IEEE Technology and Society Magazine - June 2018 - 79

Current Generation of IoT Devices
Vulnerable to Attack

ICMP Reflection

SSDP Reflection

SNMP Reflection

SNMP Public
Community String

Reflection Attacks

Phillips Hue Light Bulb

C

C

A

A

Belkin Switch

C

C

A

A

Samsung Smart Cam

C

A

C

C

Belkin Smart Cam

C

C

A

A

Awair Air Monitor

C

A

A

A

HP Envy Printer

C

A

C

A

LIFX Bulb

A

A

A

A

Canary Camera

C

A

A

A

TP Link Switch

C

A

A

A

Amazon Echo

C

A

A

A

Samsung Smart Things

C

A

A

A

Pixstar Photo Frame

C

A

A

A

TP-Link Camera

C

A

A

A

Belkin Motion Sensor

C

C

A

A

Nest Smoke Alarm

C

A

A

A

Netatmo Camera

C

A

A

A

Dlink Camera

C

C

A

A

Hello Barbie Companion

C

A

A

A

Withings Sleep Monitor

C

A

A

A

Nest Drop Camera

C

A

A

A

A

A

A

A

A

A

A

A

A

A

A

A

Devices

Netatmo Weather Station
C

Triby Speaker
Withings Weighing Scale
Chromecast

C

Key:
ICMP: Internet Control Message Protocol
SSDP: Simple Service Discovery Protocol
SNMP: Simple Network Management Protocol

Consumer products connected to the Internet will soon
become commonplace in homes and businesses, and
will offer customers many productivity and lifestyle
benefits. Our study, however, suggests that the current generation of IoT devices is vulnerable to attack in
a number of ways. It is a complex problem, and there
don't appear to be any "single bullet" solutions to make
IoT devices safer or more secure. We hope this article
sets the platform for a dialogue between consumers,
suppliers, regulators, and insurers of IoT devices to
develop appropriate methods to tackle the problem.

Author Information
Vijay Sivaraman and Hassan Habibi Gharakheili are with
the School of Electrical Engineering and Telecommunications, University of New South Wales (UNSW), Australia.
Clinton Fernandes is with the School of Humanities
and Social Sciences at UNSW and the Australian Centre
for Cyber Security, Australia.
Narelle Clark and Tanya Karliychuk are with the Australian Communications Consumer Action Network, Australia. Email: research@accan.org.au.

References
[1] D. Evans, "The Internet of Things: How the next evolution of
the Internet is changing everything," CISCO,White Paper, 2011;
https://www.cisco.com/c/dam/en_us/about/ac79/docs/innov/IoT_
IBSG_0411FINAL.pdf.
[2] J. Chambers, Executive Director of Product Innovation, comments
presented at UNSW workshop (Australia), Apr. 20, 2017.
[3] N. Dhanjani, Abusing the Internet of Things: Blackouts, Freakouts, and Stakeouts. O'Reilly Media, 2015.
[4] E. Fernandes, J. Jung, and A. Prakash, "Security analysis of emerging smart home applications," in Proc. IEEE Symp. Security and Privacy (San Jose, CA, USA), May 2016.
[5] F. Loi, A. Sivanathan, H. Habibi Gharakheili, A. Radford, and V. Sivaraman, "Systematically evaluating security and privacy for consumer
IoT devices," in Proc. ACM CCS Workshop IoT Security and Privacy
(Texas, U.S.A.), Nov. 2017.
[6] Parliamentary Joint Committee on Intelligence and Security, Advisory report on the Telecommunications (Interception and Access)
Amendment (Data Retention) Bill 2014. Canberra, Australia: Commonwealth Parliament, 2015, p. 11.
[7] C. Fernandes and V. Sivaraman, "It's only the beginning: Metadata
retention laws and the Internet of Things," Australian J. Telecommunications and the Digital Economy, vol. 3, no. 3, Sept. 2015.
[8] ZDNet, "No stars for Internet of Things security," presented at AusCERT 2016 Conf., May 27, 2016.
[9] "The data economy: Fuel of the future," The Economist, May 6, 2017.
[10] "The myth of cyber-security" & "Why everything is hackable," The
Economist, Apr. 8, 2017.
[11] M. Wynn et al., "How to practice safe IoT: Sexual intimacy in the
age of smart devices," in Proc. ACM CCS Workshop on IoT Security
and Privacy (Texas, USA), Nov. 2017.
[12] R. Chirgwin, "Wi-Fi sex toy with built-in camera fails penetration test," The Register, Apr. 4, 2014; https://www.theregister
.co.uk/2017/04/04/intimate_adult_toy_fails_penetration_test/.
[13] M. Lyu et al., "Quantifying the reflective DDoS attack capability," in
Proc. ACM (Boston, MA, U.S.A.), Jul. 2017.

Figure 4. Reflection attack.

JUNE 2018

∕

IEEE Technology and Society Magazine

79
https://www.cisco.com/c/dam/en_us/about/ac79/docs/innov/IoT_IBSG_0411FINAL.pdf https://www.theregister.co.uk/2017/04/04/intimate_adult_toy_fails_penetration_test https://www.theregister.co.uk/2017/04/04/intimate_adult_toy_fails_penetration_test
Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - June 2018
