Charting the Attack Surface of Trigger-Action IoT Platforms

Abstract

Internet of Things (IoT) deployments are becoming increasingly automated and vastly more complex. Facilitated by programming abstractions such as trigger-action rules, end-users can now easily create new functionalities by interconnecting their devices and other online services. However, when multiple rules are simultaneously enabled, complex system behaviors arise that are diicult to understand or diagnose. While history tells us that such conditions are ripe for exploitation, at present the security states of trigger-action IoT deployments are largely unknown.In this work, we conduct a comprehensive analysis of the interactions between trigger-action rules in order to identify their security risks. Using IFTTT as an exemplar platform, we irst enumerate the space of inter-rule vulnerabilities that exist within trigger-action platforms. To aid users in the identiication of these dangers, we go on to present iRuler, a system that performs Satisiability Modulo Theories (SMT) solving and model checking to discover inter-rule vulnerabilities within IoT deployments. iRuler operates over an abstracted information low model that represents the attack surface of an IoT deployment, but we discover in practice that such models are diicult to obtain given the closed nature of IoT platforms. To address this, we develop methods that assist in inferring triggeraction information lows based on Natural Language Processing. We develop a novel evaluative methodology for approximating plausible real-world IoT deployments based on the installation counts of 315,393 IFTTT applets, determining that 66% of the synthetic deployments in the IFTTT ecosystem exhibit the potential for interrule vulnerabilities. Combined, these eforts provide the insight into the real-world dangers of IoT deployment misconigurations. CCS CONCEPTS• Security and privacy → Formal methods and theory of security; Vulnerability scanners; Software security engineering; • Computing methodologies → Natural language processing; • Computer systems organization → Embedded and cyber-physical systems.

Comparing formal models of IoT app coordination analysis

“…To compare the two approaches, we used the Alloy Analyzer [20] to generate counterexamples for safety properties for seven types of possible interactions between co-located apps in a smart home IoT system. The definitions of these safety properties were adapted from prior work [2,11,13,31]. We translated each safety property into a pair of assertions-one for the state-based model and the other for the rule-based model.…”

“…The safety properties can then be defined to describe paths between those rules that violate properties describing the coordination between apps (cf. Wang, et al [31]).…”

“…In this assertion, the solver is looking for an instance where two rules send two conflicting commands to the same device from a shared system state (cf. the Action Conflict vulnerability described in Wang, et al [31]). The satisfies_rule predicate used on Lines 5-6 returns true if the shared state (sys.prev) satisfies the two rules r and r', respectively.…”

“…To determine whether rule-based properties are more scalable than the common state-based approach, we analyzed 325 randomly generated bundles of apps drawn from a corpus of 222 real-world IoT apps using both our state-based and rule-based models. We checked both systems for instances of seven general types of app coordination drawn from the literature [11,13,24], such as the Action Conflict and Action Loop inter-rule vulnerabilities described in Wang, et al [31] We tracked the time taken by the Alloy Analyzer to find up to a single counterexample for each assertion and compared the performance of each approach both as the number of apps and rules in the bundles increased.…”

AuthCTC: Defending Against Waveform Emulation Attack in Heterogeneous IoT Environments

“…In recent years, many security mechanisms (e.g. [16,27,35,39]) adopt machine learning methods to achieve anomaly detection. Aegis [35] observes different user activities and usage patterns and builds a contextual model to differentiate malicious and benign behavior.…”