论文标题
智能家庭助理应用程序的安全审查过程：首次查看和案例研究
Security Vetting Process of Smart-home Assistant Applications: A First Look and Case Studies
论文作者
论文摘要
亚马逊Alexa和Google Home等智能家庭助理系统的受欢迎程度导致了蓬勃发展的第三方应用程序市场（两家商店中有70,000多个应用程序）。尽管现有作品在这些系统中揭示了安全问题，但尚不清楚如何帮助应用程序开发人员执行安全要求。在本文中，我们进行了初步案例研究，以检查Amazon Alexa和Google Home App商店采用的安全审查机制。侧重于Alexa/Google Cloud和第三方应用程序服务器（即端点）之间的身份验证机制，我们显示当前的安全审查不足，因为无法有效地检测和通知开发人员错误。弱身份验证将使攻击者能够欺骗云以将数据插入/从应用程序端点插入/检索数据。我们通过伦理概念验证实验来验证攻击。为了确认脆弱的应用程序确实通过了安全审核并进入市场，我们开发了一种基于启发式的搜索方法。我们发现219个现实世界中的Alexa端点具有脆弱性，其中许多与控制智能家居设备和电子汽车的关键应用有关。我们已经通知了亚马逊和Google有关我们的发现，并提出了我们的建议来减轻问题。
The popularity of smart-home assistant systems such as Amazon Alexa and Google Home leads to a booming third-party application market (over 70,000 applications across the two stores). While existing works have revealed security issues in these systems, it is not well understood how to help application developers to enforce security requirements. In this paper, we perform a preliminary case study to examine the security vetting mechanisms adopted by Amazon Alexa and Google Home app stores. With a focus on the authentication mechanisms between Alexa/Google cloud and third-party application servers (i.e. endpoints), we show the current security vetting is insufficient as developer mistakes can not be effectively detected and notified. A weak authentication would allow attackers to spoof the cloud to insert/retrieve data into/from the application endpoints. We validate the attack through ethical proof-of-concept experiments. To confirm vulnerable applications have indeed passed the security vetting and entered the markets, we develop a heuristic-based searching method. We find 219 real-world Alexa endpoints that carry the vulnerability, many of which are related to critical applications that control smart home devices and electronic cars. We have notified Amazon and Google about our findings and offered our suggestions to mitigate the issue.
