  Software vulnerabilities in access control models can represent a serious
threat in a system. In fact, OWASP lists broken access control as number 5 in
severity among the top 10 vulnerabilities. In this paper, we study the
permission model of an emerging Smart-Home platform, SmartThings, and explore
an approach that detects privilege escalation in its permission model. Our
approach is based on Model Driven Engineering (MDE) in addition to static
analysis. This approach allows for better coverage of privilege escalation
detection than static analysis alone, and takes advantage of analyzing
free-form text that carries extra permissions details. Our experimental results
demonstrate a very high accuracy for detecting over-privilege vulnerabilities
in IoT applications
