Published:
2022-12-20Issue:
Vol. 16 No. 2 (2022)Section:
A Research VisionAnálisis de la extracción de datos personales sin autorización de un dispositivo IoT
Analysis of the unauthorized extraction of personal data from an IoT device
Keywords:
Authorization, Geolocation, GPS, IoT, Privacy, WPS (en).Keywords:
Autorización, Geolocalización, GPS, IoT, Privacidad, WPS (es).Downloads
Abstract (es)
En este artículo se trabaja la posibilidad de que un dispositivo IoT, transmita datos del usuario sin su permiso explícito. Se construyó un prototipo que recibe el nombre y apellido del usuario a través de una vinculación BlueTooth, y a eso se le adjunta la localización GPS del dispositivo IoT en el lugar que se encuentra y se la transmite al servidor, sin que en ningún momento se le pida permiso al usuario. La prueba se hizo con una tablet sin geolocalizador (ya que la geolocalización la proveía el prototipo IoT con un módulo GPS) y como resultado se hicieron varias transmisiones a un servidor remoto con la posición y el nombre del usuario, demostrando que era posible conseguir esos datos, (que tradicionalmente se precisan permisos para tener acceso) y transmitirlos sin un permiso del usuario.
Abstract (en)
In this paper, we work on the possibility that an IoT device sends user data without explicit permission. A prototype was built that receives the user's first and last name through a BlueTooth connection, and to that is attached the GPS location of the IoT device in the place it is located and transmits it to the server, without being informed at any time to ask the user for permission. The test was done with a tablet without a geolocator (since geolocation was provided by the IoT prototype with a GPS module) and as a result, several transmissions were made to a remote server with the position and name of the user, proving that it was possible to achieve these data, (which traditionally requires permissions to access) and send it without user permission.
References
F. Xia, L. T. Yang, L. Wang, A. Vinel. “Internet of things”, International Journal of Communication Systems, vol. 25, no. 9, pp. 1101, 2012. https://doi.org/10.1002/dac.2417
C. Zhang, R. Green, “Communication security in internet of thing: preventive measure and avoid DDoS attack over IoT network”, in Proceedings of the 18th Symposium on Communications & Networking, pp. 8–15, 2015.
C. Gibler, J. Crussell, J. Erickson, H. Chen, “Androidleaks: automatically detecting potential privacy leaks in android applications on a large scale”, in International Conference on Trust and Trustworthy Computing, pp. 291–307, Springer, 2012. https://doi.org/10.1007/978-3-642-30921-2_17
T. Yu, V. Sekar, S. Seshan, Y. Agarwal, C. Xu, “Handling a trillion (unfixable) flaws on a billion devices: Rethinking network security for the internet-of-things”, in Proceedings of the 14th ACM Workshop on Hot Topics in Networks, pp. 1–7, 2015.
J. Min, S. Wang, K. Yi. “Location based services for mobiles: Technologies and standards”, 2008.
ublox, “Neo-6 series u-blox 6 GPS modules”. [online]. Available: https://www.u-blox.com/en/product/neo-6-series
C. A. González González, F. Arévalo Tapias, y J. Hernández Gutiérrez, “Análisis de seguridad en redes LPWAN para dispositivos IoT”, Rev. Vínculos, vol. 16, no. 2, pp. 252–261, 2019. https://doi.org/10.14483/2322939X.15712
Arduino, “Arduino home page”. [online]. Available: https://www.arduino.cc/
Android, “Manifest.permission”. [online]. Available: https://developer.android.com/reference/android/Manifest.permission
Amazon, “Alexa internet website terms of use and end user license agreement”. [online]. Available: https://www.alexa.com/help/terms
Amazon, “Alexa internet privacy notice”. [online]. Available: https://www.alexa.com/help/privacy
How to Cite
APA
ACM
ACS
ABNT
Chicago
Harvard
IEEE
MLA
Turabian
Vancouver
Download Citation
Visitas
Downloads
License
Copyright (c) 2022 Visión electrónica
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
1.png)
Attribution-NonCommercial 4.0 International
.jpg)
