What Do Your Smart Home Devices Reveal About You?

With increasing popularity of smart home devices, there is a growing concern about the security and privacy risks these devices pose to the users. Indeed, researchers have been addressing these risks over the last decade by identifying vulnerabilities and developing solutions. Despite this effort, security break ins and privacy exposures still happen routinely. While most of these privacy exposures are attributed to incorrect system configurations, this paper explores the question whether these smart home systems pose any privacy risks even when they are configured correctly and the adversary has only very minimal capabilities. In particular, the paper presents an experimental study of two very popular smart home devices with an adversary that can passively observe all the message traffic coming in or going out of a home without being able to decrypt the messages or disrupt the traffic in any way. The key finding is that despite this minimal adversary capability, lots of fine-grained, personal information about the users and their homes can still be inferred. Further the privacy exposure becomes much more significant if the adversary has knowledge of some basic contextual information about the home residents. The paper describes these experiments and provides a detailed analysis of the data and privacy exposure.