Hi there, welcome back to this course. Keeping in mind the classic architecture of Iot systems that
you can see in this slide, in this lesson, I will describe what are the typical Iot attacks?
Typical attacks on Iot systems include: attacks on the cloud and the web of Iot architecture, attacks
on mobile apps of Iot architecture, attacks on hardware and firmware of Iot devices, and attacks
on wired and radio communication protocols used by Iot devices such as a Bluetooth protocol, ZigBee, etc..
And among these attacks, we can mention, for example, the replay attacks, jamming attacks,
man in the middle attacks, etc..
Let's consider now, first of all, the Owasp IoT top ten security risks list, that you can see in this
slide.
The first risk is having an IoT system with devices that have weak passwords. For example, the
Mirai malware used in a 2016 attack identified vulnerable Iot devices using a table of more than 60
common factory default usernames and passwords and logs into them to infect them and spread to other
targets.
The second risk is having an IoT system with devices that have either unnecessary or vulnerable
network services.
Another great risk is constituted by the various and possible interfaces of an IoT system that could
present vulnerabilities. Therefore vulnerabilities in Web cloud, mobile interfaces and in general
in APIs used by the Iot system.
A big problem can also arise from Iot systems where the software or firmware update mechanism has vulnerabilities
as indicated in the slide.
Another serious risk is constituted by Iot systems that use software components or libraries that are
not updated or obsolete or no longer maintained by those who develop them.
There is also risk associated with Iot systems that do not adequately protect or abuse personal data
stored in them.
Another risk is the lack of adequate protection, in terms of encryption or access control mechanism, on
the data transiting on the transmission channels or residing on the devices.
The lack of appropriate device management functions is also very critical in terms of updates, monitoring,
response to incidents, etc..
Owasp also identifies as a risk factor the fact that Iot devices are often supplied with insecure
default configurations and without the possibility of modifying them.
Talking about the lack of physical hardening, some considerations can be made. The first step in protecting
a device prior to going into production is to remove all physical, radio or optical ports that were there
for development purposes.
Of course, at least one part is required to connect the production device to the local network or back
into the cloud.
But all other ports that are no longer required should be removed, including any circuit board
tracks that connect the port into the circuitry.
Similarly, all test points should ideally be removed, including pins and circuit tracks, or at
least effectively disabling test access by, for instance, blowing on-chip fuses for JTAG.
OK, this lesson ends here.
Thank you for your attention bye.