  Internet of Things (IoT) devices are becoming increasingly important. These
devices are often resource-limited, hindering rigorous enforcement of security
policies. Assessing the vulnerability of IoT devices is an important problem,
but analyzing their firmware is difficult for a variety of reasons, including
requiring the purchase of devices. This paper finds that analyzing companion
apps to these devices for clues to security vulnerabilities can be an effective
strategy. Compared to device hardware and firmware, these apps are easy to
download and analyze. A key finding of this study is that the communication
between an IoT device and its app is often not properly encrypted and
authenticated and these issues enable the construction of exploits to remotely
control the devices. To confirm the vulnerabilities found, we created exploits
against five popular IoT devices from Amazon by using a combination of static
and dynamic analyses. We also did a larger study, finding that analyzing 96
popular IoT devices only required analyzing 32 companion apps. Among the
conservative findings, 50% of the apps corresponding to 38% of the devices did
not use proper encryption techniques to secure device to companion app
communication. Finally, we discuss defense strategies that developers can adapt
to address the lessons from our work.
