H S : Behavior Transparency and Control for Smart Home Iot Devices

HS: Behavior Transparency and Control for Smart Home IoT Devices TJ OConnor Reham Mohamed Markus Miettinen North Carolina State University Technische Universität Darmstadt Technische Universität Darmstadt [email protected] [email protected] [email protected] William Enck Bradley Reaves Ahmad-Reza Sadeghi North Carolina State University North Carolina State University Technische Universität Darmstadt [email protected] [email protected] [email protected] ABSTRACT 1 INTRODUCTION The widespread adoption of smart home IoT devices has led to a The pervasiveness of the Internet-Of-Things (IoT) devices is esti- broad and heterogeneous market with awed security designs and mated to reach 50 billion by 2020 [31]. A substantial population privacy concerns. While the quality of IoT device software is un- of these IoT devices is emerging in the residential environment. likely to be xed soon, there is great potential for a network-based These smart home devices oer convenience by monitoring wire- solution that helps protect and inform consumers. Unfortunately, less sensors such as temperature, carbon monoxide, and security the encrypted and proprietary protocols used by devices limit the cameras. Further, these devices enable automating actions including value of traditional network-based monitoring techniques. In this sounding alarms, making coee, or controlling lighting. As the func- paper, we present HS, a building block for enhancing tionality of these devices mature, they are increasingly interacting smart home transparency and control by classifying IoT device com- autonomously, invisible to the end-user. Turning oa connected munication by semantic behavior (e.g., heartbeat, rmware check, alarm can signal a coee pot to begin brewing and a motion-sensor motion detection). HS ignores payload content (which is can automate turning on a light. However, risk is introduced with often encrypted) and instead identies behaviors using features of each newly connected device due to their often-insecure software. connection-oriented application data unit exchanges, which rep- The smart home market is incredibly broad and heterogeneous, resent application-layer dialog between clients and servers. We lacking sucient standards and protocols to enforce security and evaluate HS against an independent labeled corpus of privacy. Yet, these same devices generate, process, and exchange IoT device network ows and correctly detect over 99% of behav- vast amounts of privacy-sensitive and safety-critical information iors. We further deployed HS in a home environment in our homes [30]. Manufacturers can surreptitiously gather data and empirically evaluated its ability to correctly classify known from the end user in violation of their expressed policy desires. behaviors as well as discover new behaviors. Through these eorts, As an example, Germany banned the wireless Cayla doll, which we demonstrate the utility of network-level services to classify contained a microphone and uploaded recorded conversations with behaviors of and enforce control on smart home devices. children [19, 20]. Further, an attacker may use a smart home IoT device to gain unauthorized access to other devices in the home. CCS CONCEPTS The Central Intelligence Agency’s W A implant on connected Samsung Televisions targeted home WiFi networks, accessed • Security and privacy → Access control; • Networks → Pro- user-names and passwords, and covertly recorded audio [12]. grammable networks; • Computing methodologies → Bag- Smart home security is an emerging topic without a clearly ging. dened threat model. A compromised or misbehaving smart home ACM Reference Format: device may attack other network hosts, but it may also eavesdrop TJ OConnor, Reham Mohamed, Markus Miettinen, William Enck, Bradley on the physical home environment. It is often not necessary to stop Reaves, and Ahmad-Reza Sadeghi. 2019. HS: Behavior Trans- the rst, or even second, instance of covert audio recording. Rather, parency and Control for Smart Home IoT Devices. In 12th ACM Confer- it is important to identify misbehaving devices and take some action ence on Security and Privacy in Wireless and Mobile Networks (WiSec ’19), (e.g., access control, or simply turning othe device). For example, May 15–17, 2019, Miami, FL, USA. ACM, New York, NY, USA, 12 pages. in the case of the Cayla doll, there is limited harm in eavesdropping https://doi.org/10.1145/3317549.3323409 on a few of a child’s conversations, but risk increases the longer the eavesdropping occurs. Similarly, when a device suddenly changes Permission to make digital or hard copies of all or part of this work for personal or its behavior, as in the case of W A recording audio, the classroom use is granted without fee provided that copies are not made or distributed owner’s goal is to prevent prolonged exposure. for prot or commercial advantage and that copies bear this notice and the full citation on the rst page. Copyrights for components of this work owned by others than ACM The software on IoT devices is unlikely to improve signicantly must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, in the near future. Therefore, consumers would greatly benet from to post on servers or to redistribute to lists, requires prior specic permission and/or a a network-based solution. However, contemporary tools provide fee. Request permissions from [email protected]. WiSec ’19, May 15–17, 2019, Miami, FL, USA limited help in interpreting communications exchanges taking place © 2019 Association for Computing Machinery. in the smart home network, as they require in-depth understanding ACM ISBN 978-1-4503-6726-4/19/05...$15.00 https://doi.org/10.1145/3317549.3323409 WiSec ’19, May 15–17, 2019, Miami, FL, USA OConnor and Mohamed, et al. about network protocols and the specic network set-up. Meaning- not being exploited, they may present privacy threats due to unex- ful monitoring and access control are challenging for experts, let pected behavior implemented by device manufacturers. Providing alone for regular smart home users. The task is further complicated transparency into device behavior is challenging, as smart home by the fact that IoT devices often use encryption, meaning solutions devices frequently use proprietary application-layer protocols. Fi- cannot rely on the contents of network trac. nally, eorts to secure smart home devices (e.g., HTTPS encryption) In this paper, we present HS as a building block for further complicate network layer access controls. improving the transparency and control over the network communi- Motivating Example (Alexa API Abuse): Checkmarx security cations of smart home devices. The key insight of HS is to researchers recently identied a method for abusing the implicit classify and control semantic behaviors using features that represent policies of the Amazon Alexa digital assistant [21]. In order to application-layer dialogue between clients and servers. We imple- covertly record audio from Alexa enabled devices, the researchers ment HS on a commodity wireless router and build upon created a voice activated application, known as an Alexa skill. The Software Dened Networking (SDN) primitives to control network application posed as a simple application for solving math problems trac based on end-user preferences. By operating on application but instead recorded audio indenitely. The researchers abused the behaviors, rather than IP addresses and packet ows, HS API by proving a null value to a prompt, silencing the device and facilitates enhanced user agents to provide transparency and con- deceiving the user into believing it is no longer listening. This abuse trol over smart home devices. We evaluate HS in two of trust motivates our work and presents a challenging problem ways. First, we evaluate its classication accuracy using a dataset for defense. In terms of the smart home IoT device, it must assume of labeled packet traces from the YourThings [3] project. For this the server-side platform is trusted after mutual authentication and dataset, our analysis demonstrates that HS achieves an execute commands. HS addresses this by pushing the accuracy of 99.69% in classifying behaviors. Second, we deployed monitoring and policy enforcement into the network using SDN HS in a real home environment with 20 devices and eval- and a machine learning classication of application behaviors. uated its ability to correctly classify known behaviors, as well as Problem Statement: The goal of HS is to provide the to help discover new behaviors. Such capabilities demonstrate the primitives for transparency and control of behaviors of otherwise re- practical utility and importance of providing end-users with greater source constrained smart home IoT devices. To achieve this, H transparency and control of smart home devices. S seeks to operate on application behaviors such as heartbeat, We make the following contributions in this paper. rmware check, reporting, and uploading audio or video recordings. We present the HS framework for identifying dis- • Abstracting network ows and packet data into classications oers tinct semantic behaviors by smart home devices. HS better intuition about the device activity. Thus, HS seeks provides a building block for transparency and control of to enable transparency by reporting which device performs what smart home IoT device network communications by report- behaviors, when and how often, rather than the simple existence ing activity

Load more