Smart home appliance security & malware

Friday 26 September 14:00 - 14:30, Red room.

Jeongwook Oh HP

This paper is available online (HTML, PDF).

Smart home devices are becoming increasingly popular. Sales of smart TVs alone are expected to increase to 141 million units in 2015. This number may still be small when compared with sales of PCs and mobile devices, but it is an impressive signpost of what's to come. And it's not only our TVs that are getting smarter; our refrigerators, surveillance systems and thermostats are becoming 'smart' too. They are connected to the Internet. They are in the cloud. They have more functionality than ever before and they're making our lives easier. Conversely, they may also be providing new opportunities for crime.

The current upward trend in smart appliance adoption might resemble similar historic trends seen with PCs and smartphones. At this early stage of the adoption process, we might think that the smart devices in our home are safe, but what do we really know about them? They are like black boxes and there is very little information available about their internals. Worryingly, what little published research exists in this area suggests our confidence may be misplaced.

Maybe we are not going to see prevalent malware soon on these platforms, but this is not because smart appliances aren't prone to attack. It is more about the current expected ROI for malware writers. The market for smart appliances isn't even remotely close to saturation at this point, so the potential number of targets, and therefore incentive to compromise remains relatively low. However, this gives us a good chance to think about the security of these smart devices and get ahead of the game. We can learn important lessons from the history of PCs, smartphones and malware.

In this paper, we discuss the current status of security with popular smart home appliances (TVs, thermostats and surveillance cameras). We share our findings from reverse engineering those devices and analysing their defences, including possible attacks or vulnerabilities (such as memory corruptions, MITM issues, etc.). We also elaborate on possible ways to mitigate future threats on these increasingly popular platforms.

Jeongwook Oh

Matt is a security researcher at HP. In the past, one of his main research subjects was patch analysis. He released DarunGrim as an open-source project (http://darungrim.org), which has become one of the most popular patch analysis tools. Currently, his research interests include, but are not limited to, smart appliances and payment device security.