Skip to main content
We gratefully acknowledge support from the Simons Foundation, member institutions, and all contributors. Donate
arXiv logo
Cornell University Logo

Computer Science > Cryptography and Security

arXiv:1909.11166 (cs)
[Submitted on 24 Sep 2019]

Title:Ethical Hacking for IoT Security: A First Look into Bug Bounty Programs and Responsible Disclosure

Authors:Aaron Yi Ding, Gianluca Limon De Jesus, Marijn Janssen
View PDF
Abstract:The security of the Internet of Things (IoT) has attracted much attention due to the growing number of IoT-oriented security incidents. IoT hardware and software security vulnerabilities are exploited affecting many companies and persons. Since the causes of vulnerabilities go beyond pure technical measures, there is a pressing demand nowadays to demystify IoT "security complex" and develop practical guidelines for both companies, consumers, and regulators. In this paper, we present an initial study targeting an unexplored sphere in IoT by illuminating the potential of crowdsource ethical hacking approaches for enhancing IoT vulnerability management. We focus on Bug Bounty Programs (BBP) and Responsible Disclosure (RD), which stimulate hackers to report vulnerability in exchange for monetary rewards. We carried out a qualitative investigation supported by literature survey and expert interviews to explore how BBP and RD can facilitate the practice of identifying, classifying, prioritizing, remediating, and mitigating IoT vulnerabilities in an effective and cost-efficient manner. Besides deriving tangible guidelines for IoT stakeholders, our study also sheds light on a systematic integration path to combine BBP and RD with existing security practices (e.g., penetration test) to further boost overall IoT security.
Comments: Pre-print version for conference publication at ICTRS 2019
Subjects: Cryptography and Security (cs.CR); Computers and Society (cs.CY)
Cite as: arXiv:1909.11166 [cs.CR]
  (or arXiv:1909.11166v1 [cs.CR] for this version)
  https://doi.org/10.48550/arXiv.1909.11166
Related DOI: https://doi.org/10.1145/3357767.3357774

Submission history

From: Aaron Yi Ding [view email]
[v1] Tue, 24 Sep 2019 20:48:10 UTC (3,689 KB)
Full-text links:

Access Paper:

  • View PDF
  • Other Formats
view license
Current browse context:
cs.CR
< prev   |   next >
new | recent | 2019-09
Change to browse by:
cs
cs.CY

References & Citations

DBLP - CS Bibliography

listing | bibtex
Aaron Yi Ding
Marijn Janssen
export BibTeX citation

Bookmark

BibSonomy logo Reddit logo

Bibliographic and Citation Tools

Bibliographic Explorer (What is the Explorer?)
Connected Papers (What is Connected Papers?)
Litmaps (What is Litmaps?)
scite Smart Citations (What are Smart Citations?)

Code, Data and Media Associated with this Article

alphaXiv (What is alphaXiv?)
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub (What is DagsHub?)
Gotit.pub (What is GotitPub?)
Hugging Face (What is Huggingface?)
Papers with Code (What is Papers with Code?)
ScienceCast (What is ScienceCast?)

Demos

Replicate (What is Replicate?)
Hugging Face Spaces (What is Spaces?)
TXYZ.AI (What is TXYZ.AI?)

Recommenders and Search Tools

Influence Flower (What are Influence Flowers?)
CORE Recommender (What is CORE?)

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)