Security Analysis of Emerging Smart Home Applications

By Earlence Fernandes, Jaeyeon Jung, Atul Prakash. 2016

697 citations recorded by the source corpus.

Recently, several competing smart home programming frameworks that support third party app development have emerged. These frameworks provide tangible benefits to users, but can also expose users to significant security risks. This paper presents the first in-depth empirical security analysis of one such emerging smart home programming platform. We analyzed Samsung-owned SmartThings, which has the largest number of apps among currently available smart home platforms, and supports a broad range of devices including motion sensors, fire alarms, and door locks. SmartThings hosts the application runtime on a proprietary, closed-source cloud backend, making scrutiny challenging. We overcame the challenge with a static source code analysis of 499 SmartThings apps (called SmartApps) and 132 device handlers, and carefully crafted test cases that revealed many undocumented features of the platform. Our key findings are twofold. First, although SmartThings implements a privilege separation model, we discovered two intrinsic design flaws that lead to significant overprivilege in SmartApps. Our analysis reveals that over 55% of SmartApps in the store are overprivileged due to the capabilities being too coarse-grained. Moreover, once installed, a SmartApp is granted full access to a device even if it specifies needing only limited access to the device. Second, the SmartThings event subsystem, which devices use to communicate asynchronously with SmartApps via events, does not sufficiently protect events that carry sensitive information such as lock codes. We exploited framework design flaws to construct four proof-of-concept attacks that: (1) secretly planted door lock codes, (2) stole existing door lock codes, (3) disabled vacation mode of the home, and (4) induced a fake fire alarm. We conclude the paper with security lessons for the design of emerging smart home programming frameworks.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

A survey of data fusion in smart city applications (2019, background): “In addition, smart home security is yet another study ﬁeld for many researchers [150]–[152] due to increased usage of IoT devices in normal household.”
End User Security and Privacy Concerns with Smart Homes (2017, background): “, [26]) may be considering only a narrow use case.”
BlackIoT: IoT Botnet of High Wattage Devices Can Disrupt the Power Grid (2018, background): “In a comprehensive work [28], Fernandes et al.”
Smart Cities: A Survey on Data Management, Security, and Enabling Technologies (2017, background): “[321] have studied Samsung owned SmartThings programming framework and Samsung’s SmartApps market and claim that 55% of the smart applications in the store are over-privileged.”
FlowFence: Practical Data Protection for Emerging IoT Application Frameworks (2016, background): “Fernandes et al. recently demonstrated that such threats exist in real apps on an existing IoT platform [26] where they were able to steal and misuse door lock pincodes.”
SoK: Security Evaluation of Home-Based IoT Deployments (2019, background): “[27]– [29] showed how implicit trust to third-party applications can have major implications on the security of the device.”
Security and Privacy in the Internet of Things (2017, methodology): “However, the cloud-based solutions suffer two drawbacks: (1) Because private data is stored on the cloud which cannot be fully controlled by users, users may have concerns that data is abused by cloud providers or they cannot enforce sufficient security protection for their data [66]; (2) The dedica”
The Effect of IoT New Features on Security and Privacy: New Threats, Existing Solutions, and Challenges Yet to Be Solved (2018, background): “Thus, the overprivilege has become a common problem in the permission model of existing IoT platforms applications [20].”
Intelligent Buildings of the Future: Cyberaware, Deep Learning Powered, and Human Interacting (2016, background): “published in May 2016 two intrinsic design flaws in Samsung’s SmartThings: 55% of apps were overprivileged (given excessive access to a system), and there were insufficient sensitive information protections [56].”
Classifying IoT Devices in Smart Environments Using Network Traffic Characteristics (2019, background): “It is widely known that IoT devices are by their nature and design easy to inﬁltrate [7], [8], [9], [10], [11], [12].”
Understanding the Mirai Botnet (2017, background): “Researchers have found that IoT devices contain vulnerabilities from the firmware level [18, 19] up to the application level [26, 29, 73, 78].”
A Survey of IoT-Enabled Cyberattacks: Assessing Attack Paths to Critical Infrastructures and Services (2018, background): “Defects and misconﬁguration in software applications [14], faulty hardware chips [15] and easy to tamper with devices [16] are making the present situation even more dramatic.”
Edge Computing Security: State of the Art and Challenges (2019, background): “Note that some “so-called” cloud systems, such as SmartThings whose end units are IoT devices, usually delegate most of the services to local hubs that handle the IoT services at different regions; hence, they are not strictly cloud computing platforms [5]—such systems actually follow the edge compu”