Security Evaluation of Companion Android Applications in IoT: The Case of Smart Security Devices

Ashley Allen, Alexios Mylonas, Stilianos Vidalis, Dimitris Gritzalis, Maurizio Talamo (Editor)

Research output: Contribution to journalArticlepeer-review

15 Downloads (Pure)

Abstract

Smart security devices, such as smart locks, smart cameras, and smart intruder alarms are increasingly popular with users due to the enhanced convenience and new features that they offer. A significant part of this convenience is provided by the device’s companion smartphone app. Information on whether secure and ethical development practices have been used in the creation of these applications is unavailable to the end user. As this work shows, this means that users are impacted both by potential third-party attackers that aim to compromise their device, and more subtle threats introduced by developers, who may track their use of their devices and illegally collect data that violate users’ privacy. Our results suggest that users of every application tested are susceptible to at least one potential commonly found vulnerability regardless of whether their device is offered by a known brand name or a lesser-known manufacturer. We present an overview of the most common vulnerabilities found in the scanned code and discuss the shortcomings of state-of-the-art automated scanners when looking at less structured programming languages such as C and C++. Finally, we also discuss potential methods for mitigation, and provide recommendations for developers to follow with respect to secure coding practices.
Original languageEnglish
Article number5465
Number of pages19
JournalSensors
Volume24
Issue number17
Early online date23 Aug 2024
DOIs
Publication statusE-pub ahead of print - 23 Aug 2024

Keywords

  • cybersecurity
  • Android
  • smart home
  • software development
  • IoT
  • SAST

Cite this