  We examine in detail the provisioning process used by many common,
consumer-grade Internet of Things (IoT) devices. We find that this provisioning
process involves the IoT device, the vendor's cloud-based server, and a
vendor-provided mobile app. In order to better understand this process, we
develop two toolkits. IoT-Dissect I enables us to decrypt and examine the
messages exchanged between the IoT device and the vendor's server, and between
the vendor's server and a vendor-provided mobile app. IoT-Dissect II permits us
to reverse engineer the vendor's mobile app and observe its operation in
detail. We find several potential security issues with the provisioning process
and recommend ways to mitigate these potential problems. Further, based on
these observations, we conclude that it is likely feasible to construct a
vendor-agnostic IoT home gateway that will automate this largely manual
provisioning process, isolate IoT devices on their own network, and perhaps
open the tight association between an IoT device and the vendor's server.
