# Review of Smart-Home Security Using the Internet of Things
## 3 Smart-Home Ecosystem
### Infotainment Devices
Smart TVs are susceptible to a range of security threats and attacks, broadly categorized into the following: (i) remote attacks--where attackers exploit network vulnerabilities to gain unauthorized access; (ii) malware and ransomware--targeting operating systems and applications; (iii) data interception and leakage--where sensitive information such as user credentials and viewing habits is captured; (iv) physical attacks--including USB-based exploits to install malicious software; and (v) third-party applications and services--which may contain vulnerabilities or malicious functionalities. One of the most concerning aspects of smart-TV vulnerabilities is their potential to be exploited for remote attacks [50; 52]. Cybercriminals can gain unauthorized access to a TV's camera and microphone, spying on users without their knowledge. Similarly, because smart TVs often connect to other home devices, compromising a TV can lead to further breaches across a user's entire home network. Malware can also be a significant threat, as attackers may install malicious software to steal personal information, inject ads, or enlist the TV into a botnet for larger Distributed DoS (DDoS) attacks. On the bright side, efforts to mitigate the risks associated with smart TVs have led to the development of various countermeasures and solutions [51; 53]: (i) implementing robust encryption methods for data transmission and storage, (ii) utilizing multi-factor authentication or even biometric data to restrict access to the device, (iii) policies to ensure that the TV's firmware and applications are regularly updated to address known vulnerabilities, (iv) protecting the device's startup process and critical operations from tampering (e.g., secure boot and Trusted Execution Environment (TEE) functionality), (v) employing Artificial Intelligence (AI) and Machine Learning (ML) algorithms to detect unusual behavior that may indicate a security breach, and (vi) using techniques, such as differential privacy, to protect user data collected by applications. Augmented Reality (AR) and Virtual Reality (VR) technologies being increasingly integrated into smart-home environments, enhancing the way users interact with their living spaces [43]. However, as these immersive technologies find their way into our homes, they bring with them unique security challenges and vulnerabilities that need to be carefully managed to protect user privacy and data security. One of the primary security concerns in using AR and VR within smart homes is the potential exposure of sensitive personal information [77]. These technologies often require the collection and processing of large amounts of data to function effectively, including real-time location data, visual recordings from AR glasses or VR headsets, and biometric data to customize experiences. These data are highly sensitive, and if compromised, could be used for malicious purposes, such as identity theft, unauthorized surveillance, or targeted phishing attacks. The challenge of securing user authentication in smart homes using AR and VR technologies is also significant [78; 79]. Traditional authentication methods are less suited for these interactive environments and can be intrusive or disrupt the user experience. Newer methods, such as gesture recognition or eye-tracking, offer more seamless integration. [PERSON] et al. [79] evaluated existing AR/VR authentication mechanisms and proposed a comprehensive framework for developing future methods that emphasize the user experience and security. They highlight the inadequacies of password systems and suggest the use of multimodal sensors available in AR/VR devices for authentication purposes. This includes novel approaches--such as behavioral biometrics using eye and head movements; and more advanced techniques--like skull and ear biometrics, which leverage the specific capabilities of AR/VR hardware to ensure user authenticity in a way that is both unobtrusive and secure.