Types of the IoT Vulnerability
Modern IoT Ecosystem is vast and complex, because IoT devices have drastically different architecture and computing power, there is doomed to be no " ONE SIZE FITS ALL" cybersecurity solution, and this in turn gives hackers many opportunities and make IoT industry a lot harder to protect its product/service.
As IoT itself comprises of many layers, like sensing, edge-processing, communication, server and APP etc. , malicious attack against IoT devices can come from all these layers. Due to the constrained resource available to most IoT product as mentioned in #Day 1 's post, we canโt expect same level of protection as general-purpose PC or server. Therefore, IoT security must be looked at from different angles. Check out the figure below for types of Potential Security Weaknesses on different layers summarized by Juniper Research .
-
IoT Sensor / Actuator
Industrial IoT relies heavily on sensors and actuators, yet malicious handling of these sensors and actuators could lead to catastrophic effects. This could happen on even the hardware level, for example, using acoustics or electromagnetic waves to mount transduction attacks that spoof data.
-
Smart Edge Devices
Most bare-metal microcontrollers fall in this category, this also include stripped-down Linux embedded system like smart camera, door lock and etc. Mirai attack mentioned in the #Day 1 post was designed to target these devices.
Attacks for this layer can come from network like Mirai , or OTA update, or from firmware exploitation, like reverse engineer the firmware of the smart device in order to locate bug/vulnerability which leads to attack, or simply replace the firmware with custom firmware to gain total control of the hardware.
-
Communication
As IoT device use a wide spectrum of communication protocol on the physical layer, protocol like WiFi, BLE, Zigbee, NFC can all be targeted using specific tools to hijack, sniff or even block.
Example like Proxmark for hacking NFC
Ubertooth One for hacking BT/BLE
Other than physical layer communication, software communication protocol is also a place that should pay attention to. The most popular MQTT protocol, CoAP and HTTP all has its own limitations in design or implementation, misuse of these procotol could also potential render your device susceptible to attacks.
-
Cloud
This layer is what is talked about the most, as cloud application is ubiquitous. However, attack on this level tends to create greater consequences as compared to other layers.An example is the notorious Stuxnet, this is a very sophisticated malware that targets Window machine using 4 Zero-day vulnerabilities, it has the ability to make big infrastructure like power plant/nuclear station to malfunction.
Another cyber attack happened just recently where hacker hack a PC/server that controls the NaOH level of a water reservoir using Teamviewer and set the NaOH level to extremely dangerous level.
Conclusion
Hope this gives you an idea of how broad the type of IoT attacks can be and learn that IoT is not simply a set of technologies would only make our life better, many considerations have to be put in when designing a secure and safe IoT device.