Dilemma in IoT Access Control: Revealing Novel Attacks and Design Challenges in Mobile-as-a-Gateway
summary
Bought and reverse-engineered 10 real-world devices (mainly smart locks and trackers) and finds every vendor drops critical semantics when translating cloud policies to on-device rules, letting revoked users keep BLE bindings or offline keypad codes and allowing low-privilege accounts to send high-privilege commands; implemented proof-of-concept attacks that exploit on-device identity loss and message reordering during policy sync; disclosed issues, vendors acknowledge them and four patched while the fundamental translation and consistency problems remain.
AI-written summary · about
chapters (9)
- 0:00Introduction to speaker
- 1:14Mobile and gateway IoT
- 3:33Mega IoT architecture
- 6:19Security challenges
- 9:30Access model translation
- 14:26Identity and binding flaws
- 19:45Privilege escalation risks
- 25:10Privacy and status syncing
- 30:46Policy synchronization issues
related talks
35mHow I Can Unlock Your Smart Door: Security Pitfalls in Cross-Vendor IoT Access Control
32mDesign Flaws and Deployment Chaos in Cloud-based IoT Access Control Policies
18mNo Key, No Problem: Vulnerabilities in Master Lock Smart Locks
26mSo who owns the security of the IoT
26mThreat Modeling for IoT
23mSmart Devices Gone Rogue: IOT Vulnerabilities and Designing For Security
54mThe Perimeter Has Been Shattered: Attacking and Defending Mobility and IoT on the Enterprise Network
10mIoT: End of Shorter Days