An Automated Approach for Privacy Leakage Identification in IoT Apps

TL;DR

This paper introduces Taint-Things, an automated static analysis tool that efficiently detects privacy leaks in IoT apps with improved speed and accuracy, aiding security audits.

Contribution

The paper presents a novel automated static analysis approach and tool, Taint-Things, which enhances detection speed and precision for privacy leaks in IoT applications.

Findings

Taint-Things achieves at least 4 times faster performance than existing tools.

It accurately identifies all tainted flows reported by state-of-the-art tools.

The tool reduces false positives through enhanced flow, path, and context sensitivity.

Abstract

This paper presents a fully automated static analysis approach and a tool, Taint-Things, for the identification of tainted flows in SmartThings IoT apps. Taint-Things accurately identifies all tainted flows reported by one of the state-of-the-art tools with at least 4 times improved performance. Our approach reports potential vulnerable tainted flows in a form of a concise security slice, where the relevant parts of the code are given with the lines affecting the sensitive information, which could provide security auditors with an effective and precise tool to pinpoint security issues in SmartThings apps under test. We also present and test ways to add precision to Taint-Things by adding extra sensitivities; we provide different approaches for flow, path and context sensitive analyses through modules that can be added to Taint-Things. We present experiments to evaluate Taint-Things by running it on a SmartThings app dataset as well as testing for precision and recall on a set generated by a mutation framework to see how much coverage is achieved without adding false positives. This shows an improvement in performance both in terms of speed up to 4 folds, as well as improving the precision avoiding false positives by providing a higher level of flow and path sensitivity analysis in comparison with one of state of the art tools.