AoT - Attack on Things: A security analysis of IoT firmware updates

Muhammad Ibrahim; Andrea Continella; Antonio Bianchi

doi:10.1109/EuroSP57164.2023.00065

AoT - Attack on Things: A security analysis of IoT firmware updates

Muhammad Ibrahim^*, Andrea Continella, Antonio Bianchi

^*Corresponding author for this work

Semantics, Cybersecurity & Services

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

12 Citations (Scopus)

2131 Downloads (Pure)

Abstract

IoT devices implement firmware update mechanisms to fix security issues and deploy new features. These mechanisms are often triggered and mediated by mobile companion apps running on the users' smartphones. While it is crucial to update devices, these mechanisms may cause critical security flaws if they are not implemented correctly. Given their relevance, in this paper, we perform a systematic security analysis of the firmware update mechanisms adopted by IoT devices via their companion apps. First, we define a threat model for IoT firmware updates, and we categorize the different potential security issues affecting them. Then, we analyze 23 popular IoT devices (and corresponding companion apps) to identify vulnerable devices and the SDKs that such devices use to implement the update functionality. Our analysis reveals that 6 popular SDKs present dangerous security flaws. Additionally, we fingerprint each vulnerable SDK and we leverage our fingerprints to perform a large-scale analysis of companion apps from the Google Play Store. Our results show that 61 popular devices and 1,356 apps rely on vulnerable SDKs, thus, they potentially adopt an insecure firmware update mechanism.

Original language	English
Title of host publication	Proceedings - 8th IEEE European Symposium on Security and Privacy, Euro S and P 2023
Publisher	IEEE
Pages	1047-1064
Number of pages	18
ISBN (Electronic)	9781665465120
DOIs	https://doi.org/10.1109/EuroSP57164.2023.00065
Publication status	Published - 3 Jul 2023
Event	8th IEEE European Symposium on Security and Privacy - TU Delft Echo, Delft, Netherlands Duration: 3 Jul 2023 → 7 Jul 2023 Conference number: 8 https://eurosp2023.ieee-security.org/index.html

Conference

Conference	8th IEEE European Symposium on Security and Privacy
Abbreviated title	Euro S&P
Country/Territory	Netherlands
City	Delft
Period	3/07/23 → 7/07/23
Internet address	https://eurosp2023.ieee-security.org/index.html

Keywords

cybersecurity

Access to Document

10.1109/EuroSP57164.2023.00065

aot-paperAccepted author version, 990 KB

Cite this

@inproceedings{9be30e42f9f346f49378534ddff1fd45,

title = "AoT - Attack on Things: A security analysis of IoT firmware updates",

abstract = "IoT devices implement firmware update mechanisms to fix security issues and deploy new features. These mechanisms are often triggered and mediated by mobile companion apps running on the users' smartphones. While it is crucial to update devices, these mechanisms may cause critical security flaws if they are not implemented correctly. Given their relevance, in this paper, we perform a systematic security analysis of the firmware update mechanisms adopted by IoT devices via their companion apps. First, we define a threat model for IoT firmware updates, and we categorize the different potential security issues affecting them. Then, we analyze 23 popular IoT devices (and corresponding companion apps) to identify vulnerable devices and the SDKs that such devices use to implement the update functionality. Our analysis reveals that 6 popular SDKs present dangerous security flaws. Additionally, we fingerprint each vulnerable SDK and we leverage our fingerprints to perform a large-scale analysis of companion apps from the Google Play Store. Our results show that 61 popular devices and 1,356 apps rely on vulnerable SDKs, thus, they potentially adopt an insecure firmware update mechanism.",

keywords = "cybersecurity",

author = "Muhammad Ibrahim and Andrea Continella and Antonio Bianchi",

note = "Funding Information: We are grateful to our reviewers for their valuable feedback. We are also grateful to companies Nordic Semiconductor and SwitchBot U.S. for providing support and working with us. We would also like to thank Everett Johnson for helping us with the manual analysis. This work has been supported by the INTERSECT project, Grant No. NWA 1160.18.301, funded by the Netherlands Organisation for Scientific Research (NWO), and by the Dutch Ministry of Economic Affairs and Climate Policy (EZK) through the AVR project {\textquoteleft}FirmPatch{\textquoteright}. This work was also supported in part by DARPA under contract number N6600120C4031, and by the Google{\textquoteright}s ASPIRE Award. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation thereon. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of DARPA, the U.S. Government, or Google. Publisher Copyright: {\textcopyright} 2023 IEEE.; 8th IEEE European Symposium on Security and Privacy, Euro S&P ; Conference date: 03-07-2023 Through 07-07-2023",

year = "2023",

month = jul,

day = "3",

doi = "10.1109/EuroSP57164.2023.00065",

language = "English",

pages = "1047--1064",

booktitle = "Proceedings - 8th IEEE European Symposium on Security and Privacy, Euro S and P 2023",

publisher = "IEEE",

address = "United States",

url = "https://eurosp2023.ieee-security.org/index.html",

}

TY - GEN

T1 - AoT - Attack on Things: A security analysis of IoT firmware updates

AU - Ibrahim, Muhammad

AU - Continella, Andrea

AU - Bianchi, Antonio

N1 - Conference code: 8

PY - 2023/7/3

Y1 - 2023/7/3

N2 - IoT devices implement firmware update mechanisms to fix security issues and deploy new features. These mechanisms are often triggered and mediated by mobile companion apps running on the users' smartphones. While it is crucial to update devices, these mechanisms may cause critical security flaws if they are not implemented correctly. Given their relevance, in this paper, we perform a systematic security analysis of the firmware update mechanisms adopted by IoT devices via their companion apps. First, we define a threat model for IoT firmware updates, and we categorize the different potential security issues affecting them. Then, we analyze 23 popular IoT devices (and corresponding companion apps) to identify vulnerable devices and the SDKs that such devices use to implement the update functionality. Our analysis reveals that 6 popular SDKs present dangerous security flaws. Additionally, we fingerprint each vulnerable SDK and we leverage our fingerprints to perform a large-scale analysis of companion apps from the Google Play Store. Our results show that 61 popular devices and 1,356 apps rely on vulnerable SDKs, thus, they potentially adopt an insecure firmware update mechanism.

AB - IoT devices implement firmware update mechanisms to fix security issues and deploy new features. These mechanisms are often triggered and mediated by mobile companion apps running on the users' smartphones. While it is crucial to update devices, these mechanisms may cause critical security flaws if they are not implemented correctly. Given their relevance, in this paper, we perform a systematic security analysis of the firmware update mechanisms adopted by IoT devices via their companion apps. First, we define a threat model for IoT firmware updates, and we categorize the different potential security issues affecting them. Then, we analyze 23 popular IoT devices (and corresponding companion apps) to identify vulnerable devices and the SDKs that such devices use to implement the update functionality. Our analysis reveals that 6 popular SDKs present dangerous security flaws. Additionally, we fingerprint each vulnerable SDK and we leverage our fingerprints to perform a large-scale analysis of companion apps from the Google Play Store. Our results show that 61 popular devices and 1,356 apps rely on vulnerable SDKs, thus, they potentially adopt an insecure firmware update mechanism.

KW - cybersecurity

U2 - 10.1109/EuroSP57164.2023.00065

DO - 10.1109/EuroSP57164.2023.00065

M3 - Conference contribution

SP - 1047

EP - 1064

BT - Proceedings - 8th IEEE European Symposium on Security and Privacy, Euro S and P 2023

PB - IEEE

T2 - 8th IEEE European Symposium on Security and Privacy

Y2 - 3 July 2023 through 7 July 2023

ER -

AoT - Attack on Things: A security analysis of IoT firmware updates

Abstract

Conference

Keywords

Access to Document

Fingerprint

Cite this