According to a study published by researchers at Princeton University that has been echoed by HelpNetSecurity, although many IoT devices for smart homes encrypt their traffic, any “passive observer of the network” (such as an Internet provider) can detect the behavior of the users and other details analyzing the metadata of their traffic rate.
To demonstrate this, researchers have recreated a separate home with a passive TAP in a laboratory, and have examined the traffic rates of four IoT devices for smart homes: a Sense sleep monitor, a Nest Cam Indoor security camera, a smart plug WeMo and an Amazon Echo speaker.
Based on these tests, they realized that separating network traffic into packet flows and associating it with an IoT device is not that difficult . In the document we can read the following:
Once an adversary identifies packet flows for a particular device, one or more of the streams encode the state of the device. Tracing the rates of sending and receiving flows (bytes per second) revealed interactions of potentially private users for each device we tested.
This means that any actor outside the home could extract sensitive data from users , such as sleep patterns, the hours they are at home and even use the personal assistant Alexa from the Amazon speaker.
What can be done to increase privacy?
for smart homes. His analysis makes it clear, since it was not based on a thorough inspection of the packages, but on rates of sending and receiving encrypted traffic:
A systematic solution to preserve user privacy would require obstructing or configuring all intelligent home traffic to mask the variations that encode real-world behavior.
In addition, they added that a solution like this should not have a negative impact on the performance of the device. You should also respect the limitations of the data, and you should not require the modification of proprietary software.
Together with these conclusions, they offer four strategies for manufacturersand third parties involved in the development of the devices that can be implemented in order to protect the privacy of consumers:
- Block outbound connections to prevent any observer from seeing the data streams of the devices.
- Encrypt DNS requests to prevent an observer from identifying the devices.
- Pass all smart home traffic through a VPN, so that traffic originating from a smart home can not be related to individual devices.
- Form or inject traffic to limit the confidence of an observer by identifying devices or inferring behavior, either by masking interesting traffic patterns or impersonation devices that are not in the network.
The researchers are adamant that each of the solutions they propose is not ideal. For example, the functionality of the devices they tested is affected when they are passed through a firewall, or when they are prevented from connecting to other devices beyond their local network. In conclusion, the authors of the study say that policy makers should also include protections for consumers.