4 ms·

"Our results show that IoT devices contribute the most to this privacy leakage"

• ooterness 3y ago
  It's like they say: the "S" in IoT stands for security.
  • crest 3y ago
    Good old Internet of Things that shouldn't be on the Internet.
• kstrauser 3y ago
  I didn't read the paper. For anyone who did: How would that work exactly? It looks like the general problem is that an IoT device can use SLAAC and its MAC to generate an address like `prefix1::87:65:43:21`. Then the household's prefix can change and the IoT device can create a new address with the same local portion, like `prefix2::87:65:43:21`. Then an attacker could see that `prefix1` and `prefix2` are very likely to have been used by the same person. How would an attacker get that information? If the IoT device is janky and malicious it could ping a bunch of malicious websites and wait for me to access them, I suppose. What would that give an attacker? It's not clear to me how that'd be worse than, say, the current IPv4 situation. And if the device is compromised and no firewall is blocking its outbound Internet access, there are other things I'd be more worried about. If Amazon or Google make the device, then it could just report that back directly to them whenever its Alexa or Google Home bridge reports back. Their logs would show that "bridge 0x1234 connected from `prefix1::` yesterday, and `prefix2::` today, and it's owned by user kstrauser". I don't think anything in this paper could make it less private than that, surely?