On the Data Privacy, Security, and Risk Postures of IoT Mobile Companion Apps

Neupane, Shradha; Tazi, Faiza; Paudel, Upakar; Baez, Freddy Veloz; Adamjee, Merzia; Carli, Lorenzo De; Das, Sanchari; Ray, Indrakshi

doi:10.1007/978-3-031-10684-2_10

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2023

2024

Publication Types

Select...

Other3

Book1

Article1

Relationship

Self Cite0

Independent5

Authors

Journals

Cited by 6 publications

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

From Play to Profession: A Serious Game to Raise Awareness on Digital Forensics

Friedl,

Reittinger,

Pernul

2024

Data and Applications Security and Privacy XXXVIII

View full text Add to dashboard Cite

From Play to Profession: A Serious Game to Raise Awareness on Digital Forensics

Friedl,

Reittinger,

Pernul

2024

Data and Applications Security and Privacy XXXVIII

View full text Add to dashboard Cite

AoT - Attack on Things: A security analysis of IoT firmware updates

Ibrahim,

Continella,

Bianchi

2023

2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

IoT devices implement firmware update mechanisms to fix security issues and deploy new features. These mechanisms are often triggered and mediated by mobile companion apps running on the users' smartphones. While it is crucial to update devices, these mechanisms may cause critical security flaws if they are not implemented correctly. Given their relevance, in this paper, we perform a systematic security analysis of the firmware update mechanisms adopted by IoT devices via their companion apps. First, we define a threat model for IoT firmware updates, and we categorize the different potential security issues affecting them. Then, we analyze 23 popular IoT devices (and corresponding companion apps) to identify vulnerable devices and the SDKs that such devices use to implement the update functionality. Our analysis reveals that 6 popular SDKs present dangerous security flaws. Additionally, we fingerprint each vulnerable SDK and we leverage our fingerprints to perform a largescale analysis of companion apps from the Google Play Store. Our results show that 61 popular devices and 1,356 apps rely on vulnerable SDKs, thus, they potentially adopt an insecure firmware update mechanism.

show abstract