MP-Mediator: Detecting and Handling the New Stealthy Delay Attacks on IoT Events and Commands
MP-Mediator: Detecting and Handling the New Stealthy Delay Attacks on IoT Events and Commands
复制标题
DOI：
10.1145/3607199.3607225
复制
发表时间：
2023-10
期刊：
影响因子：
--
通讯作者：
Xuening Xu;Chenglong Fu;Xiaojiang Du
中科院分区：
文献类型：
--
作者：
Xuening Xu;Chenglong Fu;Xiaojiang Du
近年来，智能和自动化设备控制功能导致智能家居物联网系统的采用显着增加。每个物联网设备将其事件发送到相应的物联网服务器/平台（并从中接收命令），该服务器/平台执行用户设置的自动化规则。最近的研究表明，物联网消息（包括事件和命令）可能会出现几秒到几分钟甚至几小时的隐秘延迟，而不会发出任何警报。利用此漏洞，攻击者可以故意延迟关键事件（例如火警）或命令（例如锁门），以及改变指示自动化规则执行的物联网消息的顺序。这种操纵可能会欺骗物联网服务器，导致发出错误的命令并危及智能家居的安全。在本文中，我们提出了 MP-Mediator，它是第一个能够检测和处理针对物联网消息的新型、隐秘且广泛适用的延迟攻击的防御系统。对于缺乏可访问 API 的物联网设备，我们提出了利用虚拟设备和虚拟规则作为与 MP-Mediator 间接集成的桥梁的创新方法。此外，还提出了基于 VPN 的组件来处理关键链路上的命令延迟攻击。我们在现实世界的智能家居测试台中实施和评估 MP-Mediator，该测试台具有 22 个流行的 IoT 设备和两个主要的 IoT 自动化平台（IFTTT 和 Samsung SmartThings）。实验结果表明，MP-Mediator能够快速、准确地检测物联网事件和命令的延迟攻击，准确率超过96%，召回率100%，并有效处理延迟攻击。
In recent years, intelligent and automated device control features have led to a significant increase in the adoption of smart home IoT systems. Each IoT device sends its events to (and receives commands from) the corresponding IoT server/platform, which executes automation rules set by the user. Recent studies have shown that IoT messages, including events and commands, are subject to stealthy delays ranging from several seconds to minutes, or even hours, without raising any alerts. Exploiting this vulnerability, adversaries can intentionally delay crucial events (e.g., fire alarms) or commands (e.g., locking a door), as well as alter the order of IoT messages that dictate automation rule execution. This manipulation can deceive IoT servers, leading to incorrect command issuance and jeopardizing smart home safety. In this paper, we present MP-Mediator, which is the first defense system that can detect and handle the new, stealthy, and widely applicable delay attacks on IoT messages. For IoT devices lacking accessible APIs, we propose innovative methods leveraging virtual devices and virtual rules as a bridge for indirect integration with MP-Mediator. Furthermore, a VPN-based component is proposed to handle command delay attacks on critical links. We implement and evaluate MP-Mediator in a real-world smart home testbed with twenty-two popular IoT devices and two major IoT automation platforms (IFTTT and Samsung SmartThings). The experimental results show that MP-Mediator can quickly and accurately detect the delay attacks on both IoT events and commands with a precision of more than 96% and a recall of 100%, as well as effectively handle the delay attacks.