2017 International Conference on Software Security and Assurance
Common Requirements for Web Application Vulnerability Scanners for the
Internet of Things
Hae Young Lee and Young Sun Park
DuDu IT
Seoul, South Korea
whichmeans@gmail.com
Abstract— This paper presents 3 common requirements for
web application vulnerability scanners for the Internet of
things devices, including browser’s rendering engine support,
false positive minimization, and device setting change
minimization. These requirements have been drawn from the
experience of the previous project, security vulnerabilities in
residential gateways.
Keywords-IoT security; insecure web interface, web
application vulnerability
I. INTRODUCTION
IoT devices usually provide web interfaces for the users
and administrators. But they may have web application
vulnerabilities, such as cross-site scripting, and attackers
may be able to exploit the vulnerabilities. For example,
videos that appear to be from IP cameras at home have been
recently found on some websites, mainly due to insecure
web interfaces [1]. However, the existing IoT vulnerability
scanners, such as, Shodan [2], examine network interfaces of
IoT devices in ‘public’ networks. Thus, IoT devices in
‘private’ networks (e.g., beyond residential gateways) may
not be scanned. Also, web application vulnerability scanners
(WAVS), such as Subgraph Vega [3], are for typical
websites.
This paper presents common requirements for IoT web
application vulnerability scanners (I-WAVS). An I-WAVS
should: 1) be able to use a browser’s rendering engine, 2)
minimize false positives, and 3) minimize device setting
changes. They have been drawn from the experience of
Lee’s previous project [4]. Based on the requirements, we
will develop an I-WAVS.
II. REQUIREMENTS FOR IOT WEB SCANNERS
A. Browser’s Rendering Engine Support
An I-WAVS should be able to use a browser’s rendering
engine to parse web interfaces of IoT devices. Stand-alone
WAVS are usually equipped with custom rendering engines
since they could show much better performance in scanning.
However, they often had difficulty in rendering the web
interfaces built with state-of-the-art technology, so that the
users occasionally need to perform time-consuming, error-
prone manual scans through browsers. Such manual jobs
could be minimized if an I-WAVS provides an option of
978-1-5386-4808-7/17 $31.00 © 2017 IEEE
978-0-7695-6338-1/17
DOI 10.1109/ICSSA.2017.31
using a browser’s engine in scanning. This may be
implemented as a form of a browser’s add-on.
B. False Positive Minimization
An I-WAVS should minimize false positives by
excluding uncommon vulnerabilities in IoT devices. WAVS
are basically designed to examine typical websites accessible
to many users, having access to DBMS. The web interface of
an IoT device is, however, usually for a few users and does
not have access to DBMS. Thus, using WAVS to scan web
interfaces of IoT devices could result in many false positives,
such as SQL injections, potential file uploads, and so on.
C. Device Setting Change Minimization
An obstacle to using WAVS to scan web interfaces of
IoT devices was they often changed the devices settings,
even to factory defaults; they explore every reachable page
through links or buttons, which may lead to saving or
resetting settings. Thus, an I-WAVS should be able to set
‘forbidden’ links, buttons, or pages to minimize the device
setting changes.
III. CONCLUSIONS AND FUTURE WORK
In this paper, we presented common requirements for I-
WAVS, which are used to scan web interfaces of IoT devices
for security vulnerabilities. Based on the proposed
requirements, we are planning to develop an I-WAVS, and to
evaluate the performance of our I-WAVS, compared to IoT
vulnerability scanners or web application vulnerability
scanners.
ACKNOWLEDGMENT
This research was supported by Basic Science Research
Program through the National Research Foundation of Korea
(NRF) funded by the Ministry of Science, ICT and Future
Planning (NRF-2013R1A1A1006542).
REFERENCES
[1] OWASP, Internet of Thins Top Ten, 2014.
[2] Shodan. https://www.shodan.io/
[3] Subgraph Vega. https://subgraph.com/vega/
[4] H.Y. Lee, H.J. Yoon, D.R. Park, J.H. Kim, Research on Detection
Technologie of Security Vulnerabilities for Wireless Access Points,
Final Report, KOFAC URP, 2015 (in Korean).
111