4 2.2 Summary of Smart Hubs
Total Page:16
File Type:pdf, Size:1020Kb
CATEGORIZING THE SECURITY AND PRIVACY OF \INTERNET OF THINGS" DEVICES by Matthew A. Wynn APPROVED BY SUPERVISORY COMMITTEE: Alvaro Cardenas, Chair Murat Kantarcioglu Bhavani Thuraisingham Copyright c 2018 Matthew A. Wynn All rights reserved CATEGORIZING THE SECURITY AND PRIVACY OF \INTERNET OF THINGS" DEVICES by MATTHEW A. WYNN, BS THESIS Presented to the Faculty of The University of Texas at Dallas in Partial Fulfillment of the Requirements for the Degree of MASTERS OF SCIENCE IN COMPUTER SCIENCE THE UNIVERSITY OF TEXAS AT DALLAS May 2018 ACKNOWLEDGMENTS The author would like to thank Dr. Alvaro Cardenas and the members of the Cyber-Physical Systems lab for their guidance and insight. This material is based upon work supported in part by NSF under award number CNS 1553683. April 2018 iv CATEGORIZING THE SECURITY AND PRIVACY OF \INTERNET OF THINGS" DEVICES Matthew A. Wynn, MS The University of Texas at Dallas, 2018 Supervising Professor: Alvaro Cardenas, Chair Internet of Things (IoT) devices are becoming an important part of our daily lives. In this thesis, we analyze the security and privacy risks of IoT devices in Smart Homes Hubs, the intersection of our daily lives and the internet, as well as intimate devices, where the vulner- abilities can put the owners at risk of privacy breaches and even sexual assault. We discuss the role of these IoT devices, analyze their practices and vulnerabilities, and emphasize the importance of holding the security and privacy of these devices to a higher standard than other IoT tools. v TABLE OF CONTENTS ACKNOWLEDGMENTS . iv ABSTRACT . v LIST OF FIGURES . viii CHAPTER 1 INTRODUCTION . 1 CHAPTER 2 ANALYSIS OF SMART HOME HUBS . 2 2.1 Introduction . .3 2.1.1 Related Work . .4 2.2 Summary of Smart Hubs . .5 2.2.1 Google Home Mini . .5 2.2.2 Amazon Echo Dot . .6 2.2.3 Samsung SmartThings Smart Home Hub . .8 2.2.4 OZOM Box 3.0 . .8 2.3 Security Analysis . 10 2.3.1 Google Home Mini . 10 2.3.2 Amazon Echo Dot . 10 2.3.3 Samsung SmartThings . 11 2.3.4 OZOM Box 3.0 . 12 2.4 Conclusion . 15 CHAPTER 3 SEXUAL INTIMACY IN THE AGE OF SMART DEVICES . 17 3.1 Introduction . 17 3.2 The Changing Notions of Sexual Intimacy . 18 3.2.1 Liberty and Privacy . 19 3.2.2 Safety and Security . 20 3.2.3 Related Work . 21 3.3 Devices . 22 3.3.1 Vibease . 23 3.3.2 OhMiBod blueMotion . 24 3.3.3 We-Vibe . 26 vi 3.3.4 Kiiroo Pearl2 and Fleshlight Launch . 26 3.3.5 Lovense Nora and Max . 28 3.4 Security and Privacy Findings . 28 3.4.1 Vibease . 28 3.4.2 OhMiBod blueMotion . 33 3.4.3 We-Vibe . 37 3.4.4 Kiiroo Pearl2 and Fleshlight Launch . 41 3.4.5 Lovense Nora and Max . 42 3.5 Conclusions . 42 CHAPTER 4 CONCLUSION . 44 REFERENCES . 45 BIOGRAPHICAL SKETCH . 47 CURRICULUM VITAE vii LIST OF FIGURES 2.1 Google Home Mini . .6 2.2 Google Home History . .6 2.3 Google Assistant Settings . .7 2.4 Home Mini Settings . .7 2.5 SmartThings Routines . .9 2.6 Google Assistant traffic, the phrase \Hey Google, what's the weather?" was spoken just before the 60 second mark. 10 2.7 Alexa traffic, the phrase \Hey Alexa, what's the weather?" was spoken about the 50 second mark. 11 2.8 Traffic between the SmartThings Hub and Samsung Servers. A motion sensor set up to turn off a lightbulb is triggered at 23 seconds. The lightbulb is turned back on via an external integration at 30 seconds. 12 2.9 Firmware format . 13 3.1 Vibease App Store. Audiobooks can be used to control vibration patterns. 24 3.2 Using the Vibease with a trusted remote partner. 25 3.3 OhMiBod App. 27 3.4 The We-Vibe App. 27 3.5 Lovense Chat. 29 3.6 Lovense Pattern Store. 29 3.7 Notifications with a locked screen might pose privacy risks. 32 3.8 We were surprised to find that our default image profile in Vibease after linking to Facebook was the profile Image of our test Facebook account. 33 3.9 OhMiBod Attack. 37 3.10 Successful Impersonation. 37 3.11 Attempting to break SSL results in disabling of remote functionality . 39 viii CHAPTER 1 INTRODUCTION Home automation is becoming increasingly popular in today's society. Advances in Internet of Things technology has transformed this hobby into affordable systems for increasing home security, providing better responses to safety hazards such as fires, and increasing the quality of life of early adopters. 1 CHAPTER 2 ANALYSIS OF SMART HOME HUBS Authors { Matthew Wynn, Junia Valente, Luis Salazar, Alvaro Cardenas The Computer Science Department, EC 31 The University of Texas at Dallas 800 West Campbell Road Richardson, Texas 75080-3021 Key words: IoT, security, smart homes Corresponding author: Matthew Wynn 2 I was the primary researcher of these devices. I studied each of the devices, analyzed the network traffic and the update scripts, discovered the vulnerabilities in the OZOM device, and wrote a large majority of the paper. 2.1 Introduction Home automation is becoming increasingly popular in today's society. Advances in Internet of Things technology has transformed this hobby into affordable systems for increasing home security, providing better responses to safety hazards such as fires, and increasing the quality of life of early adopters. At the heart of home automation are \Smart Home Hubs". These hubs provide a cen- tralized place for users to connect various IoT devices, incorporate them into an automation system with integrations, and interact with these systems via external commands. Many of these Smart Home Hubs offload their data and processing to a cloud service, which handle integrations with external services. However, as more IoT devices are created and integrated with Smart Home systems, the security implications become more serious. We identify four different attack targets that come along with these \smart hubs". The first is the ability for a hacker to control connected devices such as smart locks, appliances, and a variety of sensors. Several Smart Homes are set up as security systems, where sensors (such as contact sensors, motion detectors, and cameras) generate an alert on a user's smartphone if they are triggered (e.g., if motion is detected when the user is at work). It would be trivial for an attacker, having successfully compromised a smart home hub, to limit the outgoing traffic and exclude alerts, disabling the user's security system and allowing them to enter the house undetected. Another potential security target can be the users' accounts linked to these devices. These devices usually connect to cloud-based services provided by Amazon or Google, for 3 example. Taking over these devices allow attackers to access information about the user's accounts. In these examples especially, if permissions are set up poorly, an attacker could access the target's payment information, search and purchase history, private conversations, and other personal data. Third, the attacker may be able to remotely gain access to the device, and then move laterally across an internal network. In 2017, a casino was hacked by way of an Internet- connected fishtank (Limited, 2017). Hackers were not able to directly access the casino's servers, which were behind a firewall. However, by exploiting vulnerabilities in the IoT sensors on the fishtank, they were able to get inside the firewall and extract data from the casino's servers. Similarly, a hacker could use a weakness in a Smart Home hub to get inside a user's home network and search for other internal devices to exploit. Finally, an attacker may be able to use information from the sensors and usage data associated with a Smart Home hub to monitor the user's activity. From this, they might determine the user's schedule, the devices they own, when they are on vacation, etc. Ther- mostat settings may reveal when the user is usually away, door or motion sensors could indicate where users are in the house, and light activity may show when the user is asleep. 2.1.1 Related Work In 2017, Jose and Malekian explain security issues in existing home-automation systems (Jose and Malekian, 2017). They attempt to define \normal" user behavior (i.e. proximity sensors near a front door will be triggered before the user attempts to unlock that door), detect anomalies that could indicate a malicious actor, and request additional verification when an attack is detected. Noah Apthorpe, Dillon Reisman, Nick Feamster published \Closing the Blinds: Four Strategies for Protecting Smart Home Privacy from Network Observers" (Apthorpe et al., 2017). They identify the threats smart home consumers face to network sniffers attempting 4 to determine users' private behaviour. They then propose four solutions: blocking traffic, concealing DNS, tunneling traffic, and shaping and injecting traffic. In this way, they are able to mask the side-channel privacy threats that are inherent to today's smart home technology. 2.2 Summary of Smart Hubs In this paper, we study 4 different Smart Hubs. The Amazon Echo Dot and the Google Home Mini are both \Smart Assistants". These devices act as microphones and speakers, listening for voice commands and performing actions. The Samsung SmartThings Hub and the OZOM Box 3.0, on the other hand, set up networks for linking smart sensors and devices, and controlling the interactions between them. 2.2.1 Google Home Mini The Google Home Mini is the smallest of the Google Home products. It is shaped like a pebble, 4 inches in diameter (see Fig.