Leveraging AI to Compromise IoT Device Privacy by Exploiting Hardware Imperfections

The constrained design, remote deployment, and sensitive data generated by Internet of Things (IoT) devices make them susceptible to various cyberattacks. One such attack is profiling IoT devices by tracking their packet transmissions. While existing methods mitigate these attacks using pseudonymous identities, we propose a novel attack strategy that exploits the physical layer characteristics of IoT devices. Specifically, we demonstrate how an attacker can leverage features extracted from device transmissions to identify packets originating from the same device. Once identified, the attacker can isolate the device's signals and potentially determine its physical location. This attack exploits the fact that microcontroller clock variations exist across devices, even within the same model line. By extracting transmission features and training machine learning (ML) models, we accurately identify the originating device of the packets. This study reveals inherent privacy vulnerabilities in IoT systems due to hardware imperfections that are beyond user control. These limitations have profound implications for the design of security frameworks in emerging ubiquitous sensing environments. Our experiments demonstrate that the proposed attack achieves 99% accuracy in real-world settings and can bypass privacy measures implemented at higher protocol layers. This work highlights the urgent need for privacy protection strategies across multiple layers of the IoT protocol stack.