[Pearg] Privacy risks with smart home local device communication

Aniketh Girish <aniketh.girish@imdea.org> Wed, 15 November 2023 17:58 UTC

Return-Path: <aniketh.girish@imdea.org>
X-Original-To: pearg@ietfa.amsl.com
Delivered-To: pearg@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 925A6C14CF1C for <pearg@ietfa.amsl.com>; Wed, 15 Nov 2023 09:58:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.106
X-Spam-Status: No, score=-7.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=imdea.org
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id AsU39BNQBcmc for <pearg@ietfa.amsl.com>; Wed, 15 Nov 2023 09:58:29 -0800 (PST)
Received: from mail.imdea.org (mail.imdea.org []) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FC6CC14CEFA for <pearg@irtf.org>; Wed, 15 Nov 2023 09:58:27 -0800 (PST)
X-Virus-Scanned: Arachnida
X-Arachnida-Id: lrjvjZpxJcny
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=imdea.org; s=arachnida; t=1700071103; h=From:Reply-To:To:Subject:Date:Message-ID:MIME-Version:Content-Type; bh=4yqDdvyQnby+39qyck9k6SdXcUXzkfwTaWv7swT+0pE=; b=SEvQv4jrVI/SgTzO9eB9vXaxT5e7dw7I8V6CIR9PZHriDkU5XX7qPWPHScAvSoflR72yC6l6 2sKIuiteDWEj/3K2P2mREvhuftZuHXqyHtZC/bCD/2wk6Q8yLSD6ZNyLJMxhQSkqjY6kxHc4Igc zVQSvm2HO03oUSmdeYowYyDOXAylGf9BVmDMlnn94aUmMcSeiHodc8QZ5B9pmt0xfENvHbpm6yl AdzJyOUbBuZeiD1UH7wrNxhdPLh+KxlPTPHDEy6VCTu0dkPnUyKCSRUm9ykH3PwJevoxxHo6ZGA jEPcBbFei654n4N/cEqoWtqhXjL4oCMNtAL9AKv0Lulsg==
Received: from smtpclient.apple (unknown []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: aniketh.girish@imdea.org) by mail.imdea.org (Postfix) with ESMTPSA id 53A858A8 for <pearg@irtf.org>; Wed, 15 Nov 2023 18:58:20 +0100 (CET)
From: Aniketh Girish <aniketh.girish@imdea.org>
Content-Type: multipart/alternative; boundary="Apple-Mail=_2DC44E3F-A7CB-4E57-9A5F-71B6DBFA4237"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.300.101.1.3\))
Message-Id: <BE476D72-C26E-4C09-AA8E-25243DB8F414@imdea.org>
Date: Wed, 15 Nov 2023 18:58:09 +0100
To: pearg@irtf.org
X-Mailer: Apple Mail (2.3731.300.101.1.3)
Archived-At: <https://mailarchive.ietf.org/arch/msg/pearg/MPtLaues-lIQTb_gIFUDgwGFDDI>
Subject: [Pearg] Privacy risks with smart home local device communication
X-BeenThere: pearg@irtf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Privacy Enhancements and Assessment Proposed RG <pearg.irtf.org>
List-Unsubscribe: <https://mailman.irtf.org/mailman/options/pearg>, <mailto:pearg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pearg/>
List-Post: <mailto:pearg@irtf.org>
List-Help: <mailto:pearg-request@irtf.org?subject=help>
List-Subscribe: <https://mailman.irtf.org/mailman/listinfo/pearg>, <mailto:pearg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Nov 2023 17:58:34 -0000


I am writing to share our recent research paper[1] published at ACM IMC 2023, which addresses critical security and privacy concerns in smart home local networks. Our study focuses on characterizing local device communication and reveals substantial privacy risks associated with the misuse of discovery protocols. Additionally, we discover the inadvertent exposure of personally identifiable information (PII) by smart devices in discovery broadcasts/multicasts and detail the methods used by entities like advertisers and trackers to covertly exfiltrate this data.

Key findings of our paper include:

- *Unintentional PII Broadcasts and Protocol Vulnerabilities*: Our study shows that half of the devices in our dataset directly communicate with each other without any user interactions, often conspicuously broadcasting sensitive information like device names, private IDs, and household geolocations. This is amplified by vulnerabilities in network protocols such as DHCP, mDNS, and UPnP, leading to risks like outdated DHCP clients being vulnerable to exploitation and cross-device tracking due to unique identifiers in discovery protocol fields such as hostnames.

-  *Broadcasts exploited by Mobile Apps and Third-Party Libraries*: We find that mobile apps and third-party libraries exploit these network broadcasts to secretly extract PIIs and device identifiers and relay this local network data to remote endpoints. This occurs without user consent, using discovery protocols to access data protected by Android and iOS permissions, enabling network observers to infer precise user geolocation and other sensitive information.

We have diligently disclosed all risks found in the paper to the affected vendors and they are actively working on several remedial measures. We would also like to engage with IETF Working Groups, as our work is closely aligned with the efforts of groups like DNS-SD, Homenet, and the Open Connectivity Foundation (OCF).We are reaching out to the relevant working groups to seek interest in our findings and to engage in discussions to improve the current state. 

Would your group be interested in reconsidering these issues or connecting us with other ongoing efforts within the IETF where our work might be more relevant?  We would also be open to present our paper at one of your upcoming meetings and engage in a discussion on how we can collectively enhance network protocol security and privacy standards.

For more details, please refer to the paper. Your feedback on our paper and thoughts on how it impacts the work of the IETF would be invaluable. We look forward to hearing back from you soon.

[1]: https://dl.acm.org/doi/pdf/10.1145/3618257.3624830

Aniketh Girish
PhD Student, IMDEA Networks Institute

This message may contain confidential or privileged information. If you have received it in error, please do not use it, notify the sender and delete it. See https://networks.imdea.org/legal-notice-email/