In the operational phase, an IoT device runs a light-weight server that is responsible for responding to the user queries, like accessing video and taking a snap in a IoT camera. The flaws in the implementation of certain security mechanisms in these IoT devices can lead to varying level of security threats. In this paper, we address the problems of discovering such vulnerabilities using effective fuzzing via crafted transport and upper layer protocol packets in IoT communication. We have designed and developed a mutation-based fuzzing tool, named IoTFuzzSentry, to discover certain non-trivial vulnerabilities in commercial IoT devices and demonstrate their potential exploits. We have used IoT devices, like IP cameras and Smart Plug. We have categorized the vulnerabilities into four types (IoT Credential Leakage (\mathcalV 1), Sneak IP camera live video stream (\mathcalV 2), Creep Live IoT Image (\mathcalV 3), IoT Command Injection (\mathcalV 4)) and show their exploits using three IoT devices. We have reported all these vulnerabilities to respective vendors via email. We believe that our IoTFuzzSentry has a great potential to discover such unconventional security threats and allow IoT vendors to strengthen the security of their commercialized devices.

Video traffic can create significant privacy and security threats to an organization or a smart home. Integration of IoT cameras has increased this problem manifold especially when there is no clear distinction among the protocols that can be used in IoT cameras and traditional video streaming or sharing applications. In this paper, we initiate a study on distinguishing video traffic in IoT cameras from that in video conferencing or sharing applications. We have used three IoT cameras, four video conferencing applications and two video sharing platforms to collect network traffic at network and above layers. We found a number of protocols like Real-time Transport Protocol, QUIC protocol, UDT protocol and TLS protocols that are used for transferring video traffic in these applications. We found that the protocols that carry IoT camera traffic have significantly different characteristics compared to that in video conferencing and sharing applications, e.g., in terms of video codec.