Allen Ashley, Mylonas Alexios, Vidalis Stilianos, Gritzalis Dimitris
Cybersecurity and Computing Systems Research Group, Department of Computer Science, University of Hertfordshire, Hatfield, AL10 9AB, UK.
Department of Informatics, Athens University of Economics and Business (AUEB), 76 Patission Ave., GR-10434 Athens, Greece.
Sensors (Basel). 2024 Aug 23;24(17):5465. doi: 10.3390/s24175465.
Smart security devices, such as smart locks, smart cameras, and smart intruder alarms are increasingly popular with users due to the enhanced convenience and new features that they offer. A significant part of this convenience is provided by the device's companion smartphone app. Information on whether secure and ethical development practices have been used in the creation of these applications is unavailable to the end user. As this work shows, this means that users are impacted both by potential third-party attackers that aim to compromise their device, and more subtle threats introduced by developers, who may track their use of their devices and illegally collect data that violate users' privacy. Our results suggest that users of every application tested are susceptible to at least one potential commonly found vulnerability regardless of whether their device is offered by a known brand name or a lesser-known manufacturer. We present an overview of the most common vulnerabilities found in the scanned code and discuss the shortcomings of state-of-the-art automated scanners when looking at less structured programming languages such as C and C++. Finally, we also discuss potential methods for mitigation, and provide recommendations for developers to follow with respect to secure coding practices.
智能安全设备，如智能锁、智能摄像头和智能入侵报警器，因其提供的更高便利性和新功能而越来越受用户欢迎。这种便利性的很大一部分是由设备配套的智能手机应用程序提供的。终端用户无法获得有关这些应用程序创建过程中是否采用了安全和合乎道德的开发实践的信息。正如这项研究所示，这意味着用户既受到旨在破坏其设备的潜在第三方攻击者的影响，也受到开发者引入的更微妙威胁的影响，开发者可能会跟踪他们对设备的使用情况，并非法收集侵犯用户隐私的数据。我们的结果表明，无论测试的每个应用程序的用户使用的设备是知名品牌还是不太知名的制造商提供的，都至少容易受到一种常见潜在漏洞的影响。我们概述了在扫描代码中发现的最常见漏洞，并讨论了在查看C和C++等结构化程度较低的编程语言时，现有自动化扫描器的缺点。最后，我们还讨论了潜在的缓解方法，并为开发者提供了有关安全编码实践的建议。
