  This paper presents a fully automated static analysis approach and a tool,
Taint-Things, for the identification of tainted flows in SmartThings IoT apps.
Taint-Things accurately identifies all tainted flows reported by one of the
state-of-the-art tools with at least 4 times improved performance. Our approach
reports potential vulnerable tainted flows in a form of a concise security
slice, where the relevant parts of the code are given with the lines affecting
the sensitive information, which could provide security auditors with an
effective and precise tool to pinpoint security issues in SmartThings apps
under test. We also present and test ways to add precision to Taint-Things by
adding extra sensitivities; we provide different approaches for flow, path and
context sensitive analyses through modules that can be added to Taint-Things.
We present experiments to evaluate Taint-Things by running it on a SmartThings
app dataset as well as testing for precision and recall on a set generated by a
mutation framework to see how much coverage is achieved without adding false
positives. This shows an improvement in performance both in terms of speed up
to 4 folds, as well as improving the precision avoiding false positives by
providing a higher level of flow and path sensitivity analysis in comparison
with one of state of the art tools.
