Security Analysis of Emerging Smart Home Applications

Proceedings - 2016 IEEE Symposium on Security and Privacy, SP 2016

Volumn , Issue , 2016, Pages 636-654

  Fernandes, Earlence ^a   Jung, Jaeyeon ^b   Prakash, Atul ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

^b MICROSOFT RESEARCH   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

AUTOMATION; CODES (SYMBOLS); FIRE ALARM SYSTEMS; INTELLIGENT BUILDINGS; SECURITY SYSTEMS;

COARSE-GRAINED; FRAMEWORK DESIGNS; PROGRAMMING FRAMEWORK; PROOF OF CONCEPT; SECURITY ANALYSIS; SENSITIVE INFORMATIONS; SEPARATION MODEL; STATIC SOURCES;

LOCKS (FASTENERS);

EID: 84987660714     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2016.44     Document Type: Conference Paper

References (32)

1. "Vera Smart Home Controller," http://getvera.com/controllers/vera3/, Accessed: Oct 2015
2. Allseen Alliance, "AllJoyn Data Exchange," https://allseenalliance.org/ framework/documentation/learn/core/system-description/data-exchange, Accessed: Nov 2015
3. Allseen Alliance, "AllJoyn Framework," https://allseenalliance.org/ framework, Accessed: Oct 2015
4. AllSeen Alliance, "AllJoyn Security 2.0 Feature: High-level Design," https://allseenalliance.org/framework/documentation/learn/ core/security2 0/hld, Accessed: Nov 2015
5. Apple, "App Security, iOS Security Guide," http://www.apple.com/ business/docs/iOS Security Guide.pdf, Accessed: Nov 2015
6. Apple, "HMAccessoryDelegate Protocol Reference," https: //developer.apple.com/library/ios/documentation/HomeKit/ Reference/HMAccessoryDelegate Protocol/index.html#// apple ref/occ/intfm/HMAccessoryDelegate/accessory:service: didUpdateValueForCharacteristic:, Accessed: Oct 2015
7. Apple, "HomeKit," http://www.apple.com/ios/homekit/, Accessed: Oct 2015
8. K. W. Y. Au, Y. F. Zhou, Z. Huang, and D. Lie, "Pscout: Analyzing the android permission specification," in Proceedings of the 2012 ACM Conference on Computer and Communications Security, ser. CCS '12. New York, NY, USA: ACM, 2012, pp. 217-228. [Online]. Available: http://doi.acm.org/10.1145/2382196.2382222
9. Behrang Fouladi and Sahand Ghanoun, "Honey, I'm Home!!, Hacking ZWave Home Automation Systems," Black Hat USA 2013
10. E. Y. Chen, Y. Pei, S. Chen, Y. Tian, R. Kotcher, and P. Tague, "Oauth demystified for mobile application developers," in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS '14. New York, NY, USA: ACM, 2014, pp. 892-903. [Online]. Available: http://doi.acm.org/10.1145/2660267.2660323
11. E. Chin, A. P. Felt, K. Greenwood, and D. Wagner, "Analyzing Inter-application Communication in Android," in Proceedings of the 9th International Conference on Mobile Systems, Applications, and Services, ser. MobiSys '11. New York, NY, USA: ACM, 2011, pp. 239-252. [Online]. Available: http://doi.acm.org/10.1145/1999995.2000018
12. T. Denning, T. Kohno, and H. M. Levy, "Computer security and the modern home," Commun. ACM, vol. 56, no. 1, pp. 94-103, Jan. 2013. [Online]. Available: http://doi.acm.org/10.1145/2398356.2398377
13. A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner, "Android permissions demystified," in Proceedings of the 18th ACM Conference on Computer and Communications Security, ser. CCS '11. New York, NY, USA: ACM, 2011, pp. 627-638. [Online]. Available: http://doi.acm.org/10.1145/2046707.2046779
14. A. P. Felt, S. Egelman, M. Finifter, D. Akhawe, and D. Wagner, "How to ask for permission," in Proceedings of the 7th USENIX Conference on Hot Topics in Security, ser. HotSec'12. Berkeley, CA, USA: USENIX Association, 2012, pp. 7-7. [Online]. Available: http://dl.acm.org/citation.cfm?id=2372387.2372394
15. A. P. Felt, S. Egelman, and D. Wagner, "I've got 99 problems, but vibration ain't one: A survey of smartphone users' concerns," in Proceedings of the Second ACM Workshop on Security and Privacy in Smartphones and Mobile Devices, ser. SPSM '12. New York, NY, USA: ACM, 2012, pp. 33-44. [Online]. Available: http://doi.acm.org/10.1145/2381934.2381943
16. A. P. Felt, E. Ha, S. Egelman, A. Haney, E. Chin, and D. Wagner, "Android permissions: User attention, comprehension, and behavior," in Proceedings of the Eighth Symposium on Usable Privacy and Security, ser. SOUPS '12. New York, NY, USA: ACM, 2012, pp. 3:1-3:14. [Online]. Available: http://doi.acm.org/10.1145/2335356.2335360
17. D. Fisher, "Pair of Bugs Open Honeywell Home Controllers Up to Easy Hacks," https://threatpost.com/ pair-of-bugs-open-honeywell-home-controllers-up-to-easy-hacks/ 113965/, Accessed: Oct 2015
18. Google, "Project Weave," https://developers.google.com/weave/, Accessed: Oct 2015
19. A. Hesseldahl, "A Hackers-Eye View of the Internet of Things," http: //recode.net/2015/04/07/a-hackers-eye-view-of-The-internet-of-things/, Accessed: Oct 2015
20. Kohsuke Kawaguchi, "Groovy Sandbox," http://groovy-sandbox. kohsuke.org/, Accessed: Oct 2015
21. N. Lomas, "Critical Flaw identified In ZigBee Smart Home Devices," http://techcrunch.com/2015/08/07/ critical-flaw-ided-in-zigbee-smart-home-devices/, Accessed: Oct 2015
22. L. Lu, Z. Li, Z. Wu, W. Lee, and G. Jiang, "CHEX: Statically vetting Android apps for component hijacking vulnerabilities," in Proceedings of the 2012 ACM Conference on Computer and Communications Security, ser. CCS '12. New York, NY, USA: ACM, 2012, pp. 229-240. [Online]. Available: http://doi.acm.org/10.1145/2382196.2382223
23. T. Oluwafemi, T. Kohno, S. Gupta, and S. Patel, "Experimental Security Analyses of Non-Networked Compact Fluorescent Lamps: A Case Study of Home Automation Security," in Proceedings of the LASER 2013 (LASER 2013). Arlington, VA: USENIX, 2013, pp. 13-24. [Online]. Available: https://www.usenix.org/laser2013/program/oluwafemi
24. F. Roesner and T. Kohno, "Securing embedded user interfaces: Android and beyond." in USENIX Security, 2013
25. F. Roesner, T. Kohno, A. Moshchuk, B. Parno, H. J. Wang, and C. Cowan, "User-driven access control: Rethinking permission granting in modern operating systems," in Proceedings of the 2012 IEEE Symposium on Security and Privacy, ser. SP '12. Washington, DC, USA: IEEE Computer Society, 2012, pp. 224-238. [Online]. Available: http://dx.doi.org/10.1109/SP.2012.24
26. Samsung, "SmartApp Location object," http://docs.smartthings.com/en/ latest/ref-docs/location-ref.html#location-ref, Accessed: Oct 2015
27. Samsung, "SmartThings," http://www.smartthings.com/, Accessed: Nov 2015
28. Samsung, "SmartThings OAuth Protocol Flow-Smart-Things Documentation," http://docs.smartthings.com/en/latest/ smartapp-web-services-developers-guide/tutorial-part2.html# appendix-just-The-urls-please, Accessed: Oct 2015
29. B. Ur, J. Jung, and S. Schechter, "The current state of access control for smart devices in homes," in Workshop on Home Usable Privacy and Security (HUPS). HUPS 2014, July 2013. [Online]. Available: http://research.microsoft.com/apps/pubs/default.aspx?id=204947
30. B. Ur, E. McManus, M. Pak Yong Ho, and M. L. Littman, "Practical trigger-action programming in the smart home," in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ser. CHI '14. New York, NY, USA: ACM, 2014, pp. 803-812. [Online]. Available: http://doi.acm.org/10.1145/2556288.2557420
31. R. Vallee-Rai, P. Co, E. Gagnon, L. Hendren, P. Lam, and V. Sundaresan, "Soot-A java bytecode optimization framework," in Proceedings of the 1999 Conference of the Centre for Advanced Studies on Collaborative Research, ser. CASCON '99. IBM Press, 1999, pp. 13-. [Online]. Available: http://dl.acm.org/citation.cfm?id=781995.782008
32. Veracode, "The Internet of Things: Security Research Study," https://www.veracode.com/sites/default/files/Resources/Whitepapers/ internet-of-things-whitepaper.pdf, Accessed: Oct 2015