Reducing DNS Traffic to Enhance Home IoT Device Privacy

Area of Science:

• Computer Science
• Cybersecurity
• Network Engineering

Background:

• Internet of Things (IoT) devices are increasingly prevalent in homes, creating potential cybersecurity vulnerabilities.
• Despite security measures, IoT devices can be targeted by cyberattacks due to inherent weaknesses.
• Domain Name Server (DNS) traffic is a primary communication channel for IoT devices, often transmitting data in plain text.

Purpose of the Study:

• To conduct a detailed analysis of DNS traffic generated by IoT devices in home environments.
• To identify unique characteristics of IoT DNS queries that could be exploited by attackers.
• To propose a method for mitigating security risks associated with IoT DNS traffic.

Main Methods:

• Analysis of Domain Name Server (DNS) traffic patterns from Internet of Things (IoT) devices.
• Examination of queried domain names, query volume, and transmission protocols (User Datagram Protocol/UDP port 53).
• Evaluation of the security implications of plain text DNS queries and excessive traffic generation.

Main Results:

• IoT DNS queries exhibit highly distinctive domain patterns, allowing for easy identification of specific device types.
• An unexpectedly high volume of repetitive DNS queries was observed.
• Plain text transmission of DNS queries over UDP port 53 amplifies the risk of device identification and targeted attacks.

Conclusions:

• The distinctive and high-volume DNS traffic from IoT devices poses a significant security risk, enabling easier device identification and targeted cyberattacks.
• Excessive DNS traffic can escalate the compromise of the entire IoT ecosystem.
• Implementing DNS caching on IoT devices is a viable measure to reduce traffic, prevent device type identification, and enhance user privacy.