{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,31]],"date-time":"2026-01-31T08:58:43Z","timestamp":1769849923205,"version":"3.49.0"},"publisher-location":"New York, NY, USA","reference-count":34,"publisher":"ACM","license":[{"start":{"date-parts":[[2018,6,18]],"date-time":"2018-06-18T00:00:00Z","timestamp":1529280000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"the Key Program of National Natural Science Foun- dation of China","award":["No.U1636217"],"award-info":[{"award-number":["No.U1636217"]}]},{"name":"the National Key Research and Development Program of China","award":["No.2016YFB0801200"],"award-info":[{"award-number":["No.2016YFB0801200"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2018,6,18]]},"DOI":"10.1145\/3212480.3212496","type":"proceedings-article","created":{"date-parts":[[2018,6,28]],"date-time":"2018-06-28T16:38:41Z","timestamp":1530203921000},"page":"1-11","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["Passwords in the Air"],"prefix":"10.1145","author":[{"given":"Changyu","family":"Li","sequence":"first","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Quanpu","family":"Cai","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Juanru","family":"Li","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hui","family":"Liu","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuanyuan","family":"Zhang","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dawu","family":"Gu","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu","family":"Yu","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University, Westone Cryptologic Research Center"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2018,6,18]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"http:\/\/www.broadlink.com.cn\/pageihc.html. Accessed","author":"Broadlink","year":"2018","unstructured":"Broadlink official website. http:\/\/www.broadlink.com.cn\/pageihc.html. Accessed February 28, 2018 . Broadlink official website. http:\/\/www.broadlink.com.cn\/pageihc.html. Accessed February 28, 2018."},{"key":"e_1_3_2_1_2_1","volume-title":"http:\/\/android.myapp.com\/myapp\/searchAjax.htm?kw=smartconfig&pns=3. Accessed","author":"Myapp","year":"2018","unstructured":"Myapp app market. http:\/\/android.myapp.com\/myapp\/searchAjax.htm?kw=smartconfig&pns=3. Accessed March 5, 2018 . Myapp app market. http:\/\/android.myapp.com\/myapp\/searchAjax.htm?kw=smartconfig&pns=3. Accessed March 5, 2018."},{"key":"e_1_3_2_1_3_1","volume-title":"products, kits, hubs. https:\/\/www.smarthome.com\/. Accessed","author":"Smarthome","year":"2018","unstructured":"Smarthome - home automation systems , products, kits, hubs. https:\/\/www.smarthome.com\/. Accessed March 5, 2018 . Smarthome - home automation systems, products, kits, hubs. https:\/\/www.smarthome.com\/. Accessed March 5, 2018."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978333"},{"key":"e_1_3_2_1_5_1","volume-title":"bayithomeautomation. www.bayithomeautomation.com. Accessed","year":"2018","unstructured":"bayitHome. bayithomeautomation. www.bayithomeautomation.com. Accessed February 26, 2018 . bayitHome. bayithomeautomation. www.bayithomeautomation.com. Accessed February 26, 2018."},{"key":"e_1_3_2_1_6_1","volume-title":"Accessed","year":"2018","unstructured":"BroadLink. Library of libbroadlinkconfig. https:\/\/github.com\/ruifeng2357\/Breeze\/blob\/master\/libs\/armeabi\/libBroadLinkConfig.so . Accessed February 26, 2018 . BroadLink. Library of libbroadlinkconfig. https:\/\/github.com\/ruifeng2357\/Breeze\/blob\/master\/libs\/armeabi\/libBroadLinkConfig.so. Accessed February 26, 2018."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"e_1_3_2_1_8_1","unstructured":"Jiongyi Chen Wenrui Diao Qingchuan Zhao Chaoshun Zuo Zhiqiang Lin XiaoFeng Wang Wing Cheong Lau Menghan Sun Ronghai Yang and Kehuan Zhang. Iotfuzzer: Discovering memory corruptions in iot through app-based fuzzing.  Jiongyi Chen Wenrui Diao Qingchuan Zhao Chaoshun Zuo Zhiqiang Lin XiaoFeng Wang Wing Cheong Lau Menghan Sun Ronghai Yang and Kehuan Zhang. Iotfuzzer: Discovering memory corruptions in iot through app-based fuzzing."},{"key":"e_1_3_2_1_9_1","volume-title":"Accessed","year":"2018","unstructured":"Espressif. Espressif document. https:\/\/www.espressif.com\/en\/support\/download\/documents . Accessed February 27, 2018 . Espressif. Espressif document. https:\/\/www.espressif.com\/en\/support\/download\/documents. Accessed February 27, 2018."},{"key":"e_1_3_2_1_10_1","volume-title":"https:\/\/github.com\/EspressifApp\/EsptouchForAndroid\/. Accessed","year":"2018","unstructured":"EspressifApp. Esptouchforandroid. https:\/\/github.com\/EspressifApp\/EsptouchForAndroid\/. Accessed February 26, 2018 . EspressifApp. Esptouchforandroid. https:\/\/github.com\/EspressifApp\/EsptouchForAndroid\/. Accessed February 26, 2018."},{"key":"e_1_3_2_1_11_1","volume-title":"https:\/\/github.com\/EspressifApp\/EsptouchForAndroid\/blob\/master\/src\/com\/espressif\/iot\/esptouch\/protocol\/DatumCode.java. Accessed","year":"2018","unstructured":"EspressifApp. Esptouch_protocol. https:\/\/github.com\/EspressifApp\/EsptouchForAndroid\/blob\/master\/src\/com\/espressif\/iot\/esptouch\/protocol\/DatumCode.java. Accessed February 26, 2018 . EspressifApp. Esptouch_protocol. https:\/\/github.com\/EspressifApp\/EsptouchForAndroid\/blob\/master\/src\/com\/espressif\/iot\/esptouch\/protocol\/DatumCode.java. Accessed February 26, 2018."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66332-6_3"},{"key":"e_1_3_2_1_13_1","volume-title":"Reversing iot xiaomi ecosystem. https:\/\/recon.cx\/2018\/brussels\/resources\/slides\/RECON-BRX-2018-Reversing-IoT-Xiaomi-ecosystem.pdf. Accessed","author":"Giese Dennis","year":"2018","unstructured":"Dennis Giese and Daniel Wegemer . Reversing iot xiaomi ecosystem. https:\/\/recon.cx\/2018\/brussels\/resources\/slides\/RECON-BRX-2018-Reversing-IoT-Xiaomi-ecosystem.pdf. Accessed March 5, 2018 . Dennis Giese and Daniel Wegemer. Reversing iot xiaomi ecosystem. https:\/\/recon.cx\/2018\/brussels\/resources\/slides\/RECON-BRX-2018-Reversing-IoT-Xiaomi-ecosystem.pdf. Accessed March 5, 2018."},{"key":"e_1_3_2_1_14_1","volume-title":"Accessed","year":"2017","unstructured":"High-Flying. Hf low power wifi module user manual. http:\/\/www.hi-flying.com\/download-center-1\/user-guide-1\/download-item-hf-lpx30-user-manual . Accessed November 23, 2017 . High-Flying. Hf low power wifi module user manual. http:\/\/www.hi-flying.com\/download-center-1\/user-guide-1\/download-item-hf-lpx30-user-manual. Accessed November 23, 2017."},{"key":"e_1_3_2_1_15_1","volume-title":"Accessed","author":"Instruments Texas","year":"2018","unstructured":"Texas Instruments . Simplelink wi-fi smartconfig technology. http:\/\/www.ti.com\/tool\/SMARTCONFIG?keyMatch=smartconfig&tisearch=Search- . Accessed February 28, 2018 . Texas Instruments. Simplelink wi-fi smartconfig technology. http:\/\/www.ti.com\/tool\/SMARTCONFIG?keyMatch=smartconfig&tisearch=Search-. Accessed February 28, 2018."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3139937.3139948"},{"key":"e_1_3_2_1_17_1","volume-title":"Published","year":"2016","unstructured":"MediaTek. Mediatek linkit connect 7681 developer's guide. https:\/\/docs.labs.mediatek.com\/resource\/linkit-connect-7681\/en\/documents . Published Mar 12, 2016 . MediaTek. Mediatek linkit connect 7681 developer's guide. https:\/\/docs.labs.mediatek.com\/resource\/linkit-connect-7681\/en\/documents. Published Mar 12, 2016."},{"key":"e_1_3_2_1_18_1","volume-title":"https:\/\/github.com\/MXCHIP\/EasylinkAndroid_Demo\/. Accessed","author":"MXCHIP.","year":"2018","unstructured":"MXCHIP. Easylinkandroid_demo. https:\/\/github.com\/MXCHIP\/EasylinkAndroid_Demo\/. Accessed February 26, 2018 . MXCHIP. Easylinkandroid_demo. https:\/\/github.com\/MXCHIP\/EasylinkAndroid_Demo\/. Accessed February 26, 2018."},{"key":"e_1_3_2_1_19_1","volume-title":"Accessed","author":"IOT.","year":"2018","unstructured":"Nufront IOT. Nl6621 sdk user manual. https:\/\/github.com\/NufrontIOT\/NL6621_StandardSDK\/blob\/master\/Document . Accessed February 26, 2018 . NufrontIOT. Nl6621 sdk user manual. https:\/\/github.com\/NufrontIOT\/NL6621_StandardSDK\/blob\/master\/Document. Accessed February 26, 2018."},{"key":"e_1_3_2_1_20_1","volume-title":"https:\/\/github.com\/NufrontIOT\/NL6621_StandardSDK. Accessed","author":"IOT.","year":"2018","unstructured":"Nufront IOT. Nl6621_standardsdk. https:\/\/github.com\/NufrontIOT\/NL6621_StandardSDK. Accessed February 26, 2018 . NufrontIOT. Nl6621_standardsdk. https:\/\/github.com\/NufrontIOT\/NL6621_StandardSDK. Accessed February 26, 2018."},{"key":"e_1_3_2_1_21_1","first-page":"325","volume-title":"International Workshop on Fast Software Encryption","author":"Paterson Kenneth G","year":"2014","unstructured":"Kenneth G Paterson , Bertram Poettering , and Jacob CN Schuldt . Plaintext recovery attacks against wpa\/tkip . In International Workshop on Fast Software Encryption , pages 325 -- 349 . Springer , 2014 . Kenneth G Paterson, Bertram Poettering, and Jacob CN Schuldt. Plaintext recovery attacks against wpa\/tkip. In International Workshop on Fast Software Encryption, pages 325--349. Springer, 2014."},{"key":"e_1_3_2_1_22_1","volume-title":"https:\/\/www.amebaiot.com\/cn\/standard-sdk-simple-config\/. Accessed","year":"2018","unstructured":"Realtek. Android_simpleconfigwizard. https:\/\/www.amebaiot.com\/cn\/standard-sdk-simple-config\/. Accessed February 26, 2018 . Realtek. Android_simpleconfigwizard. https:\/\/www.amebaiot.com\/cn\/standard-sdk-simple-config\/. Accessed February 26, 2018."},{"key":"e_1_3_2_1_23_1","volume-title":"Accessed","year":"2018","unstructured":"Realtek. Realtek ameba user manual. https:\/\/www.amebaiot.com\/cn\/ameba-sdk-download\/ . Accessed February 26, 2018 . Realtek. Realtek ameba user manual. https:\/\/www.amebaiot.com\/cn\/ameba-sdk-download\/. Accessed February 26, 2018."},{"key":"e_1_3_2_1_24_1","volume-title":"Texas Instruments White Paper","author":"Reiter Gil","year":"2014","unstructured":"Gil Reiter . A primer to wi-fi\u00ae provisioning for iot applications . Texas Instruments White Paper , 2014 . Gil Reiter. A primer to wi-fi\u00ae provisioning for iot applications. Texas Instruments White Paper, 2014."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23294"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/DASC.2014.22"},{"key":"e_1_3_2_1_27_1","volume-title":"http:\/\/www.ti.com\/wireless-connectivity\/simplelink-solutions\/wi-fi\/tools-software.html. Published","author":"TI.","year":"2018","unstructured":"TI. Smartconfigcc3x. http:\/\/www.ti.com\/wireless-connectivity\/simplelink-solutions\/wi-fi\/tools-software.html. Published February 26, 2018 . TI. Smartconfigcc3x. http:\/\/www.ti.com\/wireless-connectivity\/simplelink-solutions\/wi-fi\/tools-software.html. Published February 26, 2018."},{"key":"e_1_3_2_1_28_1","first-page":"97","volume-title":"USENIX Security Symposium","author":"Vanhoef Mathy","year":"2015","unstructured":"Mathy Vanhoef and Frank Piessens . All your biases belong to us: Breaking rc4 in wpa-tkip and tls . In USENIX Security Symposium , pages 97 -- 112 , 2015 . Mathy Vanhoef and Frank Piessens. All your biases belong to us: Breaking rc4 in wpa-tkip and tls. In USENIX Security Symposium, pages 97--112, 2015."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134027"},{"key":"e_1_3_2_1_30_1","volume-title":"Accessed","year":"2018","unstructured":"wikipedia. Wi-fi protected access. https:\/\/en.wikipedia.org\/wiki\/Wi-Fi_Protected_Access . Accessed February 28, 2018 . wikipedia. Wi-fi protected access. https:\/\/en.wikipedia.org\/wiki\/Wi-Fi_Protected_Access. Accessed February 28, 2018."},{"key":"e_1_3_2_1_31_1","volume-title":"Understanding iot security through the data crystal ball: Where we are now and where we are going to be. arXiv preprint arXiv:1703.09809","author":"Zhang Nan","year":"2017","unstructured":"Nan Zhang , Soteris Demetriou , Xianghang Mi , Wenrui Diao , Kan Yuan , Peiyuan Zong , Feng Qian , XiaoFeng Wang , Kai Chen , Yuan Tian , Understanding iot security through the data crystal ball: Where we are now and where we are going to be. arXiv preprint arXiv:1703.09809 , 2017 . Nan Zhang, Soteris Demetriou, Xianghang Mi, Wenrui Diao, Kan Yuan, Peiyuan Zong, Feng Qian, XiaoFeng Wang, Kai Chen, Yuan Tian, et al. Understanding iot security through the data crystal ball: Where we are now and where we are going to be. arXiv preprint arXiv:1703.09809, 2017."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3038912.3052609"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23146"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134089"}],"event":{"name":"WiSec '18: 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks","location":"Stockholm Sweden","acronym":"WiSec '18","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control","SIGMOBILE ACM Special Interest Group on Mobility of Systems, Users, Data and Computing"]},"container-title":["Proceedings of the 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3212480.3212496","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3212480.3212496","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T22:54:15Z","timestamp":1750287255000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3212480.3212496"}},"subtitle":["Harvesting Wi-Fi Credentials from SmartCfg Provisioning"],"short-title":[],"issued":{"date-parts":[[2018,6,18]]},"references-count":34,"alternative-id":["10.1145\/3212480.3212496","10.1145\/3212480"],"URL":"https:\/\/doi.org\/10.1145\/3212480.3212496","relation":{},"subject":[],"published":{"date-parts":[[2018,6,18]]},"assertion":[{"value":"2018-06-18","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}