Side-Channel Attacks On Iot Data And Countermeasures

This thesis explores novel privacy vulnerabilities arising from the unintended use of sensordata in mobile and wearable systems. The first part introduces LuxTrack, a side-channelattack that leverages the ambient light sensor (ALS) of a smartphone to infer user activitieson nearby laptop screens based on emitted light intensity. We developed an Androidapplication to collect ALS data in a controlled environment with real users and showedthat machine learning models trained on extracted features could infer viewed websitesor applications with up to 80% accuracy. We then proposed and evaluated three countermeasures—binning, smoothing, and noise addition—demonstrating that attack accuracycould be reduced to below 30% while maintaining legitimate task utility.In the second part, we examine how motion sensor datasets, initially designed for activityor fall detection, can be exploited for subject inference attacks. Using the SisFalldataset, we show that it is possible to accurately identify individuals based on their motionpatterns using machine learning models and statistically significant features. Wepropose and evaluate several defense mechanisms that inject noise at the feature and sensorlevels, achieving a strong trade-off between reducing subject identification accuracyand preserving activity recognition performance.Together, these studies highlight the risks of side-channel leaks and unintended inferencesin sensor-based systems, and propose practical defenses to support privacy-preservingdata analytics.