A black-box assessment of authentication and reliability in consumer IoT devices

In the context of consumer Internet of Things (IoT) devices, the identification of vulnerabilities is becoming increasingly relevant. In this paper, we propose a scalable black-box assessment methodology for identifying authentication and reliability issues in IoT devices without the need for prior knowledge of device models or communication protocols. Our methodology consists of a suite of five black-box tests focusing on two specific aspects: authentication and reliability. One of these tests required the development of a tool, called REPLIOT, specifically aimed at discovering replay attacks on the local network. To the best of our knowledge, the development of such a tool is a significant contribution, as there was no similar tool previously available in the literature. We applied these tests to a testbed consisting of 51 consumer IoT devices. Our experiments reveal that 88% of the tested devices fail at least one of the proposed tests. Further manual investigation reveals severe implications of these results in terms of privacy, security, and reliability. Our findings underline a strong need to improve consumer IoT devices security practices to minimize these potential risks and protect smart home environments. • We propose a scalable black-box assessment methodology for identifying weaknesses in IoT devices. • Our methodology consists of a suite of tests focusing on authentication and reliability aspects. • 88% of the tested devices do not pass at least one of the proposed tests.