[Paper Review] Discovering and Understanding the Security Hazards in the Interactions between IoT Devices, Mobile Apps, and Clouds on Smart Home Platforms

Wei Zhou, Yan Jia+6 more|arXiv (Cornell University)|Nov 8, 2018

Advanced Malware Detection Techniques30 references71 citations

TL;DR

The paper analyzes security hazards arising from interactions among IoT devices, mobile apps, and clouds across five major cloud-based smart home platforms, using phantom devices to reveal unauthorized state transitions and attacks.

ABSTRACT

A smart home connects tens of home devices to the Internet, where an IoT cloud runs various home automation applications. While bringing unprecedented convenience and accessibility, it also introduces various security hazards to users. Prior research studied smart home security from several aspects. However, we found that the complexity of the interactions among the participating entities (i.e., devices, IoT clouds, and mobile apps) has not yet been systematically investigated. In this work, we conducted an in-depth analysis of five widely-used smart home platforms. Combining firmware analysis, network traffic interception, and blackbox testing, we reverse-engineered the details of the interactions among the participating entities. Based on the details, we inferred three legitimate state transition diagrams for the three entities, respectively. Using these state machines as a reference model, we identified a set of unexpected state transitions. To confirm and trigger the unexpected state transitions, we implemented a set of phantom devices to mimic a real device. By instructing the phantom devices to intervene in the normal entity-entity interactions, we have discovered several new vulnerabilities and a spectrum of attacks against real-world smart home platforms.

Motivation & Objective

• Characterize the security hazards arising from interactions among IoT devices, mobile apps, and IoT clouds on smart home platforms.
• Reverse-engineer interactions to infer legitimate state transition diagrams for devices, clouds, and mobile apps.
• Identify unexpected state transitions and authorization gaps to reveal new attack surfaces.
• Demonstrate practical attacks using phantom devices to validate discovered vulnerabilities.
• Provide disclosure and mitigation insights to platform providers.

Proposed method

• Combine firmware reverse-engineering, network traffic interception, and black-box testing to study interactions among the three entities.
• Use MITM and certificate-pinning circumvention to decrypt cloud-app and device-app communications.
• Perform static and dynamic analysis to extract legitimate state machines for the IoT cloud, device, and mobile app.
• Create phantom device programs to intervene in normal interactions and trigger unauthorized state transitions.
• Manipulate request parameters to test authorization checks and identify design flaws.
• Classify identity, legitimacy, and device ID information and assess feasibility of obtaining these items for attacks.

Experimental results

Research questions

• RQ1 What are the legitimate state transition diagrams governing IoT cloud, device, and mobile app interactions in smart home platforms?
• RQ2 Where do the interactions violate expected state combinations or authorization checks, enabling new vulnerabilities?
• RQ3 How can phantom devices be used to trigger and study unexpected transitions and attacks across platforms?
• RQ4 What new hazards emerge when considering the interplay of the three entities in real-world platforms?

Key findings

• Real-world platforms do not strictly enforce valid three-entity state transitions across IoT cloud, device, and mobile app.
• Entities can occupy unexpected state combinations, creating potential risk in practice.
• IoT clouds sometimes do not perform adequate authorization checks on interaction requests.
• Attacks can be constructed by combining multiple design flaws to enable new hazards.
• Phantom devices can remotely replace victims’ devices, take over devices, unbind users, impersonate devices, or trigger mass firmware requests, expanding the attack surface.
• The study demonstrates concrete vulnerabilities across five major platforms (Samsung SmartThings, TP-Link KASA, XiaoMi MIJIA, Ali Alink, JD Joylink) and emphasizes integrated insecurity analysis.