SoK: Security Evaluation of Home-Based IoT Deployments

Alrawi, Omar; Lever, Chaz; Antonakakis, Manos; Monrose, Fabian

doi:10.1109/sp.2019.00013

Cited by 292 publications

(173 citation statements)

References 30 publications

Supporting

Mentioning

155

Contrasting

Order By: Relevance

“…Related work in this area has identified vulnerabilities that allow hackers to compromise Internet of Things (IoT) devices [13, 16-18, 21, 24, 38, 39]. A recent summary of security issues related to smart home IoT devices can be found in [3]. The research community is continuously working on identifying threats [13,16,19,31,38] and flaws in devices [17,21,27] and protocols [16,18,24,39].…”

Section: Related Workmentioning

confidence: 99%

Packet-Level Signatures for Smart Home Devices

Trimananda

Varmarken

Markopoulou

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

105

View full text Add to dashboard Cite

Smart home devices are vulnerable to passive inference attacks based on network traffic, even in the presence of encryption. In this paper, we present Ping-Pong, a tool that can automatically extract packetlevel signatures (i.e., simple sequences of packet lengths and directions) from the network traffic of smart home devices, and use those signatures to detect occurrences of specific device events (e.g., light bulb turning ON/OFF). We evaluated PingPong on popular smart home devices ranging from smart plugs to thermostats and home security systems. We have successfully: (1) extracted packet-level signatures from 18 devices (11 of which are the most popular smart home devices on Amazon) from 15 popular vendors, (2) used those signatures to detect occurrences of specific device events with an average recall of more than 97%, and (3) shown that the signatures are unique among tens of millions of packets of real world network traffic.

show abstract

Section: Related Workmentioning

confidence: 99%

Packet-Level Signatures for Smart Home Devices

Trimananda

Varmarken

Markopoulou

et al. 2020

Proceedings 2020 Network and Distributed System Security Symposium

105

View full text Add to dashboard Cite

show abstract

“…Security and safety risks in the IoT domain have been the subject of a large array of research studies. We refer to recent surveys for an overview of the area [2], [5], [13]. Here, we compare our contributions with closely related works on security and safety analysis of IoT apps, information-flow control, and formal models for IoT.…”

Section: Related Workmentioning

confidence: 99%

Securing Cross-App Interactions in IoT Platforms

Balliu

Merro

Pasqua

2019

2019 IEEE 32nd Computer Security Foundations Symposium (CSF)

View full text Add to dashboard Cite

IoT platforms enable users to connect various smart devices and online services via reactive apps running on the cloud. These apps, often developed by third-parties, perform simple computations on data triggered by external information sources and actuate the results of computation on external information sinks. Recent research shows that unintended or malicious interactions between the different (even benign) apps of a user can cause severe security and safety risks. These works leverage program analysis techniques to build tools for unveiling unexpected interference across apps for specific use cases. Despite these initial efforts, we are still lacking a semantic framework for understanding interactions between IoT apps. The question of what security policy cross-app interference embodies remains largely unexplored. This paper proposes a semantic framework capturing the essence of cross-app interactions in IoT platforms. The framework generalizes and connects syntactic enforcement mechanisms to bisimulation-based notions of security, thus providing a baseline for formulating soundness criteria of these enforcement mechanisms. Specifically, we present a calculus that models the behavioral semantics of a system of apps executing concurrently, and use it to define desirable semantic policies in the security and safety context of IoT apps. To demonstrate the usefulness of our framework, we define static mechanisms for enforcing crossapp security and safety, and prove them sound with respect to our semantic conditions. Finally, we leverage real-world apps to validate the practical benefits of our policy framework.

show abstract

“…Their system creates event fingerprints, matched across different IoT devices, for autonomous pairing purposes. Alrawi et al (2019) proposes a methodology to analyse security properties of IoT devices. The authors systematise the literature for smart home IoT devices to summarise key attack techniques, mitigation and stakeholders.…”

Section: Related Workmentioning

confidence: 99%

Cyber Security Threats and Challenges in Collaborative Mixed-Reality

Happa

Glencross²,

Steed

2019

Front. ICT

View full text Add to dashboard Cite

Collaborative Mixed-Reality (CMR) applications are gaining interest in a wide range of areas including games, social interaction, design and health-care. To date, the vast majority of published work has focused on display technology advancements, software, collaboration architectures and applications. However, the potential security concerns that affect collaborative platforms have received limited research attention. In this position paper, we investigate the challenges posed by cyber-security threats to CMR systems. We focus on how typical network architectures facilitating CMR and how their vulnerabilities can be exploited by attackers, and discuss the degree of potential social, monetary impacts, psychological and other harms that may result from such exploits. The main purpose of this paper is to provoke a discussion on CMR security concerns. We highlight insights from a cyber-security threat modelling perspective and also propose potential directions for research and development toward better mitigation strategies. We present a simple, systematic approach to understanding a CMR attack surface through an abstraction-based reasoning framework to identify potential attack vectors. Using this framework, security analysts, engineers, designers and users alike (stakeholders) can identify potential Indicators of Exposures (IoE) and Indicators of Compromise (IoC). Our framework allows stakeholders to reduce their CMR attack surface as well understand how Intrusion Detection System (IDS) approaches can be adopted for CMR systems. To demonstrate the validity to our framework, we illustrate several CMR attack surfaces through a set of use-cases. Finally, we also present a discussion on future directions this line of research should take.

show abstract

SoK: Security Evaluation of Home-Based IoT Deployments

Cited by 292 publications

References 30 publications

Packet-Level Signatures for Smart Home Devices

Packet-Level Signatures for Smart Home Devices

Securing Cross-App Interactions in IoT Platforms

Cyber Security Threats and Challenges in Collaborative Mixed-Reality

Contact Info

Product

Resources

About