On the Data Privacy, Security, and Risk Postures of IoT Mobile Companion Apps

Shradha Neupane,Faiza Tazi,Upakar Paudel,Freddy Freddy Veloz Baez,Merzia Adamjee,Lorenzo De Carli,Sanchari Das,Indrakshi Ray
DOI: https://doi.org/10.2139/ssrn.4121997
2022-01-01
SSRN Electronic Journal
Abstract:Most Internet of Things (IoT) devices provide access through mobile companion apps to configure, update, and control the devices. In many cases, these apps handle all user data moving in and out of devices and cloud endpoints. Thus, they constitute a critical component in the IoT ecosystem from a privacy standpoint, but they have historically been understudied. In this paper, we perform a latitudinal study and analysis of a sample of 455 IoT companion apps to understand their privacy posture using various methods and evaluate whether apps follow best practices. Specifically, we focus on three aspects: data privacy, security, and risk. Our findings indicate: (i) apps may over-request permissions , particularly for tasks that are not related to their functioning; and (ii) there is widespread use of programming and configuration practices which may reduce security, with the concerning extreme of two apps transmitting credentials in unencrypted form.
What problem does this paper attempt to address?