RetroIoT: Retrofitting Internet of Things Deployments by Hiding Data in Battery Readings.

Commercial Internet of Things (IoT) deployments are mostly closed-source systems that offer little to no flexibility to modify the hardware and software of the end devices. Once deployed, retrofitting such systems to an upgraded functionality requires replacing all the devices, which can be extremely time and cost prohibitive. End users cannot generally leverage deployed infrastructure to add their own sensors or custom data. However, we observe that IoT systems sometimes report battery voltage information to the cloud, and batteries are often user-serviceable. This indicates that perturbing the battery voltage to encode customized information could be a minimally invasive method to retrofit existing IoT devices. In this paper, we propose a new approach, RetroIoT, to encode custom commands and data into the battery voltage channel of IoT systems and retrofit devices with enhanced capabilities. RetroIoT enables this functionality by replacing the device's original battery with a controlled power supply that manipulates the input voltages of the battery terminal. RetroIoT can encode both analog values and digital symbols which are later decoded once the battery voltage readings are stored in the cloud. This retrofit data channel enables transmitting additional data, sending new metadata, and even swapping batteries for energy-harvesting. This technique requires no modification to the IoT device beyond replacing the battery. We prototype this technique using two commercial LoRa devices and one BLE device. Results show a 95th percentile channel error of only 3.96 mV and 99% successful packet decoding with digital symbols.