Phantom Device Attack: Uncovering the Security Implications of the Interactions among Devices, IoT Cloud, and Mobile Apps

by   Wei Zhou, et al.

Smart home connects tens of home devices into the Internet, running a smart algorithm in the cloud that sends remote commands to the devices. While bringing unprecedented convenience, accessibility, and efficiency, it also introduces safety hazards to users. Prior research studied smart home security from various aspects. However, we found that the complexity of the interactions among the participating entities (device, IoT cloud, and mobile app) has not yet been systematically investigated. In this work, we conducted an in-depth analysis to four widely used smart home solutions. Combining firmware reverse-engineering, network traffic interception, and black-box testing, we distill the general state transitions representing the complex interactions among the three entities. Based on the state machine, we reveal several vulnerabilities that lead to unexpected state transitions. While these minor security flaws appear to be irrelevant, we show that combining them in a surprising way poses serious security or privacy hazards to smart home users. To this end, five concrete attacks are constructed and illustrated. We also discuss the implications of the disclosed attacks in the context of business competition. Finally, we propose some general design suggestions for building a more secure smart home solution.


page 1

page 2


Smart Home Survey on Security and Privacy

Smart homes are a special use-case of the Internet-of-Things (IoT) parad...

IoT Inspector: Crowdsourcing Labeled Network Traffic from Smart Home Devices at Scale

The proliferation of smart home devices has created new opportunities fo...

Characterizing Smart Home IoT Traffic in the Wild

As the smart home IoT ecosystem flourishes, it is imperative to gain a b...

Investigating the Security of EV Charging Mobile Applications As an Attack Surface

The adoption rate of EVs has witnessed a significant increase in recent ...

On the Principle of Accountability: Challenges for Smart Homes Cybersecurity

This chapter introduces the Accountability Principle and its role in dat...

From psychological traits to safety warnings: three studies on recommendations in a smart home environment

In this paper, we report on three experiments we have carried out in the...

Securing Smart Home Edge Devices against Compromised Cloud Servers

Smart home IoT systems often rely on cloud-based servers for communicati...

Please sign up or login with your details

Forgot password? Click here to reset