The Internet of Things
Total Page:16
File Type:pdf, Size:1020Kb
INF529: Security and Privacy In Informatics The Internet of Things Prof. Clifford Neuman Lecture 12 10 April 2020 Online via Webex Course Outline • What data is out there and how is it used • Technical means of protection • Identification, Authentication, Audit • The right of or expectation of privacy • Social Networks and the social contract – February 21st • Criminal law, National Security, and Privacy – March 6th • Big data – Privacy Considerations – March 13th • International law, Jurisdiction, Privacy Regulations • Privacy Regulation (civil) and also Healthcare – April 3rd • The Internet of Things – April 10th • Technology – April 17th • Other Topics – April 24th • The future – What can we do – may 1st April 17th Presentations Privacy Technologies • Jordan Smallwood – Privacy in Developed vs Undeveloped Countries • Neekita Salvankar - Geospacial Data and Privacy • Kriti Jain - Blockchain and Data Privacy • Dimple Gajra - Privacy in the Chrome Browser • Vraj Patel - privacy-focused browsing • Aakarsh Sharma - A Framework for Improving Data Privacy and Security of Public Cloud-based Enterprise Resource Planning Systems - Privacy in Cloud Computing April 24th Presentations Elections and Politics • Jon Melloy - Elections • Carlin Cherry - Security of Political data and its monetization May 1st Presentations Biometrics and related technologies • Vaidhyanathan S - Privacy Concerns for Biometrics • Yi-Ting Lin - Privacy of Facial Recognition • Haotian Mai - Access and use of DNA database by government agencies especially for criminal investigation. April 10th Presentations Internet of Things • Marco Gomez - Doorbells, Refrigerators, and Voice Video • Douglas Platt - Privacy of Digital Voice Assistants • Jaynee Shah – Consumer Wearables and Connected Vehicles • Fudha Alabdulrazaq -Amazon Alexa Privacy Concerns • MaryLiza Walker – IoT and Privacy: A Business Perspective • Khalid Mansory – Privacy Implications of Autonomous Vehicles … • Mohhamed Abatain – … and Aerial Drones Door Bells Voice Video Refrigerators Marco Gomez INF 529 Spring 10 Apr 2020 Sensors vs. Apps Sensors – A device which detects or measures a physical property and records, indicates, or otherwise responds to it. Apps – A type of software that does a certain task. Application Software is the type of software which runs as per user request. Sensors vs. Apps Class Discussion in D2L – Sensor Questions Midterm 2017 Each Doorbell is a sensor that collects/displays a live video and voice stream and transmit voice to its speaker if equipped. The app processes the collection. Each Refrigerator is a sensor that will collect voice and/or video. It’ll collect data from connected devices such as doorbell, lighting, smart plugs, etc. Its app will process that collection. Common Mistakes Made by Common Users Users’ Lack of Knowledge in Cybersecurity – -Use of IoT devices require a secure connection. Common users do not know how create the secure connection let alone create individual VLANs on their system. -Use of the quick start guide being anxious to connect their new device --> at a minimum change the password provided in literature (defaults). -Use of cloud storage --> Users could choose local storage. -Use of encryption for the phone app to access devices. -Failed activation of encryption on the IoT device. -Use of 2 factor authentication --> Luckily more OEMs are offering users this feature. However, Ring has “enabled” 2 Factor, still the user has to choose to use it. -Use of a VPN to access home network from users phone. Door Bells Sensors – Video, Voice, Photo Capture Apps – Eufy Security, Arlo, Ring Always Home, Nest Aware to link to a phone Data Collected – -Subscription information; Payment account information, device type, network connections, visiting family members and friends, location Privacy – -Ring has a Neighbors App. It allows sharing of your video to who you choose. -Can be requested by law enforcement. Will they use facial recognition? -With the exception of Eufy, all require use of subscription based cloud storage/access. -128 and 256 encryption is available. -Some record 24/7 some begin recording upon sensor capture. Refrigerators Sensors – Camera, Voice and Video, Microphone Apps – Family Hub and ThinQ. Both with apps for calendar, food planning and shopping, music and TV access, photo album. Smart Things app on Samsung phones. Bixby Samsung Assistant. Adjacent Connections – Smart Things Network; light bulbs, robot vacuums, alarms, Alexa, Google Voice Assistant, Door Bells, security cameras, TVs, indoor family cameras Data Collected – -User account information, App account information, device type, network connections and connected devices, location, calendar/events, order history Privacy – -Microphone and Camera remote activation. -Contacts are linked. -Photos are linked and saved. -Misuse by children. Privacy Concerns -If unauthorized access is gained to any IoT because of lack of security, access can be gained to personal computers on the network exposing all personal data. -Linking the door bell with your fridge. > If the fridge is hacked the calendar is lost and your vacation can be available to the hacker. > Access to photos, videos and worse the camera. > Access to security systems if there is one. -The refrigerators are always listening. >Advertisements will be presented. >Accidental activation; children may activate without knowledge. -Privacy policies for each of these companies are the same as every major companies. Extensive, hard to truly know how your data is used and exactly what is collected. Giving blind consent for them to use -Once Ring video or photos are shared with neighbors it can be shared by them with others that may not have your permission. -Each vendor has a Third Party agreement within their User Agreement allowing some information to be shared with them. References Desire 2 Learn – INF 529 Class Discussion: Sensor Questions - Midterm 2017 https://www.fingent.com/blog/iot-implementation-common-mistakes-and-strategies-to-tackle-them https://ktar.com/story/2898083/heres-how-to-create-a-separate-network-for-smart-home-devices/ https://us.norton.com/internetsecurity-iot-smart-home-security-core.html https://www.eufylife.com/products/variant/video-doorbell/T82001J1 https://www.eufylife.com/security-app-download https://www.eufylife.com/privacy-policy https://www.arlo.com/en-us/support/products/arlovideodoorbell.aspx https://www.arlo.com/en-us/about/privacy-policy/ https://shop.ring.com/pages/doorbell-cameras https://store.ring.com/neighbors https://shop.ring.com/pages/privacy https://store.google.com/us/product/nest_hello_doorbell https://policies.google.com/privacy https://store.google.com/magazine/google_nest_privacy References https://www.samsung.com/us/explore/family-hub-refrigerator/overview/ https://www.samsung.com/us/home-appliances/refrigerators/ https://www.samsung.com/global/galaxy/apps/bixby/ https://www.samsung.com/us/smart-home/ https://www.samsung.com/us/explore/family-hub-refrigerator/apps/ https://www.samsung.com/us/account/privacy-policy/ https://www.lg.com/us/discover/thinq/refrigerators https://www.lg.com/us/lg-thinq https://www.lg.com/global/lg-thinq https://www.lg.com/us/lg-thinq/app https://www.lg.com/us/discover/thinq https://www.lg.com/us/support/smart-thinq-google-assistant-voice-control https://www.lg.com/us/support/smart-thinq-alexa-voice-control https://play.google.com/store/apps/details?id=com.lgeha.nuts&hl=en_US https://www.lg.com/us/privacy Privacy of Digital Voice Assistants Doug Platt INF 529 Overview • Introduction to Digital Assistants • Privacy Policies • Common Concerns • Privacy Rating Comparison • Tradeoffs Between Provided Services and Privacy • Precautions That Can Be Taken • Example of Google Data Export Digital Assistants What are Digital Assistants, and how do they work? 1. Passive/Active Listening 2. Voice Recognition 3. Natural Language Processing 4. Information Retrieval 5. Information Output 6. Continuous Improvement [1 ] Privacy Policies Siri • What does it collect? • How is that data used? • When is it shared? Google Assistant • What does it collect? • How is that data used? • When is it shared? Amazon Alexa • What does it collect? • How is that data used? • When is it shared? Common Concerns Common Concerns • Are devices always listening? • Human review of recordings • What kind of impact do these have on children? • Malicious voice apps/skills • Account Security Privacy Comparisons Comparison of Products [2 ] Comparison of Products [2 ] [2 ] Tradeoffs Between Services and Privacy Tradeoffs • Improved Services • Targeted Ads • Growing prominence of Digital Assistants Precautions How Can You Protect Yourself? • Turn off the microphone • Adjust the Privacy Settings • Make sure devices are configured securely • Familiarize yourself with the privacy policy of your assistant • Unplug Google Data Export Conclusion References • [1] https://learn.g2.com/voice-assistant • [2] https://www.commonsense.org/education/articles/compare-the- privacy-practices-of-the-most-popular-smart-speakers-with-virtual- assistants • [3] https://policies.google.com/privacy • [4] https://support.apple.com/en-us/HT210657 • [5] https://www.apple.com/legal/privacy/en-ww/ • [6] https://www.amazon.com/gp/help/customer/display.html?nodeId=G VP69FUJ48X9DK8V • [7] https://www.amazon.com/gp/help/customer/display.html/ref=kinw_ myk_alxa_prvcy_ntce_us?nodeId=201909010 • [8] https://www.consumerwatchdog.org/privacy-technology/how- google-and-amazon-are-spying-you • [9] https://symantec-blogs.broadcom.com/blogs/threat-