FlagThis

Abstract

Matter is the most recent application-layer standard for the Internet of Things (IoT). It is designed by the Connectivity Standards Alliance (CSA) together with major commercial players to enable interoperability across IoT products of various manufacturers, independently of the underlying communication technologies. As one of its major selling points, Matters design imposes particular attention to security and privacy: it provides validated secure session establishment protocols, and it uses robust security algorithms to secure communications between IoT devices and Matter controllers. However, to the best of our knowledge, there is no systematic analysis investigating the extent to which a passive attacker, either in possession of lower layer keys or exploiting security misconfiguration at those layers, could infer information by passively analyzing encrypted Matter traffic. In this paper, we analyze the robustness of the Matter IoT standard to encrypted traffic analysis performed by a passive eavesdropper. By analyzing various datasets collected from real-world and simulated testbeds, we identify patterns in metadata of the encrypted Matter traffic that allow inferring the interactions occurring between end devices and controllers. Moreover, we associate patterns in sequences of interactions to specific types of IoT devices. These patterns can be used to create fingerprints that allow a passive attacker to infer the type of devices used in the network, constituting a serious breach of users privacy. Our results reveal that we can identify specific Matter interactions that occur in encrypted traffic with over 95% accuracy also in the presence of packet losses and delays. Moreover, we can identify Matter device types with a minimum accuracy of 88%. The CSA acknowledged our findings, and expressed that such vulnerabilities may be addressed in the next releases of the standard.