Home-based IoT devices have a bleak reputation regarding their security practices. On the surface, the insecurities of IoT devices seem to be caused by integration problems that may be addressed by simple measures, but this work finds that to be a naive assumption. The truth is, IoT deployments, at their core, utilize traditional compute systems, such as embedded, mobile, and network. These components have many unexplored challenges such as the effect of overprivileged mobile applications on embedded devices.

Our work proposes a methodology that researchers and practitioners could employ to analyze security properties for home-based IoT devices. We evaluate 45 devices using our methodology and demonstrate how insecure components affect the overall security of IoT deployment. To make this analysis transparent and easier to adapt by the community, we provide a public portal to share our evaluation data and invite the community to contribute their independent findings at https://YourThings.info.