  Smart homes contain diverse sensors and actuators controlled by IoT apps that
provide custom automation. Prior works showed that an adversary could exploit
physical interaction vulnerabilities among apps and put the users and
environment at risk, e.g., to break into a house, an adversary turns on the
heater to trigger an app that opens windows when the temperature exceeds a
threshold. Currently, the safe behavior of physical interactions relies on
either app code analysis or dynamic analysis of device states with manually
derived policies by developers. However, existing works fail to achieve
sufficient breadth and fidelity to translate the app code into their physical
behavior or provide incomplete security policies, causing poor accuracy and
false alarms. In this paper, we introduce a new approach, IoTSeer, which
efficiently combines app code analysis and dynamic analysis with new security
policies to discover physical interaction vulnerabilities. IoTSeer works by
first translating sensor events and actuator commands of each app into a
physical execution model (PeM) and unifying PeMs to express composite physical
execution of apps (CPeM). CPeM allows us to deploy IoTSeer in different smart
homes by defining its execution parameters with minimal data collection.
IoTSeer supports new security policies with intended/unintended physical
channel labels. It then efficiently checks them on the CPeM via falsification,
which addresses the undecidability of verification due to the continuous and
discrete behavior of IoT devices. We evaluate IoTSeer in an actual house with
14 actuators, six sensors, and 39 apps. IoTSeer discovers 16 unique policy
violations, whereas prior works identify only 2 out of 16 with 18 falsely
flagged violations. IoTSeer only requires 30 mins of data collection for each
actuator to set the CPeM parameters and is adaptive to newly added, removed,
and relocated devices.
