I tested a $15 smart switch and found a coffee maker wasting $1,500 a year in electricity


img-4753.jpg

SwitchBot Relay 1PM switch

pros and cons

Pros

  • Compact design that fits behind a switch or socket
  • Easy to fit and set up
  • The app is packed with features.
Cons

  • Installation can be fiddly
  • The unit has to be fitted in an enclosure to reduce the risk of electric shock.

Follow ZDNET: Add us as a preferred source on Google.


Has someone in your life ever yelled at you for leaving the lights on? Despite the shift to LED lights, it’s still a good idea to turn things off because, while one light might only cost about a dollar a month to run 24/7/365 (here, I’m assuming it’s a 6-watt bulb and your electricity costs $0.20 per kWh), think about how many light bulbs you have at home. It soon adds up.

Also: How I cut my power bill with IFTTT automation – in 4 simple steps

But sometimes, something that you leave on might draw a lot more power than you think, and if it’s a pain to turn on and off, or if it looks like it’s not doing much when it’s in standby mode, people are going to be tempted to leave it on.

Something like a big coffee machine in a café, perhaps.

Small but powerful

What you need is a SwitchBot Relay 1PM switch. This is a palm-sized Bluetooth- and Wi-Fi-controlled switch that you can use to automate switches and lights, and make your dumb home appliances a lot smarter. Don’t let its tiny size — it measures 1.6 x 1.4 x 0.6 inches and weighs just 0.9 oz — fool you. There’s a lot of cool stuff packed into this package.

Also: Your old iPad or Android tablet can be your new smart home panel – here’s how

Here, you have a package that can take AC inputs from 100 V to 240 V at both 50 and 60 Hz (so, essentially, it’s compatible worldwide) up to 16 A. On top of this, it can handle DC power ranging from 24 V to 30 V, making it a good choice for low-power solutions.

Good tech specs on this SwitchBot switch.

Good tech specs on this SwitchBot switch.

Adrian Kingsley-Hughes/ZDNET

Since no one wants to press buttons and flick switches anymore, this will integrate with several automation solutions, from Alexa, Siri, and Hey Google to IFTTT and SmartThings. It’ll also work with Matter. If you’ve got a smart home, this SwitchBot Relay will fit right in!

Already got a smart home ecosystem? The SwitchBot Relay will no doubt fit in!

Already got a smart home ecosystem? The SwitchBot Relay will no doubt fit in!

Adrian Kingsley-Hughes/ZDNET

The unit comes with pretty good instructions on how to fit it, but if you’re in any doubt, consult an electrician, since you don’t want to electrocute yourself or those around you. The unit is designed to be housed in an enclosure, like behind the faceplate of a switch or socket — hence the small size — and shouldn’t be left in the open, since the screws on the unit are live at mains voltage and could deliver a nasty, and possibly fatal, shock. So this isn’t something that you should have dangling within reach of people, kids, or pets.

Also: 10 useful smart home gadgets that make life so much easier (and most are discounted)

Also, bear in mind that the unit is not water-resistant in any way, so it should be treated like any other plug, socket, or switch that you have connected at home.

Perfect for home automation

The SwitchBot app offers a whole host of features.

There’s the basic turning things on or off, as well as scheduling when things should be turned off and on. Beyond the basics, it can also customize what happens when the power is restored after a shutdown (do you want the switch on, off, or in whatever the last state was?), or you can have missed-touch prevention, a feature that asks you to confirm if you want the switch operated. 

This is a nice touch that prevents something important from being turned off (although I don’t recommend connecting anything super critical, like a life support machine, to this switch!).

Also: I automated my home’s most unexpected electronics – here are 5 ingenious results

There’s also an NFC feature that allows you to pair a SwitchBot tag with the relay and control it with the touch of a phone.

The SwitchBot app is well made and packed with features.

The SwitchBot app is well made and packed with features.

Adrian Kingsley-Hughes/ZDNET

Then there’s power monitoring, both in the form of a live reading and historical data. This is where you get to find out how much of a power hog your devices are. There’s nothing like seeing how much power something uses to make people change their ways. You can take a deep dive into usage and, if you’re like me, export the data so you can number-crunch it with your favorite spreadsheet app.

Wasting a lot of power

Which brings me back to the coffee machine, a La Spaziale S5, a beast of a machine that can pull some 4,500 W of power at full load. Over a working day, this can easily be 20 kWh of power.

Also: I tried Amazon’s best-selling smart switch to power my home, and they’re seriously useful

That’s a lot, but it’s working, and it’s being paid to work.

This La Spaziale S5 coffee machine works hard and uses a lot of power.

This La Spaziale S5 coffee machine works hard and uses a lot of power.

Adrian Kingsley-Hughes/ZDNET

But what about when it’s on standby? The owners had assumed that because it wasn’t having to do much, it wouldn’t draw much. I wasn’t so sure. I suspected that this was pulling a significant amount over the 16 or so hours that it was on but wasn’t working.

I happened to have a few SwitchBot Relay 1PM switches on hand, so I pulled the coffee machine away from the wall a few inches, squeezed my head and arms in enough to be able to wire the relay into the wiring, connected it to the Wi-Fi network, and left it for a few days (making sure no one turned it off for the test!).

Also: Your smart plug is seriously underutilized: 7 ways I’ve programmed mine to automate my home

Oooooh boyyyyyy, did this thing consume power. I number-crunched the data I’d collected over a few days, and it was horrific. The S5 was burning through a whopping 8 kWh during that downtime, some 0.5 kW every hour. That didn’t seem right to me, so I checked and retested it, and got the same figure. Electricity prices in the UK are dearer than in the US, and business tariffs are more so, so this equated to over $1,500 a year being wasted.

This number bothered me so much that I had to take a look at the coffee machine. These things aren’t my wheelhouse, but I was convinced that there was something wrong with it. 

And there was — there was a small water leak in the low-pressure side of the machine. Not big enough to leave a puddle (the machine is warm, so it evaporated fast), but it meant that the water tank was continuously being filled with cold water. This meant that the machine was always working. Fixing this dropped the standby power down to under 0.25 kW per hour during standby.

Also: Why Amazon’s Echo Hub became my favorite way to control my smart home

That’s a massive saving, even if the machine isn’t turned off!

ZDNET’s buying advice

Now, I’m not suggesting that most people have something that’s as power-heavy as this, but at only $15, it doesn’t take much savings for a SwitchBot Relay to pay for itself in a year or so. 

The truth is that you’re probably going to buy more than one switch, as well as a whole raft of other smart gadgets (after all, who doesn’t need at least one FingerBot?), so consider this your first purchase in what will be a slippery slope of home automation addiction.





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)







Source link