Work

Moving from the Developer Machine to IoT Devices: An Empirical Study

Year: 2024

Type: conference-paper

Abstract: With the growing prevalence of Internet of Things (IoT) devices, IoT cloud platforms have become increasingly vital in the ecosystem that allows heterogeneous IoT devices to be accessed and managed by a wide range of IoT applications. IoT applications are typically hosted on dedicated application servers within the cloud platforms and offer intelligent automation, control, and management features for all connected IoT devices. However, we found that IoT devices can be attacked if the development environment is compromised. In this paper, we conduct the first systematic study on the security risks of IoT cloud platforms that are introduced by compromised development environments. We discover three novel attacks that can invoke commands on the IoT devices, initiate malicious IoT firmware update, and get access to the IoT devices through secure tunneling. We confirm the feasibility of these attacks on mainstream commercial IoT cloud platforms, including Azure IoT Hub, AWS IoT Core, Samsung SmartThings, IBM Watson IoT, and Google IoT, demonstrating their potential to impact a large number of devices. Our work leads to the creation of CVE-2023-38372 by IBM.

Source: IEEE Secure Development Conference (SecDev)

DOI: 10.1109/secdev61143.2024.00019

Authors: Md Rabbi Alam, Jinpeng Wei, Md Sajidul Islam Sajid, Qingyang Wang, Chenglong Fu

Institutions: University of North Carolina at Charlotte, Towson University, Louisiana State University

Language: English

Topic: IoT and Edge/Fog Computing

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

SDG: Industry, innovation and infrastructure

Open Access status: green

Funder: National Science Foundation