Security of Update-related IoT Traffic Evaluation

Abstract

Key Findings at a Glance

1. Introduction

The rapid adoption of IoT devices in smart homes and industrial settings has raised significant security and privacy challenges. To address these issues, IoT devices rely on software or firmware updates, which can be applied when a vulnerability is discovered, either manually by the user or automatically. However, update mechanisms introduce a new attack surface, and the process for firmware and software updates in IoT is non-trivial.

Neglecting the importance of secure software updates can lead to severe consequences, such as the CrowdStrike outage and SolarWinds hack due to faulty updates in 2024 and 2020, respectively. Furthermore, studies show that despite the importance of software updates, several vendors are not adhering to the best security practices. Additionally, certificate deployments across vendors are often inconsistent, with mixed key sizes, long validity windows, and legacy cryptography still present in the traffic.

This research aims to explore the update practices in smart home IoT devices by: (i) identifying update-related patterns, (ii) statistically performing entropy-based characterization, and (iii) evaluating the cryptographic properties of the cipher-suites used.

In this paper, we employ traffic analysis to study update-related IoT communication. Traffic analysis is a group of techniques used to infer details about encrypted traffic by analyzing network-level patterns such as packet directions, timing, and sizes. Unlike deep packet inspection, it does not require decrypting the payload, making it particularly suitable for studying IoT updates where encrypted channels are common.

Contributions

• We conduct a traffic analysis of update-related network communications to investigate the patterns by which IoT devices retrieve software updates.
• We apply multiple entropy metrics (Shannon, Rényi, and Tsallis) to characterize update-related traffic and to distinguish between encrypted and unencrypted communications.
• We assess the strength of encryption of cipher-suites applied to update-related network traffic across different IoT devices.
• We study the corresponding vulnerabilities in update-related traffic, assess their severity, and show the potential capabilities they grant to attackers.
• We made our artifact publicly available at github.com/abusm4n/update_traffic for reproducibility and further research.

2. Related Work

Prior studies have examined IoT device traffic from multiple perspectives. Ren et al. analyzed popular consumer IoT devices and identified large amounts of update-related traffic, but did not evaluate its content or security properties. Other works on IoT update practices have focused mainly on plaintext protocols such as HTTP, without analyzing encrypted channels like HTTPS.

Complementary studies have addressed related aspects. Bauwens et al. provided an overview of over-the-air update mechanisms with emphasis on energy efficiency, whereas Bianchi et al. investigated encrypted traffic classification using inter-flow signals but did not consider update-related traffic. Entropy has also been applied in network security — for example, Yu et al. proposed an entropy-based anomaly detection method. Similarly, Tollefsen and Anshus examined how to detect the arrival of updates at IoT nodes, though without assessing encryption quality or cryptographic strength.

Gap: To the best of our knowledge, no prior work has evaluated the quality of encryption in update-related IoT traffic by combining multiple entropy measures with cipher-suite analysis, while also identifying known vulnerabilities associated with weak and insecure configurations — which is the focus of this paper.

3. Methodology

This section outlines the research questions, traffic analysis framework, and analytical methods. The evaluation combines controlled experiments on ten IoT devices capturing update traffic with retrospective dataset analysis, supporting both internal and external validity.

Research Questions

3.1 Controlled Experiments

We conducted controlled experiments using ten heterogeneous smart IoT devices. For each device, software update processes were initiated under controlled laboratory conditions. During these update procedures, network traffic was captured using Wireshark and tcpdump to capture all update traffic communication.

The devices were selected to represent diverse IoT categories:

• Streaming devices: Apple TV, Fire TV, Sony TV
• Smart assistants: HomePod Mini
• Network cameras: Tapo C100, Tapo C200, Eufy Cam, D-Link Cam, Riolink Cam, Xiaomi Cam

The controlled experiment setup consists of three main steps: (i) update initialization, (ii) acquisition and installation, and (iii) data collection. First, the user agent triggers the update via mobile apps or a computer. Then the software update is checked, downloaded and installed on the dedicated smart IoT device. During steps one and two, the traffic is recorded using a Raspberry Pi 4 configured as a bridged wireless access point.

3.2 Retrospective Experiments

In addition to controlled experiments, retrospective analysis was conducted using previously collected network traffic datasets containing IoT communication traffic. The dataset was generated from the Mon(IoT)r Testbed, a large-scale IoT experimentation platform comprising 81 IoT devices (26 unique models) deployed in the US and the UK, from which 34,586 manually controlled and automated experiments were conducted.

To identify update patterns from the retrospective experiments, we used keywords: software, firmware, update, and download.

3.3 System Model

We develop a system model for network traffic analysis consisting of three main phases: (i) data preprocessing, (ii) metadata extraction, and (iii) parallel execution.

• Data preprocessing: Combining controlled and retrospective datasets in a vendor-agnostic manner.
• Metadata extraction: Processing packet captures focusing on session-level information relevant to IoT device network traffic.
• Parallel execution: Metadata extraction is parallelized and deployed on worker nodes, allowing packets to be processed consecutively.

Encrypted traffic is identified by extracting HTTPS protocol sessions that include the TLS handshake, while unencrypted traffic is identified by extracting HTTP protocol sessions. This process involves using and modifying PyShark to disassemble the client and server hello for the TLS handshake.

3.4 Entropy Analysis

To quantify the uncertainty or randomness in encrypted traffic payloads, we compute three types of entropy: Shannon, Rényi, and Tsallis. These measures provide different perspectives on the distribution of byte-level frequencies.

Where p_i is the probability of the i-th byte value in the packet payload, and b = 256 to match the byte range. We use α = 2 for Rényi entropy.

3.5 Certificate Analysis

We performed a multi-stage analysis of X.509 certificates across the selected IoT devices. Each X.509 certificate was parsed to extract cryptographic and lifecycle metadata (public key algorithm, key size, validity interval) following PKIX/X.509 specifications. Certificates were mapped to security-strength categories using NIST key-size-to-security-bit guidance.

3.6 Cipher-suite Identification

Each cipher-suite was represented in its raw 16-bit hexadecimal identifier as it appears in the handshake. These values were then normalized using the IANA TLS cipher-suite registry. For example: 0xC05C → TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256.

3.7 Vulnerability Analysis

To investigate the vulnerability implications of insecure and weak update-related traffic, we queried the CVE List database using results derived from insecure and weak cryptographic algorithm implementations. We searched for the keywords insecure and weak cipher-suites, following the methods used in prior work on update-related vulnerabilities.

4. Results

4.1 Update-related Traffic Patterns (RQ1)

Controlled Experiments — Devices Used

All experiments were conducted within the same local wireless network (10.42.0.0/24). Firmware updates were manually triggered using an iPhone 13 via the wlan0 interface. Apple TV (1,405,566 packets) and HomePod (767,196 packets) generated significantly higher traffic volumes, while Sony TV (up to date) produced only 51 packets.

Contacted Countries

Update Service Providers

Update retrieval frequently involves third-party cloud and CDN platforms (Amazon, Akamai, Cloudflare, Microsoft, Google), suggesting that IoT vendors rely on external infrastructure for distributing firmware binaries and update metadata.

Protocols Used

Retrospective Experiments

Across the 34,586 experiments, we identified 6,315 update-related traffic flows. Of these, 106 were observed in encrypted channels, 2,415 were observed in cleartext, and 3,794 had undetermined encryption status.

4.2 Entropy Analysis (RQ2a)

Controlled Experiments

Mean entropy (H) for the ten devices: 0.77 (Shannon), 0.74 (Rényi), 0.95 (Tsallis).

Retrospective Experiments

Mean entropy: 0.70 (Shannon), 0.65 (Rényi), 0.92 (Tsallis). Update-related traffic is comparatively less secure than overall traffic, since the average entropy did not exceed 80% for Shannon in both experiments.

Certificate Analysis

4.3 Cipher-suite Evaluation (RQ2b)

We extracted cipher-suites from our experiments, categorized into four security levels: secure, recommended, weak, and insecure.

4.4 Vulnerability Implications (RQ3)

CVE Analysis

Our results show a total of 92 vulnerabilities associated with insecure and weak cipher-suites. Confidentiality is the most highly affected property, and most attack vectors are carried out over the network.

CVSS base scores range from 2.6 to 9.8, with an upward trend in severity over the past five years — suggesting that vulnerabilities linked to weak and insecure cipher usage are becoming increasingly critical.

Top CWE Weaknesses

These weaknesses enable attackers to: manipulate and intercept encrypted communications, execute arbitrary code, steal sensitive information, perform man-in-the-middle attacks, conduct brute-force attacks, and ultimately gain full control over system components.

5. Discussion, Limitations & Future Work

Discussion

Our network-level study shows clear heterogeneity in how smart IoT devices handle software and firmware updates. Entropy analysis (Shannon, Rényi, Tsallis) demonstrates that per-device entropy profiles are informative: Tsallis routinely produces the highest values and appears most robust as a discriminator of high-randomness (likely encrypted) payloads, while Shannon and Rényi provide complementary sensitivity.

A non-trivial fraction of update-related sessions are carried over plain-text channels, and many TLS sessions observe weak or legacy cipher-suites. The insecure and weak cipher-suites may not automatically grant an attacker arbitrary code execution, however negotiation through insecure and weak cipher-suites indicates that the underlying firmware does not use independent integrity checks (like RSA/EDDSA signatures on the binary itself).

By mapping weak/insecure cryptographic configurations to public vulnerability records, we identified 92 CVEs tied to weak cipher usage and an average CVSS base score of 6.1, with a rising trend in severity during the last five years.

Two Practical Implications

1. Entropy-based monitoring (using multiple metrics and device baselines) can be a low-cost, passive signal to flag sessions that merit further inspection, but it must be applied carefully because absolute thresholds vary by device and payload type.
2. Transport security alone, especially when configured using legacy ciphers, cannot be relied upon as the sole guarantor of update integrity or confidentiality; analysis of the firmware can be leveraged to ensure higher security.

Limitations

• Controlled experiments limited to ten IoT devices.
• Retrospective dataset (Mon(IoT)r, 81 devices, 26 models) may not be exhaustive — vendor mixes, firmware versions, and update server configurations in the wild may differ.
• Update identification via keyword filtering (software, firmware, update, download) may produce false positives and false negatives.

Future Work

• Expand the dataset to include additional device populations, geographic regions, and network contexts.
• Improve update-detection heuristics by augmenting keyword filtering with multi-signal approaches — timing signatures, known update host/domain lists, sequence analysis, and supervised models trained on instrumented ground truth.

6. Conclusion

Appendix: Figures from the Experiments

This appendix contains additional figures from the controlled experiments showing the update processes of individual IoT devices.

A.1 Tapo C100 Update Process

A.2 Tapo C200 Update Process

A.3 Xiaomi Camera Update Process

A.4 Eufy Camera Update Process

A.5 Apple TV Update

A.6 Riolink Camera Update Process

A.7 HomePod Mini

A.8 Certificate Issuers (Controlled Dataset)

References