Packet-Level Signatures for Smart Home Devices
Packet-Level Signatures for Smart Home Devices Rahmadi Trimananda, Janus Varmarken, Athina Markopoulou, Brian Demsky University of California, Irvine frtrimana, jvarmark, athina, bdemskyg@uci.edu Abstract—Smart home devices are vulnerable to passive in- we observed that events on smart home devices typically result ference attacks based on network traffic, even in the presence of in communication between the device, the smartphone, and the encryption. In this paper, we present PINGPONG, a tool that can cloud servers that contains pairs of packets with predictable automatically extract packet-level signatures for device events lengths. A packet pair typically consists of a request packet (e.g., light bulb turning ON/OFF) from network traffic. We from a device/phone (“PING”), and a reply packet back to the evaluated PINGPONG on popular smart home devices ranging device/phone (“PONG”). In most cases, the packet lengths are from smart plugs and thermostats to cameras, voice-activated devices, and smart TVs. We were able to: (1) automatically extract distinct for different device types and events, thus, can be used previously unknown signatures that consist of simple sequences to infer the device and the specific type of event that occurred. of packet lengths and directions; (2) use those signatures to detect Building on this observation, we were able to identify new the devices or specific events with an average recall of more than packet-level signatures (or signatures for short) that consist 97%; (3) show that the signatures are unique among hundreds only of the lengths and directions of a few packets in the of millions of packets of real world network traffic; (4) show that smart home device traffic.
[Show full text]