A Study of Data Store-Based Home Automation
Total Page:16
File Type:pdf, Size:1020Kb
A Study of Data Store-based Home Automation Kaushal Kafle, Kevin Moran, Sunil Manandhar, Adwait Nadkarni, Denys Poshyvanyk William & Mary, Williamsburg, VA, USA {kkafle,kpmoran,smanandhar,nadkarni,denys}@cs.wm.edu ABSTRACT via the Internet, allowing the user to conveniently automate their Home automation platforms provide a new level of convenience by home. However, because many of these products are tied to the enabling consumers to automate various aspects of physical objects user’s security or privacy (e.g., door locks, cameras), it is important in their homes. While the convenience is beneficial, security flaws to understand the attack surface of such devices and platforms, in in the platforms or integrated third-party products can have serious order to build practical defenses without sacrificing utility. consequences for the integrity of a user’s physical environment. In As the market for smart home devices has continued to mature, this paper we perform a systematic security evaluation of two pop- a new software paradigm has emerged to facilitate smart home ular smart home platforms, Google’s Nest platform and Philips Hue, automation via the interactions between smart home devices and that implement home automation “routines” (i.e., trigger-action the apps that control them. These interactions may be expressed programs involving apps and devices) via manipulation of state as routines, which are sequences of app and device actions that variables in a centralized data store. Our semi-automated analysis are executed upon one or more triggers, i.e., an instance of the examines, among other things, platform access control enforcement, trigger-action paradigm in the smart home. Routines are becoming the rigor of non-system enforcement procedures, and the potential the foundational unit of home automation [8, 42, 50, 51], and as a for misuse of routines. This analysis results in ten key findings result, it is natural to characterize existing platforms based on how with serious security implications. For instance, we demonstrate routines are implemented. the potential for the misuse of smart home routines in the Nest If we categorize available platforms based on how routines are platform to perform a lateral privilege escalation, illustrate how facilitated, we observe two broad categories: (1) API-based Smart Nest’s product review system is ineffective at preventing multiple Home Managers such as Yeti [55], Yonomi [56], IFTTT [18], and stages of this attack that it examines, and demonstrate how emerg- Stringify [48] that allow users to chain together a diverse set of ing platforms may fail to provide even bare-minimum security by devices using third-party APIs exposed by device vendors, and allowing apps to arbitrarily add/remove other apps from the user’s (2) smart home platforms such as Google’s Works with Nest [34], smart home. Our findings draw attention to the unique security Samsung SmartThings [45], and Philips Hue [40] that leverage challenges of platforms that execute routines via centralized data centralized data stores to monitor and maintain the states of IoT stores, and highlight the importance of enforcing security by design devices. We term these platforms as Data Store-Based (DSB) Smart in emerging home automation platforms. Home Platforms. In DSB platforms, complex routines are executed via reads/writes to state variables in a central data store. KEYWORDS This paper is motivated by a key observation that while routines are supported via centralized data stores in all DSB platforms, there Smart Home, Routines, Privilege Escalation, Overprivilege are differences in the manner in which routines are created, ob- ACM Reference Format: served, and managed by the user. That is, SmartThings encourages Kaushal Kafle, Kevin Moran, Sunil Manandhar, Adwait Nadkarni, Denys users to take full control of creating and managing routines involv- Poshyvanyk. 2019. A Study of Data Store-based Home Automation. In ing third-party apps and devices via the SmartThings app. On the Proceedings of ACM Conference on Data and Application Security and Privacy (CODASPY 2019). ACM, New York, NY, USA, 12 pages. https://doi.org/10. contrary, in Nest, users do not have a centralized perspective of rou- 475/123_4 tines at all, and instead, manage routines using third-party apps/de- vices. This key difference may imply unique security challenges for 1 INTRODUCTION Nest. Similarly, being a much simpler platform within this category arXiv:1812.01597v1 [cs.CR] 4 Dec 2018 of DSB platforms, Hue represents another unique and interesting Internet-connected, embedded computing objects known as smart instance of the DSB platform paradigm. While prior work has ex- home products have become extremely popular with consumers. plored the security of routines enabled by a smart home manager The utility and practicality afforded by these devices has spurred (i.e., specifically, IFTTT recipes [49]), the permission enforcement tremendous market interest, with over 20 billion smart home prod- and application security in the SmartThings platform [12], and the ucts projected to be in use by 2020 [13]. The diversity of these side-effects of SmartThings SmartApps [4], there is a notable gap in products is staggering, ranging from small physical devices with current research. Namely, prior studies do not evaluate the potential embedded computers such as smart locks and light bulbs, to full for adversarial misuse of routines, which are the essence of DSB fledged appliances such as refrigerators and HVAC systems. Inthe platforms, and by extension, home automation. modern computing landscape, smart home devices are unique as they provide an often imperceptible bridge between the digital and Contributions: This paper performs a systematic security analysis physical worlds by connecting physical objects to digital services of some of the less studied, but widely popular, data store-based smart home platforms, i.e., Nest and Hue, helping to close the exist- CODASPY 2019, March 2019, Dallas, TX, USA ing gap in prior research. In particular, we evaluate (1) the access 2019. ACM ISBN 123-4567-24-567/08/06...$15.00 https://doi.org/10.475/123_4 control enforcement in the platforms themselves, (2) the robustness 1 CODASPY 2019, March 2019, Dallas, TX, USA K. Kafle, K.Moran, S. Manandhar, A. Nadkarni, and D. Poshyvanyk of other non-system enforcement (e.g., product reviews in Nest), Apps Central Data Store Devices (3) the use and more importantly the misuse of routines via ma- app Home State: h h H device 1 <latexit sha1_base64="WV1qnaSANbtCNX+IBzL2Se7oDvg=">AAAB+HicbVBNS8NAEJ3Ur1o/GvXoZbEInkpShHoseOmxgv2AJpTNdtMs3WzC7kaosb/EiwdFvPpTvPlv3LY5aOuDgcd7M8zMC1LOlHacb6u0tb2zu1ferxwcHh1X7ZPTnkoySWiXJDyRgwArypmgXc00p4NUUhwHnPaD6e3C7z9QqVgi7vUspX6MJ4KFjGBtpJFd9fIIPaEIeUygtjcf2TWn7iyBNolbkBoU6IzsL2+ckCymQhOOlRq6Tqr9HEvNCKfzipcpmmIyxRM6NFTgmCo/Xx4+R5dGGaMwkaaERkv190SOY6VmcWA6Y6wjte4txP+8YabDGz9nIs00FWS1KMw40glapIDGTFKi+cwQTCQztyISYYmJNllVTAju+subpNeou07dvbuutRpFHGU4hwu4Ahea0II2dKALBDJ4hld4sx6tF+vd+li1lqxi5gz+wPr8AVI2kig=</latexit> 1 1 { | 2 } nipulation of the data store by low-integrity devices, and finally, read device State: v v V write 1 <latexit sha1_base64="DjGWLBu1w5BvypumyTMtnN0GmGU=">AAACA3icbVBNS8NAEN3Ur1q/qt70slgETyUpgh4LXjxWsB/QhLDZTNqlm03Y3RRKLHjxr3jxoIhX/4Q3/43bNgdtfTDweG+GmXlBypnStv1tldbWNza3ytuVnd29/YPq4VFHJZmk0KYJT2QvIAo4E9DWTHPopRJIHHDoBqObmd8dg1QsEfd6koIXk4FgEaNEG8mvnrj5GD/gMXaZwB0/D2HMKPjO1J361Zpdt+fAq8QpSA0VaPnVLzdMaBaD0JQTpfqOnWovJ1IzymFacTMFKaEjMoC+oYLEoLx8/sMUnxslxFEiTQmN5+rviZzESk3iwHTGRA/VsjcT//P6mY6uvZyJNNMg6GJRlHGsEzwLBIdMAtV8YgihkplbMR0SSag2sVVMCM7yy6uk06g7dt25u6w1G0UcZXSKztAFctAVaqJb1EJtRNEjekav6M16sl6sd+tj0Vqyiplj9AfW5w8OZZcX</latexit> device1 app { | 2 } device2 (4) the security of applications that integrate into these platforms. 2 device State: v v V <latexit sha1_base64="sNHcOog0g+HqhvVGy+yi80iIxdw=">AAACA3icbVBNS8NAEN3Ur1q/qt70slgETyUpgh4LXjxWsB/QhLDZTNqlm03Y3RRKLHjxr3jxoIhX/4Q3/43bNgdtfTDweG+GmXlBypnStv1tldbWNza3ytuVnd29/YPq4VFHJZmk0KYJT2QvIAo4E9DWTHPopRJIHHDoBqObmd8dg1QsEfd6koIXk4FgEaNEG8mvnrj5GD/gMXaZwB0/D2HMKPiNqTv1qzW7bs+BV4lTkBoq0PKrX26Y0CwGoSknSvUdO9VeTqRmlMO04mYKUkJHZAB9QwWJQXn5/IcpPjdKiKNEmhIaz9XfEzmJlZrEgemMiR6qZW8m/uf1Mx1dezkTaaZB0MWiKONYJ3gWCA6ZBKr5xBBCJTO3YjokklBtYquYEJzll1dJp1F37Lpzd1lrNoo4yugUnaEL5KAr1ES3qIXaiKJH9Ixe0Zv1ZL1Y79bHorVkFTPH6A+szx8P7JcY</latexit> device write 2 2 read … To our knowledge, this paper is the first to analyze this relatively … … { | 2 } device State: v v V app <latexit sha1_base64="u4g7GsHBNOKYbbsu7rfP8UhE4Xw=">AAACA3icbVBNS8NAEN3Ur1q/qt70slgETyUpgh4LXjxWsB/QhLDZTNqlm03Y3RRKLHjxr3jxoIhX/4Q3/43bNgdtfTDweG+GmXlBypnStv1tldbWNza3ytuVnd29/YPq4VFHJZmk0KYJT2QvIAo4E9DWTHPopRJIHHDoBqObmd8dg1QsEfd6koIXk4FgEaNEG8mvnrj5GD/gMXaZwB0/D2HMKPhi6k79as2u23PgVeIUpIYKtPzqlxsmNItBaMqJUn3HTrWXE6kZ5TCtuJmClNARGUDfUEFiUF4+/2GKz40S4iiRpoTGc/X3RE5ipSZxYDpjoodq2ZuJ/3n9TEfXXs5EmmkQdLEoyjjWCZ4FgkMmgWo+MYRQycytmA6JJFSb2ComBGf55VXSadQdu+7cXdaajSKOMjpFZ+gCOegKNdEtaqE2ougRPaNX9GY9WS/Wu/WxaC1Zxcwx+gPr8wdrkJdU</latexit> device new class of smart home platforms, in particular the Nest and Hue n n { | 2 devicen } n platforms, and to provide a holistic analysis of routines, their use, Figure 1: The general architecture of home automation platforms and potential for their misuse in DSB platforms. Moreover, this that leverage centralized data stores. Note that H is the universe of paper is the first to analyze the accuracy of app-defined permission all home state variables, and Vdevice is the universe of all state prompts, which form one of the few sources