Device-to-device (D2D) network has now become a standardized feature in many mobile devices, by which mobile devices can communicate with each... Show moreDevice-to-device (D2D) network has now become a standardized feature in many mobile devices, by which mobile devices can communicate with each other even when internet access is not available. Because D2D network is expected to be an intrinsic part of the Internet of Things (IoT) and mobile device is the smartest and the most advanced commercial device in everyday usage, the D2D feature and related security protocols can influence the design and implementation of many other IoT devices. While D2D network provides tangible benefits to users, it also raises the security risks of information leaking. Our work performs an in-depth systematical security analysis on 802.11 based D2D network among commercial devices, including personal mobile devices such as phones and tablet, as well as business POS and printers. In this paper, we focus on most popular apps in the Google Play Store, the best selling printers in the market and the most widely adopted commercial POS devices for small businesses. Our analysis reveals some critical vulnerabilities. The key findings are multi-fold. First, the current mobile D2D network framework established on 802.11 protocol has significant flaw of over-privileged issue. Second, we have identified that data transfer over D2D network can be eavesdropped. Furthermore, we exploit the identified framework flaws to construct multiple proof-of-concept attacks and we conclude the paper with security lessons and suggestions of possible solutions against the identified security issues. Show less
