IoT Privacy and Edge Security: Revealing Risks Across Smart Devices and AI

Overview

The talk examines how the vast array of connected devices in homes and institutions can reveal private information through continuous sensing and network traffic. It highlights real world behaviors across doorbells, TVs, smart speakers, and medical devices, and shows how data often travels beyond local jurisdictions to servers around the world.

Key insights

• IoT devices frequently send non essential data to third parties, creating privacy and security concerns.
• Automated content recognition in smart TVs and mis activations in smart speakers pose significant privacy risks by capturing user activity and audio/video data.
• Generative AI browser extensions and edge based solutions introduce new vectors for data collection and profiling, often shared with third parties.
• Edge based mitigations and privacy labels are proposed as practical ways to give users control and enable auditors to enforce regulations.

Introduction and scope

Key research findings and methodologies

The talk then moves to a broader category: generative AI browser extensions. Using a carefully constructed Persona model with characteristics such as age, gender, and nationality, they test how prompts and interactions with extensions reveal sensitive data such as health records, NHS pages, and login details. They show that extensions often capture web form inputs and share prompts with third parties. The analysis demonstrates that profiling can occur even across different accounts and IP addresses.

Privacy and security in medical devices and wearables

The discussion shifts to wearable health devices and insulin pumps using Bluetooth Low Energy. The researchers perform practical demonstrations showing how Bluetooth traffic can be sniffed and how man in the middle and denial of service attacks may manipulate device readings, potentially impacting patient care. They emphasize the risk that such attacks pose, particularly when devices are connected to insulin pumps and glucose sensors, and the attack range that could threaten patient safety.

IoT safeguards and evaluation

The team tests consumer IoT safeguards such as software boxes, router based protections, and network guardians. They reveal mixed performance: some devices fail to automatically identify all devices on a network, mislabel a number of devices, or fail to detect basic threats like port scans. It is noted that many safeguards rely on cloud processing which introduces privacy concerns and potential data leakage. The research also documents significant privacy policy ambivalence, with many safeguards engaging third party services and failing to clearly disclose data flows or retention. The team then investigates the potential for overprotection and network overhead, highlighting ARP spoofing and traffic surges that can degrade performance.

Towards a privacy and security at the edge

The researchers advocate protecting privacy and security at the edge, keeping processing on premises and enabling user informed consent about data sharing. They describe a concept of device traffic blockers that identify non essential destinations and quarantine them without breaking the device function. They demonstrate that in many cases non essential traffic is small in data volume but can leak signals about user state like presence at home. They also explore the feasibility of on device threat detection using energy usage patterns to identify attacks such as DoS, man in the middle, or scanning activities, acknowledging that some devices resist such detection, notably high traffic devices like smart TVs.

Regulatory context and future directions

The talk concludes by outlining the regulatory landscape, highlighting the forthcoming EU cybersecurity baseline requirement that will certify IoT devices sold in the European market starting December 2027, and GDPR as a privacy backbone. They propose a vision in which privacy and security controls are visible to users via a consumer facing Privacy and Security Labels, potentially delivered via a QR code on device packaging. They emphasize the need for auditors and enforcement bodies to scale and the importance of human oversight in the privacy ecosystem.

Conclusion

While IoT remains deeply integrated into daily life, the talk argues that technology, along with policy and regulation, can be harnessed to improve privacy and security. The edge approach enables processing to stay within the user’s premises while providing actionable insights and governance to support safer, more transparent IoT ecosystems. The speaker invites engagement and provides QR codes and references for further exploration.