# Assessing the Security and Privacy of Baby Monitor Apps
## 2 Related Work  
Compared to other user systems, the usage of mobile devices appears to pose more serious risks in terms of security and data protection [6], resulting in high compliance requirements. However, despite the strict regulations for mobile devices, many mobile applications seem not to comply with current demands.  
Data practices in mobile applications are often found to be different from declared policies, omitting or incorrectly handling private information [7], collecting personal data, e.g., location profiles, without declaration or consent [8], or suffering from other inconsistencies [9]. At the same time, users often do not realize that their data are being collected and used by mobile applications [10]. In this area of conflict, further investigation is required to gain insight into how personal data is collected and how these data practices are declared in the applications' privacy policies. Therefore, a focal point of privacy research is evaluating existing mobile applications, especially those that process sensitive user data.  
Previous work investigated mobile applications supporting healthcare [11], warning about the alarming state of security and privacy in this area. Similar results were presented by a study of mobile apps targeting individuals suffering from depression. The study reported that most of the apps lacked transparency about the security of personal data and were found to be insecure and unsafe to use [12].  
It has been shown that it is relatively easy for app developers to hide their data practices from automated analysis [13]. Therefore, manual analysis of apps that record and process personal data is essential, as work in areas other than mobile health has also been suggested. One domain processing sensitive data is childcare, and devices and software designed to interact with and survey children have been found to pose high security and privacy risks [14]. Another study examines childcare mobile apps, showing that their privacy policies may not be clear about data practices. Additionally, some of the solutions examined rely on insecure cloud storage for the collected data [15], threatening the privacy of children's data.  
In this context, we found baby monitoring applications to be a unique category of interest whose security and privacy implications remain to be researched. Baby monitoring apps are designed to observe, and thus, apply methods similar to video surveillance solutions, such as recording and processing pictures, videos, and audio material. Although privacy consent for such actions is abdicated to children's guardians, there is the potential to use the data collected by such apps illegally [16]. In addition to the challenges of mobile app security and privacy, video surveillance systems have their own difficulties. In the context of IoT surveillance devices, researchers demonstrated that machine-in-the-middle attacks might allow reconstruction of visual material recorded by IP cameras by eavesdropping on network traffic or deploying a multichannel attack [2, 17]. [PERSON] et al. have conducted similar experiments, revealing activities captured by cameras even if the device's communication is encrypted [4]. Moreover, with the growing diversity and number of IoT devices and camera surveillance, attack vectors increase, putting the security and privacy of personal information at risk [18]. Therefore, this paper extends previous work in the field of security and privacy analysis of surveillance applications by examining the security and privacy implications of baby monitor mobile applications, running on off-the-shelf smartphones.