Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic

By Noah J. Apthorpe, D. Reisman, S. Sundaresan, Arvind Narayanan, N. Feamster. 2017

259 citations recorded by the source corpus.

The growing market for smart home IoT devices promises new conveniences for consumers while presenting new challenges for preserving privacy within the home. Many smart home devices have always-on sensors that capture users' offline activities in their living spaces and transmit information about these activities on the Internet. In this paper, we demonstrate that an ISP or other network observer can infer privacy sensitive in-home activities by analyzing Internet traffic from smart homes containing commercially-available IoT devices even when the devices use encryption. We evaluate several strategies for mitigating the privacy risks associated with smart home device traffic, including blocking, tunneling, and rate-shaping. Our experiments show that traffic shaping can effectively and practically mitigate many privacy risks associated with smart home IoT devices. We find that 40KB/s extra bandwidth usage is enough to protect user activities from a passive network adversary. This bandwidth cost is well within the Internet speed limits and data caps for many smart homes.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Ethical Challenges in Data-Driven Dialogue Systems (2017, background): “While network-based attack vectors have been investigated in home-based personal assistant devices (Apthorpe et al. 2017), the language and dialogue models of these devices pose another attack vector, raising privacy concerns.”
Security of the Internet of Things: Vulnerabilities, Attacks, and Countermeasures (2019, background): “[157] clearly has shown that an Internet Service Provider (ISP) or a network sniffer can easily infer inside activities of the house habitants and revoke their”
Information Exposure From Consumer IoT Devices: A Multidimensional, Network-Informed Measurement Approach (2019, background): “Other related work tackles information exposure for different categories of IoT devices: home/office consumer devices [5, 27], medical devices [49], smart toys [10, 39, 47] as well as home automation solutions [26, 31].”
Blockchain and IoT Integration: A Systematic Survey (2018, background): “This is possible by just analyzing their meta-data and traffic patterns [124].”
Peek-a-boo: i see your smart home activities, even encrypted! (2018, background): “Moreover, some other works [3– 5, 14, 24, 34, 47] worked on the device activity (event) inference problem, where the phrases device activity inference and user activity inference sometimes have been used interchangeably.”