Nav: Home

Design flaws create security vulnerabilities for 'smart home' internet-of-things devices

May 02, 2019

Researchers at North Carolina State University have identified design flaws in "smart home" Internet-of-Things (IoT) devices that allow third parties to prevent devices from sharing information. The flaws can be used to prevent security systems from signaling that there has been a break-in or uploading video of intruders.

"IoT devices are becoming increasingly common, and there's an expectation that they can contribute to our safety and security," says William Enck, co-author of a paper on the discovery and an associate professor of computer science at NC State. "But we've found that there are widespread flaws in the design of these devices that can prevent them from notifying homeowners about problems or performing other security functions."

"Essentially, the devices are designed with the assumption that wireless connectivity is secure and won't be disrupted - which isn't always the case," says Bradley Reaves, co-author of the paper and an assistant professor of computer science at NC State. "However, we have identified potential solutions that can address these vulnerabilities."

Specifically, the researchers have found that if third parties can hack a home's router - or already know the password - they can upload network layer suppression malware to the router. The malware allows devices to upload their "heartbeat" signals, signifying that they are online and functional - but it blocks signals related to security, such as when a motion sensor is activated. These suppression attacks can be done on-site or remotely.

"One reason these attacks are so problematic is that the system is telling homeowners that everything is OK, regardless of what's actually happening in the home," Enck says.

These network layer suppression attacks are possible because, for many IoT devices, it's easy to distinguish heartbeat signals from other signals. And addressing that design feature may point the way toward a solution.

"One potential fix would be to make heartbeat signals indistinguishable from other signals, so malware couldn't selectively allow heartbeat signals to pass through," says TJ O'Connor, first author of the paper and a Ph.D. student at NC State.

"Another approach would be to include more information in the heartbeat signal," O'Connor says. "For example, if a device sends three motion-sensor alerts, the subsequent heartbeat signal would include data noting that three sensor alerts had been sent. Even if the network layer suppression malware blocked the sensor alert signals, the system would see the heartbeat signal and know that three sensor alerts were sent but not received. This could then trigger a system warning for homeowners."

"No system is going to be perfect, but given the widespread adoption of IoT devices, we think it's important to raise awareness of countermeasures that device designers can use to reduce their exposure to attacks," Enck says.
-end-
The paper, "Blinded and Confused: Uncovering Systemic Flaws in Device Telemetry for Smart-Home Internet of Things," will be presented at the 12th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec '19), being held May 15-17 in Miami, Fla.

Note to Editors: The study abstract follows.

"Blinded and Confused: Uncovering Systemic Flaws in Device Telemetry for Smart-Home Internet of Things"

Authors: TJ O'Connor, William Enck and Bradley Reaves, North Carolina State University

Presented: WiSec '19, May 15-17, Miami, Florida

Abstract: The always-on, always-connected nature of smart home devices complicates Internet-of-Things (IoT) security and privacy. Unlike traditional hosts, IoT devices constantly send sensor, state, and heartbeat data to cloud-based servers. These data channels require reliable, routine communication, which is often at odds with an IoT device's storage and power constraints. Although recent efforts such as pervasive encryption have addressed protecting data in-transit, there remains little insight into designing mechanisms for protecting integrity and availability for always-connected devices. This paper seeks to better understand smart home device security by studying the vendor design decisions surrounding IoT telemetry messaging protocols, specifically, the behaviors taken when an IoT device loses connectivity. To understand this, we hypothesize and evaluate sensor blinding and state confusion attacks, measuring their effectiveness against an array of smart home IoT device types. Our analysis uncovers pervasive failure in designing telemetry that reports data to the cloud, and buffering that fails to properly cache undelivered data. We uncover that 22 of 24 studied devices suffer from critical design flaws that (1) enable attacks to transparently disrupt the reporting of device status alerts or (2) prevent the uploading of content integral to the device's core functionality. We conclude by considering the implications of these findings and offer directions for future defense. While the state of the art is rife with implementation flaws, there are several countermeasures IoT vendors could take to reduce their exposure to attacks of this nature.

North Carolina State University

Related Malware Articles:

Network traffic provides early indication of malware infection
By analyzing network traffic going to suspicious domains, security administrators could detect malware infections weeks or even months before they're able to capture a sample of the invading malware, a new study suggests.
Combination of features produces new Android vulnerability
A new vulnerability affecting Android mobile devices results not from a traditional bug, but from the malicious combination of two legitimate permissions that power desirable and commonly used features in popular apps.
Weaponizing the internet for terrorism
Writing in the International Journal of Collaborative Intelligence, researchers from Nigeria suggest that botnets and cyber attacks could interfere with infrastructure, healthcare, transportation, and power supply to as devastating an effect as the detonation of explosives of the firing of guns.
Android apps can conspire to mine information from your smartphone
'What this study shows undeniably with real-world evidence over and over again is that app behavior, whether it is intentional or not, can pose a security breach depending on the kinds of apps you have on your phone,' said researcher Gang Wang.
Desktop scanners can be hijacked to perpetrate cyberattacks
The researchers conducted several demonstrations to transmit a message into computers connected to a flatbed scanner.
More Malware News and Malware Current Events

Best Science Podcasts 2019

We have hand picked the best science podcasts for 2019. Sit back and enjoy new science podcasts updated daily from your favorite science news services and scientists.
Now Playing: TED Radio Hour

Anthropomorphic
Do animals grieve? Do they have language or consciousness? For a long time, scientists resisted the urge to look for human qualities in animals. This hour, TED speakers explore how that is changing. Guests include biological anthropologist Barbara King, dolphin researcher Denise Herzing, primatologist Frans de Waal, and ecologist Carl Safina.
Now Playing: Science for the People

#534 Bacteria are Coming for Your OJ
What makes breakfast, breakfast? Well, according to every movie and TV show we've ever seen, a big glass of orange juice is basically required. But our morning grapefruit might be in danger. Why? Citrus greening, a bacteria carried by a bug, has infected 90% of the citrus groves in Florida. It's coming for your OJ. We'll talk with University of Maryland plant virologist Anne Simon about ways to stop the citrus killer, and with science writer and journalist Maryn McKenna about why throwing antibiotics at the problem is probably not the solution. Related links: A Review of the Citrus Greening...