A Pilot Study on Consumer IoT Device Vulnerability Disclosure and Patch Release in Japan and the United States
Asuka Nakajima, Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama, Maverick Woo · 2019
With our ever increasing dependence on computers, many governments have started to investigate regulations on vulnerabilities and their lifecycle management. Although many previous works have studied this problem space for mainstream software packages and web applications, few studies have targeted consumer IoT devices. As a first step towards filling this void, this paper presents a pilot study on the vulnerability disclosures and patch release behaviors related to 3 prominent consumer IoT vendors in Japan and 3 in the United States. Our goals include (i) characterizing trends and risks using accurate data that spans a long period, and (ii) identifying problems, challenges, and potential approaches for future studies of this problem space. To this end, we collected all published vulnerabilities and their patches for the consumer IoT products by the included vendors between 2006 and 2017; then, we analyzed our data from multiple perspectives such as the severity of the vulnerabilities and the timing of patch releases with respect to disclosures and exploits. Our work has uncovered several findings that may inform future studies, including (i) a stark contrast in the vulnerability disclosures between the two countries and (ii) three alarming vendor practices that may pose significant risks of 1-day exploits.