  Personalized IoT adapts their behavior based on contextual information, such
as user behavior and location. Unfortunately, the fact that personalized IoT
adapts to user context opens a side-channel that leaks private information
about the user. To that end, we start by studying the extent to which a
malicious eavesdropper can monitor the actions taken by an IoT system and
extract users' private information. In particular, we show two concrete
instantiations (in the context of mobile phones and smart homes) of a new
category of spyware which we refer to as Context-Aware Adaptation Based Spyware
(SpyCon). Experimental evaluations show that the developed SpyCon can predict
users' daily behavior with an accuracy of 90.3%. The rest of this paper is
devoted to introducing VindiCo, a software mechanism designed to detect and
mitigate possible SpyCon. Being new spyware with no known prior signature or
behavior, traditional spyware detection that is based on code signature or app
behavior is not adequate to detect SpyCon. Therefore, VindiCo proposes a novel
information-based detection engine along with several mitigation techniques to
restrain the ability of the detected SpyCon to extract private information. By
having general detection and mitigation engines, VindiCo is agnostic to the
inference algorithm used by SpyCon. Our results show that VindiCo reduces the
ability of SpyCon to infer user context from 90.3% to the baseline accuracy
(accuracy based on random guesses) with negligible execution overhead.

Cryptography and Security