English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Internet of Things (IoT) devices are becoming increasingly important. Thesedevices are often resource-limited, hindering rigorous enforcement of securitypolicies. Assessing the vulnerability of IoT devices is an important problem,but analyzing their firmware is difficult for a variety of reasons, includingrequiring the purchase of devices. This paper finds that analyzing companionapps to these devices for clues to security vulnerabilities can be an effectivestrategy. Compared to device hardware and firmware, these apps are easy todownload and analyze. A key finding of this study is that the communicationbetween an IoT device and its app is often not properly encrypted andauthenticated and these issues enable the construction of exploits to remotelycontrol the devices. To confirm the vulnerabilities found, we created exploitsagainst five popular IoT devices from Amazon by using a combination of staticand dynamic analyses. We also did a larger study, finding that analyzing 96popular IoT devices only required analyzing 32 companion apps. Among theconservative findings, 50% of the apps corresponding to 38% of the devices didnot use proper encryption techniques to secure device to companion appcommunication. Finally, we discuss defense strategies that developers can adaptto address the lessons from our work.

Beware of the App! On the Vulnerability Surface of Smart Devices through their Companion Apps