一句话：提出 MEDIC 框架，自动建模 IFTTT 风格智能家居集成并检测其安全问题，实验发现 83% 的集成存在安全隐患。
物联网在智能家居中日益普及，触发器-动作编程（如 IFTTT）让新手用户能轻松编写 applet，用一个设备/服务的状态触发另一个设备/服务的动作，从而组合出丰富的功能。然而用户缺乏安全经验，也意识不到单个设备遭网络攻击后的连锁影响，可能设计出不安全的集成，造成财务损失、隐私泄露和未授权访问。为此，作者提出系统化框架 MEDIC，对智能家居集成进行建模与安全检查：它自动生成包含服务/设备行为与 applet 动作规则的模型，同时把外部攻击和设备内部脆弱性纳入考虑。实验在来自用户研究的集成以及从 ifttt.com 爬取的数据集共 200 个集成上进行，单个集成的建模与检查约需 1 秒；结果显示近 83% 的集成存在安全问题。
Internet of Things (IoT) has become prevalent in various fields, especially in the context of home automation (HA). To better control HA-IoT devices, especially to integrate several devices for rich smart functionalities, trigger-action programming, such as the If This Then That (IFTTT), has become a popular paradigm. Leveraging it, novice users can easily specify their intent in applets regarding how to control a device/service through another once a specific condition is met. Nevertheless, the users may design IFTTT-style integrations inappropriately, due to lack of security experience or unawareness of the security impact of cyber-attacks against individual devices. This has caused financial loss, privacy leakage, unauthorized access and other security issues. To address these problems, this work proposes a systematic framework named MEDIC to model smart home integrations and check their security. It automatically generates models incorporating the service/device behaviors and action rules of the applets, while taking into consideration the external attacks and in-device vulnerabilities. Our approach takes around one second to complete the modeling and checking of one integration. We carried out experiments based on 200 integrations created from a user study and a dataset crawled from ifttt.com. To our great surprise, nearly 83% of these integrations have security issues.
@inproceedings{BuZLDBCL23,
title = {Security Checking of Trigger-Action-Programming Smart Home Integrations},
author = {Lei Bu and Qiuping Zhang and Suwan Li and Jinglin Dai and Guangdong Bai and Kai Chen and Xuandong Li},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598084}
}