Re: [dnssd] Privacy risks with smart home local device communication

[Esko Dijk <[e-mail]>]

Thanks,

I believe there are definitely aspects mentioned in the paper that we need to consider in dnssd. mDNS (as mentioned in the paper) is one protocol, but newer ones are coming up (such as SRP).
Going towards authenticated + authorized access to discovery information still has some way to go, but SRP could enable this in the future.

But it's still a might puzzle to get there, given the requirements to stay compatible with existing/legacy approaches (e.g. unsecured mDNS advertisements of the contents of the SRP Registrar) and the prevalence of unique IDs for many things in IoT (keys, service names, host names etc).
Not entirely sure what a good next step would be.

Esko

From: dnssd <[e-mail]> On Behalf Of Aniketh Girish
Sent: Wednesday, November 15, 2023 11:23
To: [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]; [e-mail]
Cc: Tianrui Hu <[e-mail]>; Narseo Vallina Rodriguez <[e-mail]>; David Choffnes <[e-mail]>; Juan Tapiador <[e-mail]>
Subject: [dnssd] Privacy risks with smart home local device communication

Hi,

[Apologies for cross-posting]

I am writing to share our recent research paper[1] published at ACM IMC 2023, which addresses critical security and privacy concerns in smart home local networks. Our study focuses on characterizing local device communication and reveals substantial privacy risks associated with the misuse of discovery protocols. Additionally, we discover the inadvertent exposure of personally identifiable information (PII) by smart devices in discovery broadcasts/multicasts and detail the methods used by entities like advertisers and trackers to covertly exfiltrate this data.

Key findings of our paper include:


  1.  Unintentional PII Broadcasts and Protocol Vulnerabilities: Our study shows that half of the devices in our dataset directly communicate with each other without any user interactions, often conspicuously broadcasting sensitive information like device names, private IDs, and household geolocations. This is amplified by vulnerabilities in network protocols such as DHCP, mDNS, and UPnP, leading to risks like outdated DHCP clients being vulnerable to exploitation and cross-device tracking due to unique identifiers in discovery protocol fields such as hostnames.
  2.  Broadcasts exploited by Mobile Apps and Third-Party Libraries: We find that mobile apps and third-party libraries exploit these network broadcasts to secretly extract PIIs and device identifiers and relay this local network data to remote endpoints. This occurs without user consent, using discovery protocols to access data protected by Android and iOS permissions, enabling network observers to infer precise user geolocation and other sensitive information.

We have diligently disclosed all risks found in the paper to the affected vendors and they are actively working on several remedial measures. We would also like to engage with IETF Working Groups, as our work is closely aligned with the efforts of groups like DNS-SD, Homenet, and the Open Connectivity Foundation (OCF).We are reaching out to the relevant working groups to seek interest in our findings and to engage in discussions to improve the current state.

Would your group be interested in reconsidering these issues or connecting us with other ongoing efforts within the IETF where our work might be more relevant?  We would also be open to present our paper at one of your upcoming meetings and engage in a discussion on how we can collectively enhance network protocol security and privacy standards.

For more details, please refer to the paper. Your feedback on our paper and thoughts on how it impacts the work of the IETF would be invaluable. We look forward to hearing back from you soon.


[1]: https://dl.acm.org/doi/pdf/10.1145/3618257.3624830

Cheers.
--
Aniketh Girish
PhD Student, IMDEA Networks Institute
https://anikethgirish.in/

This message may contain confidential or privileged information. If you have received it in error, please do not use it, notify the sender and delete it. See https://networks.imdea.org/legal-notice-email/