Researchers block ISPs from spying through your smart devices

A university team has demonstrated a way to stop your ISP tracking your home life through your IoT gadgets.

Researchers have found a simple way to prevent ISPs from spying on you through your Internet of Things (IoT) devices.

IoT and smart home products are becoming more common in households worldwide. Whether it be Amazon's Alexa voice assistant, Google Home, or smart lighting systems, IoT has become an established industry in itself with countless products now on the market.

The majority of connected devices require Internet access to function, and when this avenue is carved into your home, there is also the risk of compromise, spying, and data theft.

Shodan is a prime example of IoT security gone wrong. You can use the search engine to find open ports and look in on surveillance cameras around the world in both businesses and households, and it was only this week that someone posted thousands of default credentials online which can be used to compromise widely-used IoT products.

However, cyberattackers do not encapsulate the full threat to your privacy that IoT devices can create. Instead, your Internet Service Provider (ISP) may also be able to use them to burrow their way into your private life.

According to researchers Noah Apthorpe, Dillon Reisman, Srikanth Sundaresan, Arvind Narayanan and Nick Feamster from Princeton University, it takes only a small amount of smart home traffic metadata to detect and track home activities.

The team's paper (.PDF), "Spying on the Smart Home: Privacy Attacks and Defenses on Encrypted IoT Traffic," suggests that by fingerprinting devices to identify IoT products or issuing Domain Name System (DNS) queries, ISPs can infer changes in user activities depending on the levels of traffic being generated.

To make matters worse, it does not matter if devices are encrypted -- ISPs or other passive network adversaries would be able to tap in and use this data against you.

The team notes that the "threat" of ISP spying is now more pronounced given the recent changes to the FCC's broadband consumer privacy rules.

In order to discover methods to circumvent snooping, the Princeton researchers created a smart home setup in their lab and tested the Sense Sleep Monitor, Nest Cam Indoor security camera, Amcrest WiFi Security IP camera, Belkin WeMo switch, TP-Link WiFi Smart Plug, Orvibo Smart WiFi Socket, and Amazon Echo.

The team tested these "attacks" on a number of smart home devices, and discovered that all "revealed potentially private user behaviors through network traffic metadata."

"Traffic rates from a Sense sleep monitor revealed consumer sleep patterns, traffic rates from a Belkin WeMo switch revealed when a physical appliance in a smart home is turned on or off, and traffic rates from a Nest Cam Indoor security camera revealed when a user is actively monitoring the camera feed or when the camera detects motion in a user's home," the paper states. "The general effectiveness of this attack across smart home device types and manufacturers motivates the need for technical privacy protection strategies."

The use of a virtual private network (VPN) is an option, but this does not completely mask IoT traffic patterns. Tracking IoT device data becomes more difficult, but not impossible.

"We find that certain common device combinations and user activity patterns minimize the ability of a VPN to obfuscate smart home traffic metadata," the team says.

In what the team calls "traffic shaping," however, there is a solution to the problem.

Independent link padding (ILP), which shapes traffic rates to match scheduled amounts, would prevent metadata traffic changes from being utilized to identify IoT devices.

This would involve either padding or fragmenting packets to a consistent size, or, alternatively, enforcing traffic at a particular rate to prevent any dips or spikes in activity.

In total, 40KB/S would be enough to prevent network snoopers from gaining metadata, which seems a small price to pay for additional protection. If no audio or video-streaming devices are in use, only 7.5KB/S would be required.

"Although ILP shaping is well-understood, it is typically dismissed as requiring excessive latency or bandwidth overhead to be practical for real-world use," the team says. "Our results contradict this common belief. ILP traffic shaping is a reasonable privacy protection method for smart homes with rate-limited broadband access or data caps."