Hello, my name is Danny Yuxing Huang, an assistant professor at New York University.
In this video, I'll give you a quick overview on how we crowdsource the network traffic
from thousands of real-world IoT devices around the world.
Many smart home IoT devices present security and privacy threats to users.
One key challenge in studying the security and privacy of these "smart devices" is scale.
A typical method is for researchers to buy dozens of smart home devices, install them
in the lab, manually interact with these devices, capture the network traffic, and try to identify
security and privacy issues . The problem is that this method is hard to scale up to
hundreds or even thousands of different types of smart home devices.
To study the security and privacy of real-world devices, we need to collect network traffic
from smart home devices at scale.
To this end, we decide to crowdsource network traffic from real smart home users.
But how do we convince thousands or even hundreds of thousands of people to help us crowdsource
this data?
Well, we build a usable software tool that provides volunteers with insight on IoT security
& privacy with one-click; in return, we ask users for consent and collect their anonymized
network traffic data.
This tool that we built is called IoT Inspector.
Anyone can visit iotinspector.org to download this tool.
Once a user downloads and runs IoT Inspector on their mac, linux, or windows computers,
IoT Inspector shows a list of devices in the same network.
Users can then look at various visualization of the smart home network traffic, like identifying
tracking and advertising services, or checking if their devices are sending large volumes
of data when the devices are not being used.
Note that users do not need additional hardware; IoT Inspector runs on their computer.
Users don't need to change their router settings either.
So how does IoT Inspector collect network traffic?
IoT Inspector works by using a technique known as ARP spoofing.
Let's say a smart camera is connected to the wireless network.
For IoT Inspector to capture the traffic, the traffic must be rerouted to IoT Inspector.
To reroute the traffic, IoT Inspector regularly sends an ARP message to the camera that says,
"Hello camera, I'm the wireless router."
At the same time, IoT Inspector regularly sends an ARP message to the wireless router
that says, "Hello router, I'm the camera."
These ARP messages convince the camera that IoT Inspector is the router, and they convenience
the router that it is the camera.
So now, all traffic between the camera and the wireless router goes through IoT Inspector.
ARP spoofing allows IoT Inspector to collect traffic without having users reconfigure their
gateways, resetting their smart devices, or purchasing additional hardware.
A few clicks, and users can identify potential security and privacy problems on their smart
home network.
Since we deployed the tool in April 2019, we have attracted more than 5,500 users around
the world, who used the tool to inspect more than 55,000 devices.
These numbers are growing, as anyone can download the tool now.
Among the users are journalists from Washington Post and National Public Radio, who used IoT
Inspector to investigate privacy leaks on smart TVs.
We have built the largest known dataset of smart home network traffic by academic researchers.
This data reveals new insights on security and privacy threats on real-world devices
in the wild.
For example, there are many cases where encryption is not implemented or implemented incorrectly.
Some 36% of devices communicate over plain-text HTTP, including devices made by Amazon.
For devices that use TLS, 10% of these devices used outdated versions like SSL 3.0 and TLS
1.0, including devices made by Samsung.
As a result, an on-path attacker could potentially conduct a man-in-the-middle attack on such
devices.
One example for privacy risks is smart TVs.
We looked at 417 smart TVs in our dataset and the registered domains they contacted.
22% of these domains belong to advertising and tracking services.
In fact, 34% of smart TVs talk to Google advertising domains, and 5% of smart TVs talk to advertising
and tracking services owned by Comcast.
We're currently collaborating with a number of institutions, including University of Chicago
and Carnegie Mellon University.
Topics include IoT domain identification, building firewalls for IoT devices, studying
users' privacy perception, and conducting healthcare research.
Feel free to reach out to us if you're interested in doing research with this largest known
dataset of IoT traffic.
For more information, visit iotinspector.org.
Thank you!