Standardization could lead to increased security while maintaining interoperability between standard-compliant products from different manufacturers. This assumption should be no different for the Internet-of-Things (IoT) landscape, and thus we decided to look at the use of the security from a longstanding industry de facto standard: Bluetooth LE (BLE). We developed an automated sniffing tool to analyze the initial BLE pairing process between a device and its smartphone app, looking for hints on the use of standard compliant security mechanisms. We found the number of devices facilitating standard mechanisms with higher levels of security –or any standard conforming mechanism at all– alarmingly low: Less than 5% of devices actually implemented a secure pairing method prescribed in the BLE standard. Noteworthy, some implementations went as far as ’replicating‘ or ’imitating‘ a higher-level security pairing process within their own protocol inside their proprietary smartphone apps instead of relying on the standardized implementation supported by the smartphone’s OS.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Checking the Impact of Security Standardization — A Case Study on Bluetooth LE Pairing of Internet-of-Things Devices

  • Henrich C. Pöhls,
  • Lukas Steffens

摘要

Standardization could lead to increased security while maintaining interoperability between standard-compliant products from different manufacturers. This assumption should be no different for the Internet-of-Things (IoT) landscape, and thus we decided to look at the use of the security from a longstanding industry de facto standard: Bluetooth LE (BLE). We developed an automated sniffing tool to analyze the initial BLE pairing process between a device and its smartphone app, looking for hints on the use of standard compliant security mechanisms. We found the number of devices facilitating standard mechanisms with higher levels of security –or any standard conforming mechanism at all– alarmingly low: Less than 5% of devices actually implemented a secure pairing method prescribed in the BLE standard. Noteworthy, some implementations went as far as ’replicating‘ or ’imitating‘ a higher-level security pairing process within their own protocol inside their proprietary smartphone apps instead of relying on the standardized implementation supported by the smartphone’s OS.