Never Ending Story: Authentication and Access Control Design Flaws in Shared IoT Devices

Abstract

Internet-of-Things (IoT) devices implement weak authentication and access control schemes. The on-demand nature of IoT devices requires a responsive communications channel, which is often at odds with thorough authentication and access control. This paper seeks to better understand IoT device security by examining the design of authentication and access control schemes. In this work, we explore the challenge of propagating credential revocation and access control list modifications in a shared IoT ecosystem. We evaluate the vulnerability of 19 popular security cameras and doorbells against a straightforward user-interface bound adversary attack. Our results demonstrate that 16 of 19 surveyed devices suffer from flaws that enable unauthorized access after credential modification or revocation. We conclude by discussing these findings and propose a means for balancing authentication and access control schemes while still offering responsive communications channels.104 2020 Symposium on Security and Privacy Workshops (SPW)

‘I feel like we’re really behind the game’: perspectives of the United Kingdom’s intimate partner violence support sector on the rise of technology-facilitated abuse

“…More recently, scholars such as Leitão (2019), Slupska (2019), andJanes et al (2020) have added to this burgeoning, IoT-specific literature and helped to uncover why in-home privacy security threats deriving from smart systems require closer attention. For instance, in many cases the usability of smart devices is limited due to the restricted user interface that is available, and proposed security and privacy recommendations often conflict with each other when examined across the three different abuse phases (i.e., physical control, escape, life apart) (Alshehri et al, 2020;Matthews et al, 2017;.…”

“…For instance, in many cases the usability of smart devices is limited due to the restricted user interface that is available, and proposed security and privacy recommendations often conflict with each other when examined across the three different abuse phases (i.e., physical control, escape, life apart) (Alshehri et al, 2020;Matthews et al, 2017;. Besides, devices often suffer from flaws that enable unauthorised access, with such a deficiency of transparency endangering particularly vulnerable groups and communities (Janes et al, 2020). In addition, researchers exposed a lack of awareness on IoT-facilitated tech abuse across support services such as voluntary sector organisations like refuges and charities, and statutory service bodies such as law enforcement (Mayhew and Jahankhani, 2020;Tanczer et al, 2018b), which limits the support affected victims/survivors can expect.…”

Datta Burton, S; Tanczer, LM; Vasudevan, S; Hailes, S; Carr, M; (2021) The UK Code of Practice for Consumer IoT Cybersecurity: where we are and what next

“…The increasing drive to expand the connectivity of devices and provide centralised hubs such as smart speakers creates nodes that are "information goldmines" for perpetrators. In addition, research has shown that IoT manufacturers do not provide transparency and the necessary prompts to flag up to IoT device users the breadth of connections and access controls they have agreed to (Janes et al, 2020;Parkin et al, 2019). People may not remember with whom they have shared credentials, and they may have no easy way of checking this which can provide avenues for abusers to continue to spy on their family or ex-partner covertly and over an extended period of time.…”

“…Previous studies have indicated a range of interventions that device manufacturers can implement to improve the usability of IoT devices in ways that will benefit victims and survivors. These include suggestions mentioned above, plus more accessible and navigable user interfaces, improvements to the usability of privacy and security controls, enforced authentication requirements, and the ability to review historical queries and actions (Janes et al, 2020;Parkin et al, 2019;Leitão, 2019).…”

“…However, our understanding and awareness of tech abuse facilitated through IoT is still in its infancy. Internationally, only a handful of scholars and a selected number of support organisations have begun to explicitly address this topic (Slupska, 2019;Janes, Crawford, & OConnor, 2020;Mayhew & Jahankhani, 2020;Parkin et al, 2019;Leitão, 2019;Rodríguez-Rodríguez et al, 2020;Slupska & Tanczer, forthcoming).…”