Beware of the App! On the Vulnerability Surface of Smart Devices through their Companion Apps

by   Davino Mauro Junior, et al.

Internet of Things (IoT) devices are becoming increasingly important. These devices are often resource-limited, hindering rigorous enforcement of security policies. Assessing the vulnerability of IoT devices is an important problem, but analyzing their firmware is difficult for a variety of reasons, including requiring the purchase of devices. This paper finds that analyzing companion apps to these devices for clues to security vulnerabilities can be an effective strategy. Compared to device hardware and firmware, these apps are easy to download and analyze. A key finding of this study is that the communication between an IoT device and its app is often not properly encrypted and authenticated and these issues enable the construction of exploits to remotely control the devices. To confirm the vulnerabilities found, we created exploits against five popular IoT devices from Amazon by using a combination of static and dynamic analyses. We also did a larger study, finding that analyzing 96 popular IoT devices only required analyzing 32 companion apps. Among the conservative findings, 50 not use proper encryption techniques to secure device to companion app communication. Finally, we discuss defense strategies that developers can adapt to address the lessons from our work.


Is this IoT Device Likely to be Secure? Risk Score Prediction for IoT Devices Using Gradient Boosting Machines

Security risk assessment and prediction are critical for organisations d...

Iota: A Framework for Analyzing System-Level Security of IoTs

Most IoT systems involve IoT devices, communication protocols, remote cl...

Snipuzz: Black-box Fuzzing of IoT Firmware via Message Snippet Inference

The proliferation of Internet of Things (IoT) devices has made people's ...

Securing IoT Apps with Fine-grained Control of Information Flows

Internet of Things is growing rapidly, with many connected devices now a...

Community-Based Security for the Internet of Things

With more and more devices becoming connectable to the internet, the num...

Topics of Concern: Identifying User Issues in Reviews of IoT Apps and Devices

Internet of Things (IoT) systems are bundles of networked sensors and ac...

PETIoT: PEnetration Testing the Internet of Things

Attackers may attempt exploiting Internet of Things (IoT) devices to ope...

Please sign up or login with your details

Forgot password? Click here to reset