Toward discovering and identifying real-world IoT devices
Danny Y. Huang
Assistant Professor
Center for Cyber Security
New York University
We are surrounded by IoT devices
Not just my home, but elsewhere too
IoTs in someone else’s home (Airbnb)
IoTs in my home but I have no control
New threat model
I may not know of or have control over an IoT device
An IoT device can be easily used by anyone
Overall research questions
What devices are around me?
What are these devices doing?
Easy to buy covert spying devices
Easy to buy covert spying devices
Characteristics of our sample of 163 potential spy devices
USENIX Security ’23
Nick Ceccio
Sophie Stephenson
Varun Chadha
Danny Yuxing Huang
Rahul Chatterjee
Some devices explicitly claim to catch cheating spouse
Advertised use cases of devices used for spying
USENIX Security ’23
Fing App: scan for devices on wireless network
Non-WiFi based detectors on the market
Detectors’ readings constantly fluctuate
USENIX Security ’23
Challenges in detecting devices
Training data
More precise techniques
Usability for non-experts
Crowdsourcing network fingerprints from devices
IMWUT/Ubicomp ‘20
Danny Yuxing Huang
Noah Apthorpe
Gunes Acar
Frank Li
Nick Feamster
User interface: device list
User interface: device activity
Large training dataset from real-world devices
63K+ Internet-connected devices across 6K users worldwide since 2019
Median running time: ~40 minutes
Data collected by IoT Inspector
Challenges in device identification using IoT Inspector data
Cleaning labels from users and devices
No ground truth; can only check for consistency
Overall research questions
What devices are around me?
What are these devices doing?
General challenges in discovering and locating devices
Layer | Work | Venue | Identifies devices | Locates devices | Usable |
IP | IoT Inspector | IMWUT ‘20 | Yes | No | Maybe |
802.11 | Wi-Peep | MobiCom ‘22 | Maybe | yes | No |
BLE | AirGuard | WiSec ‘22 | AirTag only? | No | Maybe |
LTE | ? | ? | ? | ? | ? |
Locating 802.11-based devices with time-of-flight
MobiCom ‘22
Ali Abedi
Deepak Vasisht
Emulating Apple’s UI/UX in locating 802.11-based devices
Deployment for real-world use
Usability:
Form factor: app vs hardware
Location: in situ vs dedicated center
Instructions: self-driven vs phone
One-time scan vs continuous monitoring
False positives and negatives
Taking actions
Summary
Research questions:
What devices around me?
What these devices are doing?
Challenges
Training data
Precision
Usability
Ethics & safety