Security Vetting Process of Smart-home Assistant Applications: A First Look and Case Studies
This addresses security risks for users of smart-home assistant applications, but it is incremental as it builds on prior work by focusing on vetting mechanisms.
The study examined security vetting mechanisms for Amazon Alexa and Google Home apps, finding that current processes are insufficient to detect developer mistakes in authentication, leading to vulnerabilities. It identified 219 real-world Alexa endpoints with these issues, including critical applications for smart home devices and electronic cars.
The popularity of smart-home assistant systems such as Amazon Alexa and Google Home leads to a booming third-party application market (over 70,000 applications across the two stores). While existing works have revealed security issues in these systems, it is not well understood how to help application developers to enforce security requirements. In this paper, we perform a preliminary case study to examine the security vetting mechanisms adopted by Amazon Alexa and Google Home app stores. With a focus on the authentication mechanisms between Alexa/Google cloud and third-party application servers (i.e. endpoints), we show the current security vetting is insufficient as developer mistakes can not be effectively detected and notified. A weak authentication would allow attackers to spoof the cloud to insert/retrieve data into/from the application endpoints. We validate the attack through ethical proof-of-concept experiments. To confirm vulnerable applications have indeed passed the security vetting and entered the markets, we develop a heuristic-based searching method. We find 219 real-world Alexa endpoints that carry the vulnerability, many of which are related to critical applications that control smart home devices and electronic cars. We have notified Amazon and Google about our findings and offered our suggestions to mitigate the issue.