A Survey on Sensor-based Threats to Internet-of-Things (IoT) Devices and Applications

• Sensors let IoT devices sense their surroundings and act autonomously, supporting applications from healthcare and home appliances to industry and smart cities.Source: §I · p. 1
• Sensor attacks can transfer malicious code or trigger malware,, capture personal information –, and extract encryption keys.Source: §I · p. 1
• Sensor-based threats pose significant risks because manufacturers may not recognize them, while easy access and limited safeguards make attacks easier to execute –.Source: §I · p. 1
• The survey examines IoT OS sensor-management shortcomings, taxonomizes threats, reviews defenses and their limitations, and outlines open research directions.Source: §I · pp. 1–2

II. BACKGROUND: COMPONENTS OF IOT

• IoT device architecture comprises sensing, network, data-processing, and application layers.Source: §II · p. 2, Figure 1 · p. 3

A. Sensing Layer

• The sensing layer collects real-world data through sensors, often connected via sensor hubs that forward data to the device’s processing unit.Source: A. Sensing Layer · p. 2

1) Motion Sensors:

• Motion sensors measure device motion and orientation, distinguishing linear displacement from angular or rotational displacement.Source: 1) Motion Sensors · p. 2

2) Environmental Sensors:

• Environmental sensors detect changes in a device’s surroundings so it can make autonomous decisions, such as in home automation and smart locks.Source: 2) Environmental Sensors · p. 2

3) Position sensors:

• Position sensors determine a device’s physical position or location; magnetic sensors support compass orientation, while GPS supports navigation.Source: 3) Position sensors · p. 3

B. Network Layer

• The network layer transfers sensing-layer data to connected devices using technologies such as Wi-Fi, Bluetooth, Zigbee, Z-Wave, LoRa, and cellular networks.Source: B. Network Layer · p. 3

C. Data Processing Layer

• The data-processing layer analyzes sensing-layer data to make decisions and may store analysis results or share them with connected devices.Source: C. Data Processing Layer · p. 3

D. Application Layer

• The application layer presents data-processing results and executes user-facing tasks across applications such as smart transportation, smart homes, personal care, and healthcare.Source: D. Application Layer · p. 3

III. SENSOR MANAGEMENT SYSTEMS IN IOT OSES

• IoT operating systems use sensor managers to coordinate access across apps and sensors; Android routes app requests through a manager and HAL to sensor drivers.Android requests include sensor parameters and a listener; the manager creates a ListenerService and multiplexes access when multiple apps request one sensor. SmartThings instead uses capability-based selection.Source: §III · pp. 3–4, Figure 2 · p. 4
• Existing systems rely on user consent and protect only selected sensors, so malicious apps can trick users or access unprotected sensors.The paper identifies accelerometers, gyroscopes, and light sensors among sensors that may lack permission controls.Source: §III · p. 4

IV. SENSOR-BASED THREATS TO IOT DEVICES

• Sensor-based threats are malicious actions that exploit sensors, and the survey reviews attack scenarios reported by researchers, –.Source: §IV · p. 4
• The taxonomy groups threats into information leakage, malicious sensor patterns or commands, false sensor data injection, and denial-of-service.Threats may be passive, such as observing device behavior, or active, such as injecting false data or transferring malicious sensor code.Source: §IV · p. 4

A. Information Leakage

• Information leakage can expose passwords, cryptographic secret keys, or credit-card information, using one sensor or multiple sensors together.Examples include microphone eavesdropping and keystroke inference using gyroscope and audio sensors.Source: A. Information Leakage · p. 4

• Typing changes device orientation and sensor readings, which can be used to infer inputs on the device or from a nearby device.Source: 1) Keystroke inference · p. 4
• Light-sensor intensity changes with touchscreen interaction and can be matched to a database to decode keystrokes; PIN Skimming uses ambient-light and RGBW sensors.A fast photosensor can also capture CRT display signals for text reconstruction.Source: 1) Keystroke inference · pp. 4–5
• Motion-sensor readings vary with input location, force, and device orientation; accelerometer patterns can be matched to keystrokes or detect touchscreen areas.Gyroscope data can be combined with tap sounds, accelerometer and gyroscope data can be combined, and smartwatch motion data can reveal phone keystrokes.Source: 1) Keystroke inference · p. 5
• Acoustic attacks infer keys from recorded typing sounds using signal analysis, machine learning, or training data, with some methods also using multiple microphones or timing cues.The survey also describes inferring printed text from printer sounds and reconstructing 3-D printer designs from acoustic features.Source: 1) Keystroke inference · pp. 5–6
• Camera-based attacks combine video, touch sounds, hand position, or screen reflections to infer PINs, typed text, or unlock patterns.Examples include PIN skimming, filming touchscreens for later transfer, and inferring patterns from screen smudges.Source: 1) Keystroke inference · p. 6
• Magnetic sensors can capture keyboard electromagnetic emissions, which attackers process to infer keystrokes.Source: 1) Keystroke inference · p. 6

• Task inference reveals an ongoing device task or application by using sensor deviations to infer the running process.Source: 2) Task inference · p. 6
• Magnetic-sensor readings can reveal device activity and nearby computer or server hard-drive tasks through changes in magnetic fields.Source: 2) Task inference · pp. 6–7
• Electromagnetic emissions from FPGA-based IoT devices and smart cards can reveal running applications, logic-block states, or tasks –.Source: 2) Task inference · p. 7
• Differential power analysis of IEEE 802.15.4 nodes can reveal encryption-process details and packet-size-related information from sensor power profiles.Source: 2) Task inference · p. 7

3) Location Inference:

• Acoustic reflections in foreground voice audio can fingerprint a user’s location and compromise anonymous VoIP participants’ location privacy.The attack does not depend on characteristic background sounds.Source: 3) Location Inference · p. 7
• Audio recordings can also be compared to verify whether they originated from the same location, regardless of the speakers.Source: 3) Location Inference · p. 7
• Heuristics can identify sensitive locations, including a victim’s home and work, when an adversary controls their personal device.Source: 3) Location Inference · p. 7

4) Eavesdropping:

• A malicious app can stealthily record microphone audio, capturing sensitive information from only the beginning of a call or after identifying a dialed number.The dialed number can be inferred from tones produced by the phone’s touchpad.Source: 4) Eavesdropping · p. 7
• Voice-assistant attacks include malware recording commands for reuse and hidden commands that assistants recognize but people cannot understand.CPVT recordings can be controlled through SMS, Wi-Fi, or sensory channels.Source: 4) Eavesdropping · p. 7
• Gyroscope vibrations caused by acoustic signals can support speaker discrimination and recognition of one-syllable words using signal processing and machine learning.The gyroscope does not cover the full audible range.Source: 4) Eavesdropping · p. 8

B. Transmitting Malicious Sensor Commands

• Sensors can transmit malicious patterns or triggering commands that activate implanted malware or create unexpected communication channels between peripherals.Source: B. Transmitting Malicious Sensor… · p. 8
• Changing light intensity can encode bit streams, while changes in magnetic-field readings can encode distinct malware-triggering messages.A TV screen or laptop monitor can transmit light-based trigger messages.Source: B. Transmitting Malicious Sensor… · p. 8
• Audio commands embedded in songs can trigger malicious apps, and ultrasonic signals or buzzer-carried audio can transfer information or a trojan covertly.Source: B. Transmitting Malicious Sensor… · p. 8

C. False Sensor Data Injection

• False sensor data injection forges or forcefully changes data used by IoT applications, through physical access or covert communication channels.Sensor use can also alter data typed or stored on devices.Source: C. False Sensor Data Injection · p. 8
• Forged GPS signals can disguise a vehicle’s real location, and smartwatch GPS data can likewise be replaced with a false location.Source: C. False Sensor Data Injection · p. 8
• Power analysis can reveal encryption details, including the key, enabling attackers to encrypt false data and replace original data in communications.Spy-sense is another approach: it monitors sensor behavior and covertly deletes or modifies data in active memory.Source: C. False Sensor Data Injection · p. 8

D. Denial-of-Service

• Vibration matched to an accelerometer’s working frequency can force a device off, while sound matching a drone gyroscope’s resonance can disrupt flight control or turn it off.Source: D. Denial-of-Service · pp. 8–9

• The survey finds no comprehensive mechanism able to prevent sensor-based threats, citing diverse sensor characteristics and limited threat knowledge as obstacles.Source: §V · p. 9

Enhancing Existing Sensor Management Systems

• Semadroid makes app sensor use explicit through monitoring and logging, lets users set access and precision policies, and tests unknown apps with mock data.Source: §V · p. 9
• AWare binds sensor-operation requests to user input events; in a lab study, at most 7% of users were tricked, versus 85% on average with prior approaches.AWare increased authorization effort by an average of 2.28 decisions per application, and 1,000 popular apps operated effectively under it.Source: §V · p. 9
• 6thSense uses real-time sensor data and activity-specific context models to classify malicious contexts, detecting threats with approximately 97% accuracy and F-score.The framework was tested with data from 50 real-life users.Source: §V · p. 9

Protecting Sensed Data

• 3% on average versus 57% with state-of-the-art LPPMs: targeted maneuvers reduced white-box location-inference attack success on a real dataset.The maneuvers augment sensor readings with synthetic data and respond to system events to increase reading diversity.Source: §V · pp. 9–10
• Other defenses include public-key encryption for sensor data, AuDroid access control over audio-channel information flows, and SIRO or random pre-charges against side-channel attacks.Public-key encryption and random pre-charges target different risks: data protection and power-analysis attacks, respectively.Source: §V · p. 10

Shortcomings of Proposed Security Mechanisms

• Proposed defenses remain constrained by application-level detection, resource limits, incomplete sensor coverage, permissive user decisions, and encryption’s power cost.The survey concludes that autonomous policy enforcement, coverage of all sensors, and efficient power-performance trade-offs remain unresolved.Source: §V · p. 10

Study of Expected Functionality to Identify Threats

• Researchers should study expected IoT functionality and user behavior to identify threats, addressing limited architectural knowledge and users’ limited awareness of sensor-based risks.The section also proposes usability studies to understand how users can improve sensor access control.Source: §VI · pp. 10–11

Adoption of Standard Security Mechanisms

• A common development platform could support universal sensor defenses, including shared mechanisms for sensor-data authentication and legitimate-access authorization.Different IoT operating systems manage sensors dissimilarly, making a general security scheme difficult to converge on.Source: §VI · p. 11

Fine-grained Control of Sensors

• Fine-grained sensor management is needed because installation-time permissions leave users with limited ongoing control and may cover only some sensors.Granting permission for microphone, camera, or GPS can automatically grant access to other sensors, and both permission-enforced and unenforced sensors are vulnerable.Source: §VI · p. 11

Control Sharing of Data among Sensors

• Securing sensor-to-sensor communication is important for end-to-end protection and avoiding information leakage from sensitive personal data.The section notes a shift toward machine-to-machine communication as the number of sensors grows.Source: §VI · p. 11

Protect Sensor Data when at Rest

• Sensor-data authenticity and secure internal data flow may be supported by encryption, hardware security features, and research into blockchain-based attestation.Tampered sensor data can affect normal application behavior; ARM TrustZone is given as a possible hardware feature.Source: §VI · p. 11

Prevent Leakage of Secret Data

• Sensor behavior patterns that vary by activity may help detect ongoing tasks and prevent information leakage.The section proposes observing these patterns as a way to identify information accessed by a task.Source: §VI · p. 11

Protect Integrity of Sensor Operations; Adoption of Intrusion Mechanisms to Detect Attacks

• Automated tools are needed to detect adversary-controlled sensors and risky access-control configurations, while ML and NN classifiers are proposed for distinguishing legitimate from illegal sensing.Dangerous configurations may enable trusted programs to perform risky operations that compromise system integrity.Source: §VI · p. 11

Summary

• IoT security research should account for IoT-specific characteristics, which may guide the design of new protection mechanisms.The section presents these characteristics as distinct from those of commodity systems.Source: §VI · p. 11

VII. CONCLUSION

• The survey analyzes recent sensor-based threats and how they can exploit sensors in IoT devices.It also provides an overview of sensors and sensor-management systems in commodity IoT operating systems.Source: §VII · p. 11
• The paper summarizes proposed security approaches and discusses challenges for future research on IoT sensor security.Source: §VII · p. 11
• The authors present documenting recent sensor-based threats as a way to motivate comprehensive security schemes for IoT devices.Source: §VII · p. 11