Suspicious Entry in SysLog

[chetansha]

i kept seeing this Mac address continually since last few days; I am not able to find this MAC in list of my devices, i am not sure what this device is. It says TUYA CORP
Line 4542: Feb 20 18:05:45 wlceventd: wlceventd_proc_event(645): eth6: Deauth_ind B8:06:0D:46:BD1, status: 0, reason: Unspecified reason (1), rssi:0
Line 4543: Feb 20 18:05:45 wlceventd: wlceventd_proc_event(685): eth6: Auth B8:06:0D:46:BD1, status: Successful (0), rssi:0

Line 5016: Feb 20 19:05:52 wlceventd: wlceventd_proc_event(645): eth6: Deauth_ind B8:06:0D:46:BD1, status: 0, reason: Disassociated due to inactivity (4), rssi:0
Line 5017: Feb 20 19:05:52 wlceventd: wlceventd_proc_event(662): eth6: Disassoc B8:06:0D:46:BD1, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0
Line 5018: Feb 20 19:05:52 hostapd: eth6: STA b8:06:0d:46:bd:d1 IEEE 802.11: disassociated
Line 5019: Feb 20 19:05:52 hostapd: eth6: STA b8:06:0d:46:bd:d1 IEEE 802.11: disassociated

 

[n2ubp]

i kept seeing this Mac address continually since last few days; I am not able to find this MAC in list of my devices, i am not sure what this device is. It says TUYA CORP

TUYA is an IOT device.

 

[bennor]

i am not sure what this device is. It says TUYA CORP

What IoT devices, like smart plugs, smart bulbs and wifi cameras, do you have connected to the router's WiFi?

Personally I see those kinds of entries in the system log all the time due to the various devices I have connected to the router's WiFi. From my smartphone to various IoT devices.

 

[zer0bitz]

TUYA is an IOT device.

Yup. I have several Ledvance WiFi RGB Smart lamps in my home, but for some reason they appear as TUYA in devices list.

 

[degrub]

Tuya Inc. - Wikipedia

en.wikipedia.org

phoning home with all surveillance data.

 

[Ripshod]

Feb 20 18:05:45 wlceventd: wlceventd_proc_event(685): eth6: Auth B8:06:0D:46:BD1, status: Successful (0), rssi:0

Although this entry states "successful" the "rssi:0" means it's not connected.
Typical when there is a device close by that hasn't been set up on a wifi network and just tries it's luck with yours. Devices like this will connect to any unsecured wifi to call home.
Your WiFi is secure, so just consider it log noise and ignore.

 

[killweav]

If this really is not your device it could be an errant neighbor's device that is misconfigured. Router's must acknowledge auth/deauth requests. If you never see assoc, and rssi stays at 0, it means no connection to your network. I had the same issue months back from some Tuya devices. If I blocked the MAC, it would pop up with another Tuya MAC. I was seeing 1K of those auth/deauth requests per day and it was so annoying what I ended up putting all my 2.4ghz IoT devices on thread and disabling the 2.4ghz radio on my router. Now all my low bandwidth IoT devices are on their own mesh network and my high bandwidth IoT devices (security cameras, etc) are on 5ghz band.

Make sure to harden your router / wifi. Find out which of your devices don't support WPA3 and see if you can replace them with devices that do support WPA3 & then switch your 2.4 to use WPA3 only security, not mixed. WPA3 requires protected management frames. Use a password generator to generate a min. 32 character long WiFi password & router admin password.

If an IoT device is advertised as matter-over-wifi it has a higher chance of supporting WPA3 as WPA3 support is required after 2020.

Not saying anything untoward is happening just that these are generally good practices.

In my case I just became so annoyed with it keep popping up with new variations on MAC address. After 3 new MAC I was done with 2.4ghz.

Tuya Smart Inc.
wl0
F8:17:2D:7E:96:FC
F8:17:2D:7E:93:5A
F8:17:2D:7E:89:A1

Hope this helps. Cheers.

 

[bpsmicro]

I ended up putting all my 2.4ghz IoT devices on thread and disabling the 2.4ghz radio on my router

Hmm, this is intriguing. Where can I learn more about this concept?

 

[Seth Harman]

Hmm, this is intriguing. Where can I learn more about this concept?

I assume he's referring to "Matter-over-thread" which differs from "Matter-over-WiFi" in that it still uses 2.4GHz RF to communicate directly with a Thread Matter Border Router (like a newer Amazon Echo, which is what I use) but doesn't use your existing WiFi network. This isn't as simple as changing how your existing IoT devices communicate, you have to replace them with Matter-over-Thread devices (unless, of course, your devices support that already). I have a bunch of the new Matter-over-Thread Ikea IoT devices and I can tell you it's an entire ordeal just on its own as, so far, they're significantly less stable communication-wise than the Zigbee devices I have in the house (and there's been a few news articles specifically about communication issues with these devices). I ended up having to buy a few Matter-over-Thread smart plugs and then stick them in outlets in various places around my house so the Thread mesh network was stable enough that some of my Matter devices didn't keep losing connection. Depending on how/where you're installing these devices you're going to need to ensure you've got good coverage for the entirely different thread 2.4GHz network which can actually be negatively affected by your regular 2.4GHz WiFi network. The poster you're responding to was in a position to disable his 2.4GHz to get rid of that potential interference but if you've got any devices that require 2.4GHz WiFi you're not going to be able to do that. That's my scenario; I have 2.4GHz WiFi devices so I can't disable it in my router which is potentially the source of my matter thread network instability. My advice is don't go down the Matter rabbit hole until you're fully dialed in on what it is and all the potential pitfalls.

 

[bpsmicro]

Yikes, thanks. But quite informative. I don't think I'm having any specific problems with my few WiFi-based IoT devices. And if I had to replace them anyway I'd probably just get more Zigbee to add to my collection.

 

[Seth Harman]

Yikes, thanks. But quite informative. I don't think I'm having any specific problems with my few WiFi-based IoT devices. And if I had to replace them anyway I'd probably just get more Zigbee to add to my collection.

Matter has the potential to be way more useful than Zigbee in that it's designed to be platform-agnostic, allow for local control, more secure than Zigbee, doesn't require specific/proprietary hubs just for the devices, standardized onboarding, etc... but we aren't even close to being there yet. Not only that, but I see lots of vendors still playing the game of making Matter devices but then specifically including instructions in the box for you to download/install their app; manufactures realized long ago that the app is the best way to direct-market to you so they certainly want you installing their app anyway. As a side-note I'm happy to report that none of those Ikea devices required me to use an Ikea app to onboard them, I installed them using the Alexa app and then onboarded them to my Hubitat C7 hub and I have full control of them because of some excellent community-provided drivers.

 

[killweav]

Hmm, this is intriguing. Where can I learn more about this concept?

Here is a link that might be helpful:
https://www.wired.com/story/what-is-thread/

 

[killweav]

I assume he's referring to "Matter-over-thread" which differs from "Matter-over-WiFi" in that it still uses 2.4GHz RF to communicate directly with a Thread Matter Border Router (like a newer Amazon Echo, which is what I use) but doesn't use your existing WiFi network. This isn't as simple as changing how your existing IoT devices communicate, you have to replace them with Matter-over-Thread devices (unless, of course, your devices support that already). I have a bunch of the new Matter-over-Thread Ikea IoT devices and I can tell you it's an entire ordeal just on its own as, so far, they're significantly less stable communication-wise than the Zigbee devices I have in the house (and there's been a few news articles specifically about communication issues with these devices). I ended up having to buy a few Matter-over-Thread smart plugs and then stick them in outlets in various places around my house so the Thread mesh network was stable enough that some of my Matter devices didn't keep losing connection. Depending on how/where you're installing these devices you're going to need to ensure you've got good coverage for the entirely different thread 2.4GHz network which can actually be negatively affected by your regular 2.4GHz WiFi network. The poster you're responding to was in a position to disable his 2.4GHz to get rid of that potential interference but if you've got any devices that require 2.4GHz WiFi you're not going to be able to do that. That's my scenario; I have 2.4GHz WiFi devices so I can't disable it in my router which is potentially the source of my matter thread network instability. My advice is don't go down the Matter rabbit hole until you're fully dialed in on what it is and all the potential pitfalls.

Yes, I was outlying the easiest path for him if he wants to keep using 2.4ghz WiFi and be as secure as possible. Switching to thread isn't for everyone. If he wants to keep using WiFi I highly recommend he gets all devices compatible with WPA3. I indicated Matter-over-Wifi devices for that reason. He will still have to replace some but hopefully won't need a complete rehaul of every IoT device.

 

[killweav]

pecifically including instructions in the box for you to download/install their app; manufactures realized long ago that the app is the best way to direct-market to you so they certainly want you installing their app anyway.

Exactly. And sadly most people don't know you can skip past it w/Matter. Those companies want that precious user data.