Refine
Year of publication
- 2019 (1)
Document Type
- Doctoral Thesis (1)
Language
- English (1)
Has Fulltext
- yes (1)
Institute
For the last twenty years, the Internet extends from digital spheres into the physical world through applications such as smart homes, smart cities, and Industry 4.0. Although this technological revolution of the Internet of Things (IoT) brings many benefits to its users, such as increased energy efficiency, optimized and automated processes, and enhanced comfort, it also introduces new security and privacy concerns.
In the first part of this thesis, we examine three novel IoT security and privacy threats from a technical perspective. As first threat, we investigate privacy risks arising from the collection of room climate measurements in smart heating applications. We assume that an attacker has access to temperature and relative humidity data, and trains machine learning classifiers to predict the presence of occupants as well as to discriminate between different types of activities. The results show the leakage of room climate data has serious privacy implications. As second threat, we examine how the expansion of wide-area IoT infrastructure facilitates new attack vectors in hardware security. In particular, we explore to which extent malicious product modifications in the supply chain allow attackers to take control over these devices after deployment. To this end, we design and build a malicious IoT implant that is inserted in arbitrary electronic products. In the evaluation, we leverage these implants for hardware-level attacks on safety- and security-critical products. As third threat, we analyze the security of ZigBee, a popular network standard for smart homes. We present novel attacks that make direct use of the standard's features, showing that one of its commissioning procedures is insecure by design. In the evaluation of these vulnerabilities, we reveal that attackers are able to eavesdrop key material as well as take-over ZigBee products and networks from a distance of more than 100 meters.
In the second part of this thesis, we investigate how IoT security can be improved. Based on an analysis of the root causes of ZigBee's security vulnerabilities, we learn that economic considerations influenced the security design of this IoT technology. Consumers are currently not able to reward IoT security measures as an asymmetric information barrier prevents them from assessing the level of security that is provided by IoT products. As a result, manufacturers are not willing to invest into comprehensive security designs as consumers cannot distinguish them from insufficient security measures. To tackle the asymmetric information barrier, we propose so-called security update labels. Focusing on the delivering of security updates as an important aspect of enforcing IoT security, these labels transform the asymmetric information about the manufacturers' willingness to provide future security updates into an attribute that can be considered during buying decisions. To assess the influence of security update labels on the consumers' choice, we conducted a user study with more than 1,400 participants. The results reveal that the proposed labels are intuitively understood by consumers, considerably influence their buying decisions, and therefore have the potential to establish incentives for manufacturers to provide sustainable security support.