Work

A black-box assessment of authentication and reliability in consumer IoT devices

Year: 2025

Type: article

Abstract: In the context of consumer Internet of Things (IoT) devices, the identification of vulnerabilities is becoming increasingly relevant. In this paper, we propose a scalable black-box assessment methodology for identifying authentication and reliability issues in IoT devices without the need for prior knowledge of device models or communication protocols. Our methodology consists of a suite of five black-box tests focusing on two specific aspects: authentication and reliability. One of these tests required the development of a tool, called REPLIOT, specifically aimed at discovering replay attacks on the local network . To the best of our knowledge, the development of such a tool is a significant contribution, as there was no similar tool previously available in the literature. We applied these tests to a testbed consisting of 51 consumer IoT devices. Our experiments reveal that 88% of the tested devices fail at least one of the proposed tests. Further manual investigation reveals severe implications of these results in terms of privacy, security, and reliability. Our findings underline a strong need to improve consumer IoT devices security practices to minimize these potential risks and protect smart home environments.

Source: Pervasive and Mobile Computing

DOI: 10.1016/j.pmcj.2025.102045

Authors: Sara Lazzaro, Vincenzo De Angelis, Anna Maria Mandalari, Francesco Buccafurri

Institutions: University of Calabria, Torrington Hospital, University College London, University of Reggio Calabria

Language: English

Topic: IoT and Edge/Fog Computing

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Estimated APC paid: $2,620

Funder: European Commission