论文标题
软件更新实践在智能家庭IoT设备上
Software Update Practices on Smart Home IoT Devices
论文作者
论文摘要
众所周知，智能家联网设备是安全和隐私脆弱性的繁殖场。尽管某些物联网供应商部署了更新，但对研究人员的更新过程大多是不透明的。目前尚不清楚设备上哪些软件组件，是否以及何时更新这些组件以及漏洞如何随着更新而变化。这种不透明的使得很难了解物联网设备的软件供应链的安全性。 为了了解物联网设备上的软件更新实践，我们利用了来自现实世界IoT设备的网络流量数据集。我们分析了普通文本HTTP连接的用户代理字符串。我们专注于用户代理中包含的四个软件组件：Curl，Wget，Okhttp和Python-Requeasts。通过跟踪哪些设备在哪些版本上具有哪些组件，我们发现许多物联网设备可能使用这些组件的过时且易受攻击的版本（基于用户代理） - 即使易用的更新版本较小，更新版本可用；对于某些IoT设备而言，更新的推出往往很慢。
Smart home IoT devices are known to be breeding grounds for security and privacy vulnerabilities. Although some IoT vendors deploy updates, the update process is mostly opaque to researchers. It is unclear what software components are on devices, whether and when these components are updated, and how vulnerabilities change alongside the updates. This opaqueness makes it difficult to understand the security of software supply chains of IoT devices. To understand the software update practices on IoT devices, we leverage IoT Inspector's dataset of network traffic from real-world IoT devices. We analyze the User Agent strings from plain-text HTTP connections. We focus on four software components included in User Agents: cURL, Wget, OkHttp, and python-requests. By keeping track of what kinds of devices have which of these components at what versions, we find that many IoT devices potentially used outdated and vulnerable versions of these components - based on the User Agents - even though less vulnerable, more updated versions were available; and that the rollout of updates tends to be slow for some IoT devices.
