How can I prevent my device leaking sensitive data through traffic fingerprinting?

Question

According to the recent paper A Smart Home is No Castle: Privacy Vulnerabilities of Encrypted IoT Traffic, many smart home devices can be 'fingerprinted' by their connection patterns. Since most devices connect to a small set of URLs when they're invoked, it's possible for an attacker (or an unfriendly ISP) to determine when you use each device.

For example, they tracked the traffic going to the Alexa servers from a home router (the URLs they used are in Figure 1 in the paper):

They also show that a similar principle can be used to determine when a sleep monitor is used (and hence when you wake up/go to sleep), or when a smart switch is toggled.

Clearly, it's disturbing that you can get so much information from a device, despite it being encrypted. It seems harder to get much information from computer traffic, because the servers accessed are much more diverse, but for an IoT device that only 'calls home' to a specific server, it appears easy to track which device was used, and when.

Since many countries store metadata such as this, it's feasible that they would be able to use this method themselves to determine your activity, and the same amount of data would be leaked to any network-level attacker.

Are there any ways to prevent traffic from being fingerprinted in this way, or at least to reduce the amount of sensitive data that can be extracted?

Answer 1

What are the steps to the privacy leak described?

Basically there are three parts in getting the information described in the paper.

1. An interested party recording the outgoing traffic (2)
2. Said party being able to split the traffic streams (4.1)
3. Analyzing the different traffic streams
   • Identifying device (type) (4.2)
   • Analyzing device pattern (5)

Recording the outgoing traffic

While the attacker is simply assumed in the paper as prerequisite this is already quite the hurdle.

Specifically, an adversary in this model can observe and record all wide-area network traffic, including traffic to and from home gateway routers.

That's not a lot of potential attackers. Basically, that's the ISP you use to connect to the Internet, the WAN carriers and interested intelligence agencies. Thankfully the one with the easiest access, your ISP, is likely not interested since it doesn't really help their business model. On the other hand, the ISPs are the ones courts can compel to record and provide these information.

We assume that ISPs are typically uninterested in performing targeted active attacks on individual users.

Whilst not being interested in these attacks, they might very well be forced to provide the information. Of course, that depends on the laws of the country they operate in.

Assuming you haven't gotten a court to compel your ISP or attracted the attention of an intelligence agency with the necessary capabilities to record the traffic the likeliest attacker that can use the further steps would be a compromised home router.

Splitting traffic streams

The split into traffic streams is assumed to be performed by grouping them by the external communication partner, e.g. the services the IoT devices communicate with. The aforementioned attacker obviously has the target IP, after all the information is needed to get the information where they belong.

A good possibility that Mawg describes in his answer is the use of a VPN service provider. With the use of a VPN the ISP or otherwise capable attacker cannot deduce the actual target of the communication since every communication is addressed at the VPN service provider. However, that enables another party to be the attacker of this model—the VPN service provider.

By using a VPN router you essentially enable another party to be this attacker. The advantage of the TOR network as mentioned in Sylvain's answer is the obfuscation of streams while simultaneously not enabling another player to the proverbial man-in-the-middle. If you're using TOR you'll need either really bad luck in TOR nodes or really really interested parties to enable the attacker to identify the streams.

This Wiki article subsection describes the theoretical possibilities to still identify source and target of TOR communications. Although, these methods require serious resources and access to the basic Internet structure, which again brings us back to the same group of potential attackers than mentioned before. However, they would need even more motivation to invest the effort to track that traffic.

If you VPN with either solution over jurisdictions (continents or at least countries, not counties or the like) you are likely safe from court proceedings.

Summary:

• When using a dedicated VPN provider you have to weigh the trustworthiness of said provider versus your own ISP. This just moves the ability of attack to another party.
• When using TOR consider how it works and who owns (and pays for) the exit nodes
• Either solution adds significant hurdles in splitting the traffic stream.
• Either solution will likely make court proceedings to get the data useless when spanning several jurisdictions. ¹

Analyzing the different traffic streams

This is actually trivial for anyone who has jumped the first two hurdles. Unless you have a home-made solution the traffic patterns of any IoT device can be easily recorded and afterwards recognized when the data set is sufficient.

However, as Sean describes in his answer you can still muddy the waters. If you device sends additional spoofing data or bulk transmits data that does not have to be real-time the pattern analysis gets really complicated.

---

_{1 not a lawyer}

Answer 2

If the service you use can tolerate some latency, routing the traffic of your device through the TOR network would make the destination address impossible to determine for your ISP, and the source address (home IP) impossible to determine for the ISP of the server your device is communicating with.

If you have only one device in your home, traffic patterns will still be easily observable by your ISP. To prevent that, the box you use as TOR tunnel entrance for your device could also act as a TOR relay ("middle" node). Then, the traffic coming in and out of your box will make the traffic your device generate harder to isolate.

Answer 3

For devices which are particularly sensitive, a good way to prevent someone from snooping the connection pattern is to generate spoof data, or intentionally skew the connection times (if data need not be uploaded as soon as it is generated).

Importantly, you would need to use static payload sizes, or generate plausibly sized payloads for the dummy data too.

Although this is best performed by the device in question, you may potentially be able to generate sufficiently similar traffic from a 2nd device in your network (either an SBC, or a 2nd sleep tracker or whatever).

Fundamentally, if your data is sensitive, someone will attack the weakest part in the chain, and that may not be the transport later.

Answer 4

While I like the use of TOR, you might not be able to configure every device to use it.

The simplest way would be to do something at the router, where all traffic, from all devices, enters and exits your house.

I would recommend a VPN router. This will encrypt all data leaving your home, so that no one, even you ISP, can see its destination. Data travels, with encrypted destination, to the VPN server, which then unencrypts it and routes the data for you, sending any responses encrypted.

There's a bunch of them on Amazon. Here's one for $58.

What This Product Does

TP-LINK's SafeStream Gigabit Broadband VPN Router TL-R600VPN supports Gigabit Ethernet connections for both WAN and LAN ports, which guarantees high-speed wired connectivity. It also integrates multiple VPN protocols and high-security VPN capabilities to enable employees’ remote connections to their main office as if they were in the office. Besides, TL-R600VPN’s abundant security strategies such as SPI Firewall, DoS Defense and IP-MAC Binding help protecting your network against most known attacks. TL-R600VPN is an ideal solution for small offices that need cost-effective and reliable VPN solutions.

High-Security VPN Capabilities

TL-R600VPN supports IPsec and PPTP VPN protocols and can handle IPsec/PPTP/L2TP pass-through traffic as well. The maximum throughput can reach 20 Mbps. It also features a built-in hardware-based VPN engine allowing the router to support and manage up to 20 LAN-to-LAN IPsec and 16 PPTP VPN connections. Advanced VPN features include:

DES/3DES/AES128/AES192/AES256 encryption
MD5/SHA1 authentication
Manual/IKE key management
Main/Aggressive negotiation modes

Abundant Security Features

For defense against external threats, TL-R600VPN features SPI Firewall function. Additionally, it can automatically detect and block Denial of service (DoS) attacks such as TCP/UDP/ICMP Flooding, Ping of Death and other related threats. Moreover, this router provides IP/MAC/Domain name filtering functions, which forcefully prevent attacks from intruders and viruses.

For applications such as FTP, TFTP, H.323 and RTSP which are not well compatible with NAT, TL-R600VPN offers administrators an one-click activation of ALG choices corresponding to the forementioned applications.

It's not clear whether you have to pay for the use of the VPN server. If you do, there is also a router which supports TOR for $99.99 (just imagine what you cold do with that extra penny ;-) I must admit, that one does look good. - read the full spec, which is too extensive to quote here.