Trigger-Action platforms are an emerging class of web-based systems that enable users to create automation rules (or recipes) of the form, "If there is a smoke alarm, then turn off my oven." These platforms stitch together various online services including Internet of Things devices, social networks, and productivity tools by obtaining OAuth tokens on behalf of users. Unfortunately, these platforms also introduce a long-term security risk: If they are compromised, the attacker can misuse the OAuth tokens belonging to millions of users to arbitrarily manipulate their devices and data. In this work, we first quantify the risk users face in the context of If-This-Then-That (IFTTT). We perform the first empirical analysis of the OAuth-based authorization model of IFTTT using semi-automated tools that we built to overcome the challenges of IFTTT's closed source nature and of online service API inconsistencies. We find that 75% of IFTTT's channels, an abstraction of online services, use overprivileged OAuth tokens, increasing risks in the event of a compromise. Even if the OAuth tokens were to be privileged correctly, IFTTT's compromise will not prevent their misuse. Motivated by this empirical analysis, we design and evaluate Decoupled-IFTTT (dIFTTT), the first trigger-action platform where users do not have to give it highly-privileged access to their online services. Our design pushes the notion of fine-grained OAuth tokens to its extreme and ensures that even if the cloud service is controlled by the attacker, it cannot misuse the OAuth tokens to invoke unauthorized actions. Our evaluation establishes that dIFTTT poses modest overhead: it adds less than 15ms of latency to recipe execution time, and reduces throughput by 2.5%.

翻译：特里格- 动作平台是一个新兴的基于网络的系统类别, 使用户能够创建自动规则( 或配方 ), “ 如果有烟雾警报, 然后关闭我的烤箱 ” 。 这些平台将各种在线服务, 包括Tings装置的互联网、 社交网络和生产力工具, 代表用户获取 OAuth 标志。 不幸的是, 这些平台还引入了长期安全风险: 如果它们被暴露, 攻击者可以滥用属于数百万用户的 OAuth 标志, 任意操纵它们的设备和数据。 在这项工作中, 我们首先量化用户在 " 如果当时有烟雾警报, 然后关闭我的烤箱。 我们使用基于OAUTT的OA授权模型进行第一次实验性分析, 使用半自动工具来克服IFTT的封闭源性质和在线服务不一致的挑战。 我们发现, IFTT的频道有75% 的网络服务缩略图, 使用过度的OAUTU, 使用过度的 OAUDUT服务, 防止发生货币攻击的风险增加。 即使OAUT的罚款, 也无法正确评估。