Understanding IoT Security Through the Data Crystal Ball: Where We Are Now and Where We Are Going to Be Nan Zhang1, Soteris Demetriou2, Xianghang Mi1, Wenrui Diao3, Kan Yuan1, Peiyuan Zong4, Feng Qian1 XiaoFeng Wang1, Kai Chen4, Yuan Tian5, Carl A. Gunter2, Kehuan Zhang3, Patrick Tague5 and Yue-Hsun Lin6 1Indiana University, Bloomington {nz3, xmi, kanyuan, fengqian, xw7}@indiana.edu 2University of Illinois at Urbana-Champaign {sdemetr2, cgunter}@illinois.edu 3The Chinese University of Hong Kong {dw013, khzhang}@ie.cuhk.edu.hk 4Institute of Information Engineering, Chinese Academy of Sciences {zongpeiyuan, chenkai}@iie.ac.cn 5Carnegie Mellon University {yt, tague}@cmu.edu 6Samsung Research America
[email protected] Abstract—Inspired by the boom of the consumer IoT market, by the IoT ecosystem is privacy and security. While this many device manufacturers, new start-up companies and tech- domain shares some problems with conventional wireless nology behemoths have jumped into the space. Indeed, in a span sensor networks (WSN), it also has some unique traits. IoT of less than 5 years, we have experienced the manifestation of an array of solutions for the smart home, smart cities and even smart devices are user-centric, are Internet-connected and have more cars. Unfortunately, the exciting utility and rapid marketization complex software/hardware. As such, potential compromises of IoTs, come at the expense of privacy and security. Online and may cause serious harms (e.g., physical property damage [2], industry reports, and academic work have revealed a number of bodily injuries [3], traffic accidents [4]). In addition, remote attacks on IoT systems, resulting in privacy leakage, property loss adversaries become possible due to the connectivity of IoT and even large-scale availability problems on some of the most influential Internet services (e.g.