Recently, several competing smart home programming frameworks that support third party app development have emerged. These frameworks provide tangible benefits to users, but can also expose users to significant security risks. This paper presents the first in-depth empirical security analysis of one such emerging smart home programming platform. We analyzed Samsung-owned SmartThings, which has the largest number of apps among currently available smart home platforms, and supports a broad range of devices including motion sensors, fire alarms, and door locks. SmartThings hosts the application runtime on a proprietary, closed-source cloud backend, making scrutiny challenging. We overcame the challenge with a static source code analysis of 499 SmartThings apps (called SmartApps) and 132 device handlers, and carefully crafted test cases that revealed many undocumented features of the platform. Our key findings are twofold. First, although SmartThings implements a privilege separation model, we discovered two intrinsic design flaws that lead to significant overprivilege in SmartApps. Our analysis reveals that over 55% of SmartApps in the store are overprivileged due to the capabilities being too coarse-grained. Moreover, once installed, a SmartApp is granted full access to a device even if it specifies needing only limited access to the device. Second, the SmartThings event subsystem, which devices use to communicate asynchronously with SmartApps via events, does not sufficiently protect events that carry sensitive information such as lock codes. We exploited framework design flaws to construct four proof-of-concept attacks that: (1) secretly planted door lock codes, (2) stole existing door lock codes, (3) disabled vacation mode of the home, and (4) induced a fake fire alarm. We conclude the paper with security lessons for the design of emerging smart home programming frameworks.
[1]
Yuan Tian,et al.
OAuth Demystified for Mobile Application Developers
,
2014,
CCS.
[2]
Helen J. Wang,et al.
User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems
,
2012,
2012 IEEE Symposium on Security and Privacy.
[3]
Blase Ur,et al.
The Current State of Access Control for Smart Devices in Homes
,
2013
.
[4]
Steve Hanna,et al.
Android permissions demystified
,
2011,
CCS '11.
[5]
Laurie Hendren,et al.
Soot: a Java bytecode optimization framework
,
2010,
CASCON.
[6]
David A. Wagner,et al.
Android permissions: user attention, comprehension, and behavior
,
2012,
SOUPS.
[7]
Wenke Lee,et al.
CHEX: statically vetting Android apps for component hijacking vulnerabilities
,
2012,
CCS.
[8]
Tadayoshi Kohno,et al.
Securing Embedded User Interfaces: Android and Beyond
,
2013,
USENIX Security Symposium.
[9]
Tadayoshi Kohno,et al.
Computer security and the modern home
,
2013,
CACM.
[10]
David A. Wagner,et al.
Analyzing inter-application communication in Android
,
2011,
MobiSys '11.
[11]
David A. Wagner,et al.
How to Ask for Permission
,
2012,
HotSec.
[12]
Zhen Huang,et al.
PScout: analyzing the Android permission specification
,
2012,
CCS.
[13]
Shwetak N. Patel,et al.
Experimental Security Analyses of Non-Networked Compact Fluorescent Lamps: A Case Study of Home Automation Security
,
2013,
LASER.
[14]
Blase Ur,et al.
Practical trigger-action programming in the smart home
,
2014,
CHI.
[15]
David A. Wagner,et al.
I've got 99 problems, but vibration ain't one: a survey of smartphone users' concerns
,
2012,
SPSM '12.