IoTIO: Analyzing and Understanding the Internet of Insecure Things

Principal Investigators

Prof. Dr. Kevin Borgolte
Prof. Dr. Martina Lindorfer (TU Wien)

Project Time Period

Jun 2020–Nov 2025

Funding Agency

Vienna Science and Technology Fund (WWTF)

Abstract

Consumer devices, from door locks to light bulbs, are becoming increasingly smart. They are linked with other devices as part of smart homes and offices, usually Internet-connected, and may be publicly accessible through misconfiguration or IPv6. The corresponding security and privacy implications have yet to be explored in depth, and their analysis is complicated by device type and architecture diversity. Prior work focused on case studies of specific device types, or analyzed devices’ firmware in isolation, requiring substantial manual effort. In contrast, the automatic analysis of devices’ interaction with their environment and other devices could uncover new vulnerability types and privacy violations. In this project, we will propose scalable techniques to analyze smart devices for potential vulnerabilities based on how they are collecting, processing, and sharing data by interacting with their mobile companion app or smart hubs. We will provide a proof-of-concept tool to show our research’s practicality. The basis of our project are novel software and network analyses of companion apps and hub integration to synthesize protocols, discover commands to exercise device functionality, and identify information flows – without requiring access to the smart devices themselves. The project is a multi-disciplinary research effort enabling security and privacy analyses. It has also societal impact by enabling informed decision making by manufactures, lawmakers, and users.

Publications

Peer-Reviewed

Onelogon: Taking over Active Directory Accounts via Netlogon

Alexander Neff, Tobias Holl, Kevin Borgolte

Proceedings of the 20th USENIX WOOT Conference on Offensive Technologies (WOOT), August 2026

@inproceedings{woot2026-onelogon,
  title     = {{Onelogon: Taking over Active Directory Accounts via Netlogon}},
  author    = {Neff, Alexander and Holl, Tobias and Borgolte, Kevin},
  booktitle = {Proceedings of the 20th USENIX WOOT Conference on Offensive Technologies (WOOT)},
  code      = {https://github.com/rub-softsec/onelogon},
  date      = {2026-08},
  editor    = {Bianchi, Antonio and Classen, Jiska},
  location  = {Baltimore, MD, USA},
  publisher = {USENIX Association}
}

New Platform, Old Issues: How Web-based TV Broadcasts threaten Users' Security

Carlotta Tagliaro, Andrej Danis, Kevin Borgolte, Martina Lindorfer

Proceedings of the 23rd Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), July 2026

@inproceedings{dimva2026-hbbtv-old-issues,
  title     = {{New Platform, Old Issues: How Web-based TV Broadcasts threaten Users' Security}},
  author    = {Tagliaro, Carlotta and Danis, Andrej and Borgolte, Kevin and Lindorfer, Martina},
  booktitle = {Proceedings of the 23rd Conference on Detection of Intrusions and Malware \& Vulnerability Assessment (DIMVA)},
  series    = {Lecture Notes in Computer Science (LNCS)},
  code      = {https://github.com/SecPriv/HbbTV-attack-toolkit},
  date      = {2026-07},
  editor    = {Moonsamy, Veelasha and D'Elia, Daniele Cono},
  location  = {Chania, Greece},
  publisher = {Springer International Publishing}
}

StorFuzz: Using Data Diversity to Overcome Fuzzing Plateaus

Leon Weiß, Tobias Holl, Kevin Borgolte

Proceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE), April 2026

@inproceedings{icse2026-storfuzz,
  title     = {{StorFuzz: Using Data Diversity to Overcome Fuzzing Plateaus}},
  author    = {Weiß, Leon and Holl, Tobias and Borgolte, Kevin},
  booktitle = {Proceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE)},
  code      = {https://github.com/rub-softsec/storfuzz/},
  data      = {https://doi.org/10.5281/zenodo.14979693},
  date      = {2026-04},
  doi       = {10.1145/3744916.3773179},
  editor    = {Mezini, Mira and Zimmermann, Thomas},
  location  = {Rio de Janeiro, Brazil},
  publisher = {Association for Computing Machinery (ACM)/Institute of Electrical and Electronics Engineers (IEEE)},
  volume    = {48}
}

Hallucinating Certificates: Differential Testing of TLS Certificate Validation Using Generative Language Models

Talha Paracha, Kyle Posluns, Kevin Borgolte, Martina Lindorfer, David Choffnes

Proceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE), April 2026

@inproceedings{icse2026-hallucinating-certificates,
  title     = {{Hallucinating Certificates: Differential Testing of TLS Certificate Validation Using Generative Language Models}},
  author    = {Paracha, Talha and Posluns, Kyle and Borgolte, Kevin and Lindorfer, Martina and Choffnes, David},
  booktitle = {Proceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE)},
  code      = {https://github.com/rub-softsec/mlcerts},
  data      = {https://zenodo.org/records/15971208},
  date      = {2026-04},
  doi       = {10.1145/3744916.3773203},
  editor    = {Mezini, Mira and Zimmermann, Thomas},
  location  = {Rio de Janeiro, Brazil},
  publisher = {Association for Computing Machinery (ACM)/Institute of Electrical and Electronics Engineers (IEEE)},
  volume    = {48}
}

The Things That Count: Coverage Evaluation Under the Microscope (Registered Report)

Tobias Holl, Leon Weiß, Kevin Borgolte

Proceedings of the 5th International Fuzzing Workshop (FUZZING), February 2026

@inproceedings{fuzzing2026-the-things-that-count,
  title     = {{The Things That Count: Coverage Evaluation Under the Microscope (Registered Report)}},
  author    = {Holl, Tobias and Weiß, Leon and Borgolte, Kevin},
  booktitle = {Proceedings of the 5th International Fuzzing Workshop (FUZZING)},
  code      = {https://softsec.link/fz26.cov/},
  date      = {2026-02-27},
  doi       = {10.14722/fuzzing.2026.23030},
  editor    = {Böhme, Marcel and Meng, Ruijie and Padhye, Rohan and Noller, Yannic and Szekeres, László},
  location  = {San Diego, CA, USA},
  publisher = {Internet Society (ISOC)},
  volume    = {5}
}

Pogofuzz: Profile-Guided Optimization for Fuzzing (Registered Report)

Tobias Holl, Leon Weiß, Kevin Borgolte

Proceedings of the 5th International Fuzzing Workshop (FUZZING), February 2026

@inproceedings{fuzzing2026-pogofuzz,
  title     = {{Pogofuzz: Profile-Guided Optimization for Fuzzing (Registered Report)}},
  author    = {Holl, Tobias and Weiß, Leon and Borgolte, Kevin},
  booktitle = {Proceedings of the 5th International Fuzzing Workshop (FUZZING)},
  code      = {https://softsec.link/fz26.pogofuzz/},
  date      = {2026-02-27},
  doi       = {10.14722/fuzzing.2026.23029},
  editor    = {Böhme, Marcel and Meng, Ruijie and Padhye, Rohan and Noller, Yannic and Szekeres, László},
  location  = {San Diego, CA, USA},
  publisher = {Internet Society (ISOC)},
  volume    = {5}
}

Large-Scale Security Analysis of Real-World Backend Deployments Speaking IoT-Focused Protocols

Carlotta Tagliaro, Martina Komsic, Andrea Continella, Kevin Borgolte, Martina Lindorfer

Proceedings of the 27th International Symposium on Recent Advances in Intrusion Detection (RAID), September 2024

@inproceedings{raid2024-iot-backends,
  title     = {{Large-Scale Security Analysis of Real-World Backend Deployments Speaking IoT-Focused Protocols}},
  author    = {Tagliaro, Carlotta and Komsic, Martina and Continella, Andrea and Borgolte, Kevin and Lindorfer, Martina},
  booktitle = {Proceedings of the 27th International Symposium on Recent Advances in Intrusion Detection (RAID)},
  series    = {Lecture Notes in Computer Science (LNCS)},
  date      = {2024-09},
  doi       = {10.1145/3678890.3678899},
  edition   = {27},
  editor    = {Aafer, Yousra and Fratantonio, Yanick},
  isbn      = {979-8-4007-0959},
  location  = {Padua, Italy},
  publisher = {Springer International Publishing}
}

IoTFlow: Inferring IoT Device Behavior at Scale through Static Mobile Companion App Analysis

David Schmidt, Carlotta Tagliaro, Kevin Borgolte, Martina Lindorfer

Proceedings of the 30th ACM SIGSAC Conference on Computer and Communications Security (CCS), November 2023

@inproceedings{ccs2023-iotflow,
  title     = {{IoTFlow: Inferring IoT Device Behavior at Scale through Static Mobile Companion App Analysis}},
  author    = {Schmidt, David and Tagliaro, Carlotta and Borgolte, Kevin and Lindorfer, Martina},
  booktitle = {Proceedings of the 30th ACM SIGSAC Conference on Computer and Communications Security (CCS)},
  date      = {2023-11},
  doi       = {10.1145/3576915.3623211},
  edition   = {30},
  editor    = {Cremers, Cas and Kirda, Engin},
  location  = {Copenhagen, Denmark},
  publisher = {Association for Computing Machinery (ACM)}
}

Out of Sight, Out of Mind: Detecting Orphaned Web Pages at Internet-Scale

Stijn Pletinckx, Kevin Borgolte, Tobias Fiebig

Proceedings of the 28th ACM SIGSAC Conference on Computer and Communications Security (CCS), November 2021

@inproceedings{ccs2021-out-of-sight-out-of-mind,
  title     = {{Out of Sight, Out of Mind: Detecting Orphaned Web Pages at Internet-Scale}},
  author    = {Pletinckx, Stijn and Borgolte, Kevin and Fiebig, Tobias},
  booktitle = {Proceedings of the 28th ACM SIGSAC Conference on Computer and Communications Security (CCS)},
  date      = {2021-11},
  doi       = {10.1145/3460120.3485367},
  edition   = {28},
  editor    = {Shi, Elaine and Vigna, Giovanni},
  isbn      = {978-1-4503-8454-4},
  location  = {Seoul, South Korea},
  publisher = {Association for Computing Machinery (ACM)}
}