[dnssd] Privacy risks with smart home local device communication

Aniketh Girish <aniketh.girish@imdea.org> Wed, 15 November 2023 18:11 UTC

Return-Path: <aniketh.girish@imdea.org>
X-Original-To: dnssd@ietfa.amsl.com
Delivered-To: dnssd@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id A9290C14CE2B for <dnssd@ietfa.amsl.com>; Wed, 15 Nov 2023 10:11:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.105
X-Spam-Status: No, score=-7.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=imdea.org
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id i0qp5vKCN3Kd for <dnssd@ietfa.amsl.com>; Wed, 15 Nov 2023 10:11:40 -0800 (PST)
Received: from mail.imdea.org (mail.imdea.org []) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A142C14CE4A for <dnssd@ietf.org>; Wed, 15 Nov 2023 10:11:40 -0800 (PST)
X-Virus-Scanned: Arachnida
X-Arachnida-Id: lSfGHctSmnck
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=imdea.org; s=arachnida; t=1700071898; h=From:Reply-To:To:Subject:Date:Message-ID:MIME-Version:Content-Type; bh=JIFOAGTinYnk76T/Rn9LGtTWFZex/rZ/shIuPwROLjY=; b=uq5mqBu1qwgl2tNOb0cAg/voRxqKxvCZKx7e/EpvFMakqUv1hIESgdiz87v1ItIjzK6hjV2k GnxpnYyu+38Qm9ktot3pig7OS8lZWzFEFtHXT9Glm3Ka0mewoMRlXaVrO3S/U/vsAqR3kOoN8bo GK4nIjyknaAITsL9YnG5/OB2BNORpTDNbMh44V6WpG6t1kXc+KvDXWHz3xLdbVlXYFQ1zwV3MBi gK4HPN/yj+9W7tzUkaPXa0o24r4eecLsasOc33NJOqqEHMURfSWgmTE7I3ibo/nF3nnZ0lym8mX vb1o3sbPjZGgJFSvYoGSdjmKEt6sGg4ZiQyPAbyYApyxg==
Received: from smtpclient.apple (unknown []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: aniketh.girish@imdea.org) by mail.imdea.org (Postfix) with ESMTPSA id 592F68A8 for <dnssd@ietf.org>; Wed, 15 Nov 2023 19:11:36 +0100 (CET)
From: Aniketh Girish <aniketh.girish@imdea.org>
Content-Type: multipart/alternative; boundary="Apple-Mail=_321BEBED-AA14-40A8-B80D-A7178445F7AA"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.300.101.1.3\))
Message-Id: <97123BEE-FE6C-469A-B689-43B7AC1B420B@imdea.org>
Date: Wed, 15 Nov 2023 19:11:26 +0100
To: dnssd@ietf.org
X-Mailer: Apple Mail (2.3731.300.101.1.3)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnssd/9pXSm7tz3Wztv5kBCEpiHociSDA>
Subject: [dnssd] Privacy risks with smart home local device communication
X-BeenThere: dnssd@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "Discussion of extensions to DNS-based service discovery for routed networks." <dnssd.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnssd>, <mailto:dnssd-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnssd/>
List-Post: <mailto:dnssd@ietf.org>
List-Help: <mailto:dnssd-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnssd>, <mailto:dnssd-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Nov 2023 18:11:45 -0000


I am writing to share our recent research paper[1] published at ACM IMC 2023, which addresses critical security and privacy concerns in smart home local networks. Our study focuses on characterizing local device communication and reveals substantial privacy risks associated with the misuse of discovery protocols. Additionally, we discover the inadvertent exposure of personally identifiable information (PII) by smart devices in discovery broadcasts/multicasts and detail the methods used by entities like advertisers and trackers to covertly exfiltrate this data.

Key findings of our paper include:

- Unintentional PII Broadcasts and Protocol Vulnerabilities: Our study shows that half of the devices in our dataset directly communicate with each other without any user interactions, often conspicuously broadcasting sensitive information like device names, private IDs, and household geolocations. This is amplified by vulnerabilities in network protocols such as DHCP, mDNS, and UPnP, leading to risks like outdated DHCP clients being vulnerable to exploitation and cross-device tracking due to unique identifiers in discovery protocol fields such as hostnames.

-  Broadcasts exploited by Mobile Apps and Third-Party Libraries: We find that mobile apps and third-party libraries exploit these network broadcasts to secretly extract PIIs and device identifiers and relay this local network data to remote endpoints. This occurs without user consent, using discovery protocols to access data protected by Android and iOS permissions, enabling network observers to infer precise user geolocation and other sensitive information.

We have diligently disclosed all risks found in the paper to the affected vendors and they are actively working on several remedial measures. We would also like to engage with IETF Working Groups, as our work is closely aligned with the efforts of groups like DNS-SD, Homenet, and the Open Connectivity Foundation (OCF).We are reaching out to the relevant working groups to seek interest in our findings and to engage in discussions to improve the current state. 

Would your group be interested in reconsidering these issues or connecting us with other ongoing efforts within the IETF where our work might be more relevant?  We would also be open to present our paper at one of your upcoming meetings and engage in a discussion on how we can collectively enhance network protocol security and privacy standards.

For more details, please refer to the paper. Your feedback on our paper and thoughts on how it impacts the work of the IETF would be invaluable. We look forward to hearing back from you soon.

[1]: https://dl.acm.org/doi/pdf/10.1145/3618257.3624830

Aniketh Girish
PhD Student, IMDEA Networks Institute

This message may contain confidential or privileged information. If you have received it in error, please do not use it, notify the sender and delete it. See https://networks.imdea.org/legal-notice-email/