# Review of Smart-Home Security Using the Internet of Things
## 3 Smart-Home Ecosystem
### Infotainment Devices  
The main home-assistant solutions are provided by large companies, like the Google Home, Amazon Alexa, Apple Siri, and Microsoft Cortana [67]. Ordinarily, these systems utilize Deep Neural Networks (DNN) and multi-modal dialogue systems for Automatic Speech Recognition (ASR), Natural Language Understanding (NLU), and the incorporation of gestures and visual input to create more interactive and engaging user experiences [67]. In the smart-home environment, these systems offer an easy-to-use setting for the average user and ease integration with compatible smart-home devices. [PERSON] and [PERSON] [68] studied users' attitudes and concerns towards the security and privacy of home assistants, with only 2% of participants reporting problematic issues, like (i) data collection and scope, (ii) \"creepy\" device behavior, and (iii) violations of personal privacy thresholds. However, several security and privacy issues and challenges have been reported by researchers and practitioners [69; 70; 71; 72; 73; 74]. Among others, these involve (i) the continuous processing of data by these devices and potential disclosure of private information to companies or adversaries, (ii) vulnerabilities in data transmission or storage mechanisms (e.g., an adversary outside the victim's house can connect his/her smartphone to the victim's Bluetooth speaker and then play an MP3 audio file of voice commands [69]), (iii) third-party exposure by the insufficient reviewing of applications in related application stores or insecure collaborating devices, which may inject vulnerabilities or weak security mechanisms into the home system, (iv) low security awareness by the user, who may not set or configure the system properly (e.g., use weak passwords or other authentication mechanisms), or maintain it (e.g., not updating or patching the system on a frequent basis), (v) attacks exploiting the open vocal interface [70], like mischievous neighbors or criminals speaking commands from outside, replaying commands via other means (e.g., TV commercial), commands in ultrasonic frequencies which cannot be heard by humans but can be detected by smart speakers, etc., (vi) challenges of supporting a multi-user environment, like protecting a user's private data from the rest of the users of the same smart environment (e.g., hired apartments, elder residents, or people with disabilities with support person dyads [71; 72; 73], etc. ), or imposing smart-home ownership and control among family members (family rivalry) [74] or pets with talking capabilities (i.e., parrots or mynas [70]). Home assistants, in their always-on listening capability, are designed to activate upon hearing a wake word. This feature, while convenient, raises the possibility of inadvertent recording and data collection [75]. There have been instances where conversations were recorded and transmitted without user consent due to false triggers or misinterpretations of the wake word. The storage and processing of vocal commands on remote servers further exacerbate privacy concerns, as any breach from these data centers could expose users' sensitive information. Home assistants are linked to user accounts containing a wealth of personal information, including contacts, calendars, and even financial data. Attackers who gain access to these accounts can potentially hijack not only the home assistant but also other connected services. Weak or reused passwords, a lack of two-factor authentication, and phishing campaigns are common vectors for unauthorized access attacks. Third-party applications from application stores or other sources also pose a security challenge. Home assistants allow the installation of third-party skills or applications that enhance functionality. However, these third-party integrations can be a source of vulnerabilities, especially if they are not properly examined for security threats. Malicious skills could perform unwanted actions, such as eavesdropping or sending data to unauthorized third parties.