IoT Research introduces REPLIoT Tool to Enhance Consumer Device Security

As society increasingly integrates Internet of Things (IoT) devices into daily life, concerns over security vulnerabilities have surged. New research published in the IEEE International Conference on Pervasive Computing and Communications entitled, “Is Your Kettle Smarter Than a Hacker? A Scalable Tool for Assessing Replay Attack Vulnerabilities on Consumer IoT Devices” not only highlights these concerns but offers a tangible solution in the form of a tool designed to systematically assess and address the security gaps prevalent in consumer IoT devices.

At the heart of this research lies REPLIoT, a sophisticated AI toolset poised to redefine the approach to IoT security assessment. Unlike previous methods, REPLIoT requires no prior knowledge of target devices, making it accessible and adaptable across a diverse range of consumer products. Through automated testing, replay attack simulations, and dynamic payload modifications, REPLIOT offers scalability, efficiency, and vendor-agnostic testing capabilities. Its unveiling marks a pivotal moment in the quest for heightened consumer device security, empowering consumers, manufacturers, and security professionals alike to secure the IoT landscape.

Here is a breakdown of how it works:

1. Automated Testing Methodology: REPLIoT systematically tests IoT devices for replay attack vulnerabilities.
2. Replay Attack Simulation: The tool intercepts and replays legitimate communication to mimic an adversary’s action.
3. Dynamic Payload Modification: REPLIoT modifies packet payloads subtly to assess device responses.
4. Scalability and Efficiency: Designed for large-scale experiments across various vendors and categories.
5. Vendor-Agnostic Testing: It adapts to different devices’ communication patterns.

In the study, researchers found that 51% of tested devices do not support local connectivity, failing to meet reliability and safety requirements. While 75% of the remaining devices are vulnerable to replay attacks. One striking example involved a widely used garage door opener lacking robust local security measures. This vulnerability could allow unauthorised access to homes.

Assistant Professor and co-author of the paper, Dr Anna Maria Mandalari said that TP-Link, the manufacturer of one of the affected devices, the Tapo smart plug, has acknowledged the identified issue and taken proactive steps by releasing a new firmware to address the vulnerability. This impacted millions of Tapo devices worldwide. 

The study can be extended to other types of attacks, highlighting the importance of continuously auditing, and helping IoT device manufacturers to release security-by-design devices and authorities to test and enforce stringent security standards.

For more information, please see links below.

• Read the paper
• Studying the Internet of Things and Security and Privacy at UCL
• Dr Anna Maria Mandalari profile