darkReading-logo

Connecting the information security community

Author Bio ▼

Part of the Informa Network, Dark Reading is a trusted online community for cyber security professionals, including CISOs, cyber security researchers and technology specialists. Covering the latest threats, vulnerabilities and cyber attacks, Dark Reading supports community members in keeping up with the latest in the sector.
May 11, 2021

Download

Whitepaper: Enhancing security, resilience and efficiency across a range of industries

IoT security

Vulnerabilities in IoT-based access control devices puts users and vendors at risk

Researchers spot problems in how IoT vendors delegate device access across multiple clouds and users, reports Dark Reading’s Kelly Sheridan.

KellySheridan-DarkReading-20A team of Internet of Things security researchers has discovered vulnerabilities in the way IoT device vendors manage access across multiple clouds and users, putting both individuals and vendors at risk.

IoT devices are increasingly managed through clouds operated by device vendors such as Philips Hue, LIFX, and Tuya, or by cloud providers such as Google and Amazon. These clouds mediate the users’ access to specific devices — for example, granting them permission to unlock a smart lock.

The researchers were especially interested in the emerging capability to delegate device access across multiple clouds and users. Some vendors let Google Home control devices under their clouds, so a person can manage multiple devices from different vendors via their Google Home. It’s a win for usability — normally, someone with devices from various vendors would install multiple apps to control them, which becomes a hassle as their IoT device collection grows.

“[The IoT] keeps evolving, and we keep observing new security issues, new security risks coming up, especially when a vendor tries to strike a balance between usability and security,” says Luyi Xing, Assistant Professor of computer science at Indiana University Bloomington and a member of the research team.

While being able to manage multiple devices from a single hub is convenient, access delegation across IoT clouds is distributed and unverified, researchers report. The problems emerge when one cloud unknowingly violates the security operations and assumptions of another cloud. When this happens, devices may not fully revoke access when someone instructs them to.

“Security always comes behind the functionality, so that’s why this is important,” adds Bin Yuan, post-doc at Huazhong University of Science and Technology and Indiana University Bloomington. “That’s why we did our research in this area, to better understand it and try to solve the security risks here.”

The problem lies in vendors’ protocols, Xing explains. Each vendor independently develops its own delegation protocol with implicit security assumptions, but the protocols from different vendors have to work together to establish the delegation chain between vendor and user.

“When these protocols work together, their security assumptions may conflict with each other, and one vendor may not fully understand the implications [or] the assumptions of another vendor’s operation in terms of security,” he says. One of the vulnerabilities they discovered let a user continue accessing a device after temporary permissions were removed. When someone attempted to revoke the permission, it turned out the user still had control over the device.

In the real world, this could happen with something as simple as a smart lock, Xing says. An Airbnb host may grant temporary access to a guest, but that guest could still have access to their home after the host thinks they’ve checked out.

An industry-wide problem

This problem affects a broad range of IoT device vendors and clouds. Given this, the researchers sought to develop an approach to verify the protocols of different device manufacturers and determine whether a protocol might be vulnerable to an attack. They created a verification tool to model the operations and data flows of an IoT vendor and automatically discover flaws.

From there, they conducted a systematic study on cross-cloud IoT delegation, in which they investigated 10 mainstream IoT clouds, including Google Home, SmartThings, Philips Hue, LIFX, August, and others. They discovered five serious flaws that, if exploited, could give someone unauthorised access to IoT devices such as smart locks, switches, and safety sensors, they say.

“We can find the individual vulnerabilities for a specific protocol, for a specific vendor, but that doesn’t solve the problem,” Xing says of why they wanted to create a systematic approach. All of the flaws they discovered were reported to the respective vendors, which have deployed or scheduled fixes.

The researchers believe cross-vendor delegation is helpful to users; however, the protocols behind it must be designed with more caution. Protocols they saw in the wild had not undergone rigorous security analysis or verification, Xing says. The team hopes that protocols will eventually become more transparent, so vendors know one another’s security assumptions.


darkReading-logoThis story first appeared on Dark Reading. Part of the Informa Network, Dark Reading is a trusted online community for cyber security professionals, including CISOs, cyber security researchers and technology specialists. Covering the latest threats, vulnerabilities and cyber attacks, Dark Reading supports community members in keeping up with the latest in the sector.


 

Connect with the security industry online 1-30 June

Connect 2021 is your first major opportunity to come together with the security industry online from 1-30 June!

The month-long online event will give attendees the opportunity to make up for lost time by browsing security solutions, connecting with suppliers and accessing thought-leadership content - all from the comfort of your own home or workplace!

Related Topics

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments