Dissecting IoT Device Provisioning Process

We examine in detail the provisioning process used by many common, consumer-grade Internet of Things (IoT) devices. We find that this provisioning process involves the IoT device, the vendor's cloud-based server, and a vendor-provided mobile app. In order to better understand this process, we develop two toolkits. IoT-Dissect I enables us to decrypt and examine the messages exchanged between the IoT device and the vendor's server, and between the vendor's server and a vendor-provided mobile app. IoT-Dissect II permits us to reverse engineer the vendor's mobile app and observe its operation in detail. We find several potential security issues with the provisioning process and recommend ways to mitigate these potential problems. Further, based on these observations, we conclude that it is likely feasible to construct a vendor-agnostic IoT home gateway that will automate this largely manual provisioning process, isolate IoT devices on their own network, and perhaps open the tight association between an IoT device and the vendor's server.