@article {ferraris2020, title = {A Trust Model for Popular Smart Home Devices}, journal = {International Journal of Information Security}, year = {2020}, publisher = {Springer}, abstract = {

Nowadays, smart home devices like Amazon Echo and Google Home have reached mainstream popularity.
Being in the homes of users, these devices are intrinsically intrusive, being able to access details such as users{\textquoteright} name, gender, home address, calendar appointments and others.
There are growing concerns about indiscriminate data collection and invasion of user privacy in smart home devices, but studies show that perceived benefits are exceeding perceived risks when it comes to consumers.
As a result, consumers are placing a lot of trust in these devices, sometimes without realizing it.
Improper trust assumptions and security controls can lead to unauthorized access and control of the devices, which can result in serious consequences.
In this paper, we explore the behaviour of devices such as Amazon Echo and Google Home in a smart home setting with respect to trust relationships and propose a trust model to improve these relationships among all the involved actors.
We have evaluated how trust was built and managed from the initial set up phase to the normal operation phase, during which we performed a number of interaction tests with different types of users (i.e. owner, guests).
As a result, we were able to assess the effectiveness of the provided security controls and identify potential relevant security issues.\  In order to address the identified issues, we defined a trust model and propose a solution based on it for further securing smart home systems.

}, keywords = {Internet of Things, privacy, security, Smart Home, Trust}, issn = {1615-5262}, doi = {10.1007/s10207-020-00519-2}, url = {https://link.springer.com/article/10.1007/s10207-020-00519-2}, author = {Davide Ferraris and Daniel Bastos and Carmen Fernandez-Gago and Fadi El-Moussa} } @article {IonnaisPanosMihalisAlcarazLopez2018, title = {Survey of IoT-enabled Cyberattacks: Assessing Attack Paths to Critical Infrastructures and Services}, journal = { IEEE Communications Surveys and Tutorials}, volume = {20}, year = {2018}, month = {07/2018}, pages = {3453-3495}, publisher = {IEEE}, abstract = {

As the deployment of Internet of Things (IoT)\ is experiencing an exponential growth, it is no surprise that\ many recent cyber attacks are IoT-enabled: The attacker initially\ exploits some vulnerable IoT technology as a first step towards\ compromising a critical system that is connected, in some way,\ with the IoT. For some sectors, like industry, smart grids,\ transportation and medical services, the significance of such\ attacks is obvious, since IoT technologies are part of critical backend\ systems. However, in sectors where IoT is usually at the enduser\ side, like smart homes, such attacks can be underestimated,\ since not all possible attack paths are examined. In this paper\ we survey IoT-enabled cyber attacks, found in all application\ domains since 2010. For each sector, we emphasize on the latest,\ verified IoT-enabled attacks, based on known real-world incidents\ and published proof-of-concept attacks. We methodologically\ analyze representative attacks that demonstrate direct, indirect\ and subliminal attack paths against critical targets. Our goal is\ threefold: (i) To assess IoT-enabled cyber attacks in a risk-like\ approach, in order to demonstrate their current threat landscape;\ (ii) To identify hidden and subliminal IoT-enabled attack paths\ against critical infrastructures and services, and (iii) To examine\ mitigation strategies for all application domains.

}, keywords = {Critical Infrastructures, Cyber Attacks, Intelligent Transportation Systems, Internet of Things, SCADA, Smart grids, Smart Home, Smart Medical Systems}, issn = {1553-877X}, doi = {https://doi.org/10.1109/COMST.2018.2855563}, url = {https://ieeexplore.ieee.org/document/8410404}, author = {Ioannis Stellios and Panayiotis Kotzanikolaou and Mihalis Psarakis and Cristina Alcaraz and Javier Lopez} }