Security Analysis of Emerging Smart Home Applications - Fernandes, Earlence; Jung, Jaeyeon; Prakash, Atul (37th IEEE Symposium on Security and Privacy, 2016)
Recently, several competing smart home programming frameworks that support third party app development have emerged. These frameworks provide tangible beneﬁts to users, but can also expose users to signiﬁcant security risks. This paper presents the ﬁrst in-depth empirical security analysis of one such emerging smart home programming platform. We analyzed Samsung-owned SmartThings, which has the largest number of apps among currently available smart home platforms, and supports a broad range of devices including motion sensors, ﬁre alarms, and door locks. SmartThings hosts the application runtime on a proprietary, closed-source cloud backend, making scrutiny challenging. We overcame the challenge with a static source code analysis of 499 SmartThings apps (called SmartApps) and 132 device handlers, and carefully crafted test cases that revealed many undocumented features of the platform. Our key ﬁndings are twofold. First, although SmartThings implements a privilege separation model, we discovered two intrinsic design ﬂaws that lead to signiﬁcant overprivilege in SmartApps. Our analysis reveals that over 55% of SmartApps in the store are overprivileged due to the capabilities being too coarse-grained. Moreover, once installed, a SmartApp is granted full access to a device even if it speciﬁes needing only limited access to the device. Second, the SmartThings event subsystem, which devices use to communicate asynchronously with SmartApps via events, does not sufﬁciently protect events that carry sensitive information such as lock codes. We exploited framework design ﬂaws to construct four proof-of-concept attacks that: (1) secretly planted door lock codes; (2) stole existing door lock codes; (3) disabled vacation mode of the home; and (4) induced a fake ﬁre alarm. We conclude the paper with security lessons for the design of emerging smart home programming frameworks.
Distinguished Practical Paper Award