Program Analysis of Commodity IoT Applications for Security and Privacy

Abstract

Recent advances in Internet of Things (IoT) have enabled myriad domains such as smart homes, personal monitoring devices, and enhanced manufacturing. IoT is now pervasive-new applications are being used in nearly every conceivable environment, which leads to the adoption of device-based interaction and automation. However, IoT has also raised issues about the security and privacy of these digitally augmented spaces. Program analysis is crucial in identifying those issues, yet the application and scope of program analysis in IoT remains largely unexplored by the technical community. In this article, we study privacy and security issues in IoT that require program-analysis techniques with an emphasis on identified attacks against these systems and defenses implemented so far. Based on a study of five IoT programming platforms, we identify the key insights that result from research efforts in both the program analysis and security communities and relate the efficacy of program-analysis techniques to security and privacy issues. We conclude by studying recent IoT analysis systems and exploring their implementations. Through these explorations, we highlight key challenges and opportunities in calibrating for the environments in which IoT systems will be used. CCS Concepts: • Security and privacy → Software and application security; • Software and its engineering → Automated static analysis; Dynamic analysis;

IoTGuard: Dynamic Enforcement of Security and Safety Policy in Commodity IoT

“…When she leaves, it locks the front door, turns off the lights, and sets the thermostat to another specific value. The code instrumentor searches for entry points of the app and finds two entry points: the not-present event handler that turns off the switch, locks the door, and sets the temperature (lines [10][11][12], and the present event handler that turns on the switch, unlocks the door and sets the temperature (lines 13-18). For each action, the code instrumentor finds the predicate that guards the action and the numerical-valued attributes used in the action call.…”

“…For example, a rule turns on the light when the user receives an email, and similarly, another rule logs the user's presence to a spreadsheet file when the front door is unlocked. This inter-tangled environment expands the interactions among devices to online services [10], [47]; for example, an IoT app that subscribes to the switch "turn-on" event interacts with a trigger-action platform rule that "turns on" the switch when the user is tagged in a photo on Facebook.…”

Clockwork: Tracking Remote Timing Attacks

“…Although browser vendors have moved to eliminate fine-grained timers from JavaScript, researchers have uncovered other ways to measure time [53], [54]. Information flow in IoT apps An active area of research is dedicated to securing IoT apps [10], [27]. Surbatovich et al [58] present an empirical study of IFTTT apps and categorize the apps with respect to potential security and integrity violations.…”

A New Method With Swapping of Peers and Fogs to Protect User Privacy in IoT Applications

“…However the trust of the SP is not critical in the application of data security protection methods, if transmission occurs and nicknames for users are used. Accordingly, advanced methods based on the trust of the SP should have an inbuilt system to alert users to grant permission for their data to be accessed [32]. How to avoid dependence on the trust of the SP has been an open problem, which has recently been addressed in the Blind Approach [33] by way of using a pair of keys in addition to the third party, and in the Double Obfuscation Approach (DOA) [34].…”