Analyzing and Understanding the Internet of Insecure Things
Förderjahr 2025 / Stipendium Call #20 / Stipendien ID: 7820
Internet of Things (IoT) devices are now common in homes, assisting with daily tasks while collecting large amounts of user and environmental data. As these devices often lack interfaces, mobile companion apps provide key functionality, but also pose privacy and security risks. My research investigates how IoT devices, apps, backends, and protocols operate, whether safeguards exist, and where privacy may be compromised. In one study, we analyzed the HbbTV protocol used in smart TVs and found personal data was collected before user consent in several European countries. We then examined 3k companion apps, identifying sensitive data exposures, including default credentials allowing access to all users of a health bracelet. Next, we assessed backend systems at scale, uncovering widespread misconfigurations, weak cryptography, and data leakage. Finally, we explored the challenges of coordinated vulnerability disclosure, balancing public safety with researcher and vendor responsibilities.
Uni | FH [Universität]
Themengebiet
Zielgruppe
Gesamtklassifikation
Technologie
Lizenz
Projektergebnisse
The ever-increasing popularity of Smart TVs and support for the Hybrid Broadcast Broadband TV (HbbTV) standard allow broadcasters to enrich content offered to users via the standard broadcast signal with Internet-delivered apps, e.g., ranging from quizzes during a TV show to targeted advertisement. HbbTV works using standard web technologies as transparent overlays over a TV channel. Despite the number of HbbTV-enabled devices rapidly growing, studies on the protocol's security and privacy aspects are scarce, and no standard protective measure is in place.
We fill this gap by investigating the current state of HbbTV in the European landscape and assessing its implications for users' privacy. We shift the focus from the Smart TV's firmware and app security, already studied in-depth in related work, to the content transmission protocol itself. Contrary to traditional "linear TV" signals, HbbTV allows for bi-directional communication: in addition to receiving TV content, it also allows for transmitting data back to the broadcaster. We describe techniques broadcasters use to measure users' (viewing) preferences and show how the protocol's implementation can cause severe privacy risks by studying its deployment by 36 TV channels in five European countries (Italy, Germany, France, Austria, and Finland). We also survey users' awareness of Smart TV and HbbTV-related risks. Our results show little understanding of the possible threats users are exposed to. Finally, we present a denylist-based mechanism to ensure a safe experience for users when watching TV and to reduce the privacy issues that HbbTV may pose.
