Internet of ThingsRating Security of Internet-Connected Devices

If you’re in the market for an internet-connected garage door opener, doorbell, thermostat, security camera, yard irrigation system, slow cooker—or even a box of connected light bulbs—a new website can help you understand the security issues these shiny new devices might bring into your home.

Consumer-grade internet of things (IoT) devices aren’t exactly known for having tight security practices. Georgia Tech says that to save purchasers from finding that out the hard way, researchers from the Georgia Institute of Technology and the University of North Carolina at Chapel Hill have done security assessments of representative devices, awarding scores ranging from 28 (an F) up to 100.

Their site, https://yourthings.info, shows rankings for 45 devices, though a total of 74 have been evaluated. That’s hardly a complete roundup of the tens of thousands of device types available, but the big idea behind the project is to help consumers understand important issues before connecting a new IoT helper to their home networks.

“A lot of people who purchase these devices don’t fully understand the risks associated with installing them in their homes,” said Georgia Tech Graduate Research Assistant Omar Alrawi. “We want to provide insight by providing security ratings for the devices we have tested.”

Voice-activated personal digital assistants are among the most common home IoT devices, but if not properly installed, they can provide unwanted access to the home networks to which they are connected, warned Manos Antonakakis, a cybersecurity researcher and associate professor in Georgia Tech’s School of Electrical and Computer Engineering.

“If you have an IoT app that is vulnerable, whoever has access to that app not only has access to your personal information, but could also jump into your home and eavesdrop on your conversations,” he said. “Anything that is connected in the home in proximity to the personal assistant could also interact with it. If there is vulnerable software running on the device, it could be exploited within the home network.”

One problem is that most home networks were set up for simple tasks like sharing printers, so they lack the kind of security controls found on enterprise systems at businesses, noted Chaz Lever, a research engineer in Georgia Tech’s School of Electrical and Computer Engineering.

“The home network is beginning to look a lot like enterprise networks with a range of services that have to be protected,” Lever said. “But the average consumer is not going to be equipped to do that. They don’t have an IT staff that is doing audits and securing the devices. If these devices are not secure out of the box and there aren’t easy ways to secure them, they can open the home up to a new vector of attacks.”

To give consumers helpful advice, the researchers developed a framework for analyzing security components of the devices. In what is believed to be the first effort to objectively assess the risks of IoT equipment, they examined the devices themselves, how the devices communicate with cloud servers, the applications running on the devices, and the cloud-based end-points.