A case of smart devices that compromise home cybersecurity

Abstract

The importance of cybersecurity is widely acknowledged as paramount for virtually every computerized application domain. Not only is it concerned with the protection of digital assets and resources from illegitimate use, but it is also essential to people’s privacy, for example for shielding their personal data, and even to their safety, for example for safeguarding the functioning of devices that may potentially harm humans.

This article investigates the extent to which cybersecurity is properly ensured of IoT devices (also commonly termed smart devices) which are modern, that is, trendy at present, then also inexpensive, hence useful to evaluate a price-cybersecurity ratio, and, finally, commonly used. While it is clear that innumerable such devices exist, the findings reported below focus on the case of the Tapo ecosystem by TP-Link, which features cheap Amazon best sellers at present.

Our findings suggest that effective Vulnerability Assessment and Penetration Testing sessions can be carried out on such devices by following the PETIoT kill chain. Findings also demonstrate that as many as six devices of the TAPO ecosystem suffer four previously unknown (so called zero-day) vulnerabilities, which we filed as four CVEs on MITRE’s public database. Following Responsible Disclosure with TP-Link, vulnerabilities were publicly disclosed only after the vendor released appropriate fixes. All vulnerabilities were found using freeware, requiring over 600 lines of exploitation code.