Let the Cat out of the Bag: Popular Android IoT Apps under Security Scrutiny

Abstract

The impact that IoT technologies have on our everyday life is indisputable. Wearables, smart appliances, lighting, security controls, and others make our life simpler and more comfortable. For the sake of easy monitoring and administration, such devices are typically accompanied by smartphone apps, which are becoming increasingly popular, and sometimes are even required to operate the device. Nevertheless, the use of such apps may indirectly magnify the attack surface of the IoT device itself and expose the end-user to security and privacy breaches. Therefore, a key question arises: do these apps curtail their functionality to the minimum needed, and additionally, are they secure against known vulnerabilities and flaws? In seek of concrete answers to the aforesaid question, this work scrutinizes more than forty chart-topping Android official apps belonging to six diverse mainstream categories of IoT devices. We attentively analyse each app statically, and almost half of them dynamically, after pairing them with real-life IoT devices. The results collected span several axes, namely sensitive permissions, misconfigurations, weaknesses, vulnerabilities, and other issues, including trackers, manifest data, shared software, and more. The short answer to the posed question is that the majority of such apps still remain susceptible to a range of security and privacy issues, which in turn, and at least to a significant degree, reflects the general proclivity in this ecosystem.

IoT-Based Android Malware Detection Using Graph Neural Network With Adversarial Defense

“…Chatzoglou et al in their work [37] examined more than forty IoT based Android official apps statically and dynamically and found that majority of the apps have a range of security and privacy issues. There were repeated incidents of malicious code injection into popular Android apps through advertising SDKs, as in the case of CamScanner in 2021 [?].…”

“…Section II is the overview of the work done, section III is the preliminary study, section IV is the proposed method, section V is evaluation, section VI is related works, and section VII is conclusion. Chatzoglou et al in their recent work [37] closely examined more than forty top Android official apps belonging to six Fig. 2.…”

The Convergence of Artificial Intelligence and Blockchain: The State of Play and the Road Ahead

“…The Internet of Things has revolutionized the way data are connected and transformed between physical and virtual entities. Traditional IoT systems, operating on centralized architectures, face challenges like single points of failure and concerns regarding the security, transparency, privacy, integrity, and confidentiality of data [47,127,128]. These challenges have the potential to hinder the future development and application of IoT technology.…”

AoT - Attack on Things: A security analysis of IoT firmware updates

“…Chatzoglou et al [17] use existing tools and frameworks to analyze the security of IoT companion apps. Their study finds existing CWEs, third-party trackers and some other known issues in the companion apps.…”