetooth or WiFi connection.The improved WiFi technology let you quick connection and stay stable,no disconnection worries. Please keep the smart plug connected to your stable 2.4GHz network.(Note: Only 2.4Ghz WiFi)
- Hand-Free Voice Control:Smart plugs that work with Alexa and Googel Assistant. Just give a simple voice command to Alexa or Google Assistant to control your connected home devices. Enjoy the joy of smart home devices.
- APP Remote Control From Anywhere:You also can control your outlet timers anywhere anytime via the APP directly when you are away. Monitor and control connected electrical equipment in your home.The smart outlet plug compatible with GHome APP, Smart Life App and Tuya App.
- Schedules and Timer Function:Easy to set timers and add schedules to connected smart home devices circularly or randomly, making them work as scheduled like auto-off and auto-on to save energy and money. Such as lamps, fan, humidifier, Christmas light timers etc.
- Note: To use Alexa and Google Home, please note that this product cannot be connected directly. You need to connect the product to the network and the GHome APP first.
The guide identifies an Omron HF32F-G/012-H relay, described there as 10 A and approximately 2,200 W, and documents GPIO 26 as the relay-control line in its setup. Those figures describe the cited hardware reference; they are not a blanket safe-load recommendation. Outlet format, enclosure, wiring, local electrical standards, load type, and actual board revision all matter.
How does GPIO control the relay?
In the community guide’s vanilla OpenWrt arrangement, the relay is controlled by exporting GPIO 26, setting it as an output, and writing a value. The Linux GPIO sysfs interface used by these commands is legacy on newer Linux systems; exact paths and behavior depend on the firmware and kernel. OpenWrt’s GPIO documentation explains the general interface, but it does not validate this plug’s pin mapping.
echo 26 > /sys/class/gpio/export
echo out > /sys/class/gpio/gpio26/direction
echo 1 > /sys/devices/virtual/gpio/gpio26/value
echo 0 > /sys/devices/virtual/gpio/gpio26/valueThe documented commands assume GPIO 26 is available, the board uses that mapping, the firmware exposes these sysfs paths, and the relay polarity matches the example. The guide notes that its OpenWrt 15.05/WR703N-style setup did not automatically define the relay as a named LED, which is why it exported the GPIO manually. A GPIO may instead be claimed by a driver or serve another function; an incorrect assumption can produce no action or unintended behavior.
Rank #3
- Stability Upgrade Quick Connection:Supports Bluetooth or WiFi connection.The improved WiFi technology let you quick connection and stay stable,no disconnection worries. Please keep the smart plug connected to your stable 2.4GHz network.(Note: Only 2.4Ghz WiFi)
- Hand-Free Voice Control:Smart plugs that work with Alexa and Googel Assistant. Just give a simple voice command to Alexa or Google Assistant to control your connected home devices. Enjoy the joy of smart home devices.
- APP Remote Control From Anywhere:You also can control your outlet timers anywhere anytime via the APP directly when you are away. Monitor and control connected electrical equipment in your home.The smart outlet plug compatible with GHome APP, Smart Life App and Tuya App.
- Schedules and Timer Function:Easy to set timers and add schedules to connected smart home devices circularly or randomly, making them work as scheduled like auto-off and auto-on to save energy and money. Such as lamps, fan, humidifier, Christmas light timers etc.
- Group Control and Sharing:You can set a group for some wifi smart plugs and control connected appliances with one tap. Also you can share your wifi outlet plug by App with your families and enjoy the smart life together.
The guide recommends putting initialization in /etc/rc.local to run after boot. Do not copy that change blindly: first confirm the device and firmware, establish a recovery plan, and test relay behavior with a low-risk load. Some boards may be active-low, so the value that switches a relay on can be the reverse of the example.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →What did the CGI and HTTP layer add?
A CGI script turns direct GPIO operations into requests a browser or automation client can make. The community guide gives example paths for a simple relay script:
/cgi-bin/relay.cgi?on
/cgi-bin/relay.cgi?off
/cgi-bin/relay.cgi?toggleThose paths are examples for a modified device with the relevant script installed; they are not guaranteed to exist on untouched factory firmware. They also do not provide security by themselves. An unauthenticated switch endpoint is a power-control API available to any host that can reach it.
Rank #4
- Voice control: Kasa smart plugs that work with Alexa and Google Home Assistant. Enjoy the hands free convenience of controlling any home electronic appliances with your voice via Amazon Alexa or Google Assistant. Compatible with Android 5.0 or higher and iOS 10.0 or higher
- Smart Outlet Control from anywhere: Turn electronics on and off your smart home devices from anywhere with your smartphone using the Kasa app, whether you are at home, in the office or on vacation
- Scheduling: Use timer or countdown schedules to set your wifi smart plug to automatically turn on and off any home electronic appliances such as lamps, fan, humidifier, Christmas lights etc. The Kasa app is free and compatible with iOS 10.0 or later.
- Easy set up and use: 2.4GHz Wi-Fi connection required. Plug in, open the Kasa app, follow the simple instructions and enjoy
- Trusted and reliable: Designed and developed in Silicon Valley, Kasa is trusted by over 5 Million users and being the reader’s choice for PCMag 2020. UL certified for safety use.
Home Assistant’s Kankun integration uses a different, structured JSON CGI interface, with /cgi-bin/json.cgi as its documented default and configurable connection details including host, port, path, and optional basic-auth credentials. It expects a modified Kankun with the JSON CGI script installed. See the Home Assistant Kankun integration documentation. The simple relay.cgi examples, the integration’s json.cgi, the Windows client, and the original app’s UDP protocol are distinct layers—not interchangeable names for one API.
How to approach a reproduction in a lab
This is a historical hardware experiment, not a turnkey tutorial for an unknown plug. The commands and firmware behavior below apply only after confirming the unit matches the documented configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Identify and document the unit. Record the exact model, regional outlet version, visible board markings, firmware, and configuration. Photograph the intact device and preserve settings before making changes.
- Isolate the network. Use a dedicated test WLAN or IoT VLAN. Find the device’s DHCP lease, then scan only your authorized private test network to confirm its address and reachable services. Do not expose management access or CGI routes through a public-facing port forward.
- Plan recovery before altering firmware. Back up configuration and determine a realistic rollback path. The community guide warns that wireless may be disabled in vanilla OpenWrt images and that upgrades may fail to preserve wireless configuration, leaving the plug unreachable. Small flash capacity also restricts firmware choices. Recovery may require serial or hardware access; do not assume it will be available or straightforward.
- Use only device-specific credentials. The 2014 report’s
root/adminfinding is not a universal credential. If you gain authorized shell access, change or disable default credentials if the firmware permits, and keep the device isolated while assessing it. - Verify relay mapping and polarity cautiously. Only after confirming the board and firmware match should you try the documented GPIO sequence. Observe the relay with a small, low-risk load and stop if behavior differs from expectations; do not toggle arbitrary pins on an unknown mains-connected board.
- Add local automation only after direct control is reliable. If installing a CGI script, use authentication where supported, restrict access to trusted hosts, and avoid WAN exposure. Integrate with a local controller only once the device’s actual interface and relay state are understood.
What can go wrong?
- The plug vanishes after a firmware change: a wireless configuration may have been lost, an image may not fit the flash, or the device may not boot as expected. A backup and plausible recovery method need to exist before flashing; wireless recovery cannot be promised for every revision.
- The GPIO command has no effect: the board revision may use another pin, the pin may be claimed by a driver, the kernel may lack the expected sysfs interface, or the relay circuit may have a fault.
- The relay switches backward: active-low control can invert the meaning of 0 and 1. Confirm actual state transitions under controlled conditions instead of assuming the example’s polarity.
- The CGI endpoint works but is exposed: without effective authentication and network restrictions, reachable users or devices may be able to switch the outlet. Strong credentials, firewalling to trusted hosts, and a separate IoT network reduce exposure; they do not make obsolete firmware current or secure.
- Operation is intermittent: weak Wi-Fi, old firmware, power-supply degradation, relay wear, or app incompatibility are possible factors. The original report does not establish a specific cause for intermittent behavior.
Why mains safety changes the answer
A smart plug contains mains-voltage conductors and switching components. Opening, probing, or modifying an energized enclosure risks lethal shock, arc injury, fire, and loss of electrical isolation. This article is not an instruction to open or work on a live plug. If you are not qualified to work safely with mains equipment, do not open it; use a certified, intact device instead. Any mains-side inspection belongs to a qualified person using appropriate isolation and procedures.
Best Value
- Voice control: Kasa smart plugs that work with Alexa and Google Home Assistant. Enjoy the hands free convenience of controlling any home electronic appliances with your voice via Amazon Alexa or Google Assistant
- Easy set up and use: 2.4GHz Wi-Fi connection required. Plug in, open the case app, follow the simple instructions and enjoy. Kasa app reqiured
- Scheduling: Use timer or countdown schedules set your smart plug to automatically turn on and off any home electronic appliances such as lamps, fan, humidifier, Christmas lights etc.
- Smart Outlet Control from Anywhere: Turn electronics on and off from anywhere with your smartphone using the Kasa app, whether you are at home, in the office or on vacation.
- Trusted and Reliable: Kasa is trusted by over 6 Million users and being the Reader’s Choice of PCMag 2020. UL certified for safety use. 2-year warranty.
Even the community guide’s 10 A / approximately 2,200 W relay description is not permission to run a heater or other high-risk appliance. Relay ratings do not establish safe continuous operation for every enclosure, region, wiring condition, or type of load. Resistive appliances, motors, and inductive loads place different demands on switching hardware. Do not use an old low-cost plug as a safety-critical cutoff, or for heating appliances, ovens, dryers, pumps, medical equipment, EV charging, or any load where unexpected switching could cause injury or property damage.
Is the Kankun hack still practical?
It remains worthwhile as a reverse-engineering lesson in network discovery, embedded Linux, GPIO, and lightweight HTTP control. It is generally a poor choice for a dependable smart-home installation or a new purchase. The hardware and stock software are obsolete; later community documentation reports that the original mobile apps may no longer work, and the current Home Assistant integration is categorized as legacy with eight active installations listed when its documentation was retrieved. App availability can differ by platform, archive, and region, so that report should not be read as proof that no copy can function anywhere.
The practical drawbacks compound: tiny flash and RAM, no native USB or Ethernet in the documented unit, revision-dependent wiring, uncertain recovery after firmware changes, and a mains enclosure that should not be casually opened. A working demonstration proves the Linux system can switch a relay; it does not prove long-term support, electrical suitability, or secure configuration.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat to choose for a current local-control project
For readers who want the same general outcome—local switching and automation—use hardware whose exact model, regional certification, firmware support, and local API are documented. Home Assistant is a local automation platform that can coordinate supported devices; its Kankun integration is specifically for modified legacy hardware, not a fix for the plug’s age. Tasmota is open firmware for supported ESP8266, ESP8285, and ESP32 devices, but it is not a firmware option for the Kankun’s Atheros/OpenWrt platform. Consult the Tasmota project and its getting-started documentation when choosing compatible hardware.
- Confirm the exact model and regional plug variant rather than relying on a product-family name or listing photo.
- Check that local control is documented for the precise revision, including whether it uses HTTP, MQTT, or another interface.
- Verify electrical certification, load rating, and suitability for the intended load; do not infer these from a relay part number alone.
- Prefer a pre-flashed, supported device if the goal is automation rather than firmware recovery or board-level learning.
Modern local-control plugs still require model-specific scrutiny, but they avoid making an obsolete app-dependent device the foundation of a home’s power control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Leave a Reply