IoT Threats and Vulnerabilities 22 1 Vulnerable device software IoT devices rely on software that might contain poor design choices and/or security bugs such as buffer overflows and improper exception handling. This makes them vulnerable to many different attacks that can compromise data confidentiality or integrity. 2 Privacy threat Device location tracking poses a privacy risk to users; an attacker can infer sensitive information from data gathered and communicated by devices. Such information may be sold to interested parties for marketing purposes or used for unauthorised surveillance. 3 Eavesdropping Communication over an IoT network can be intercepted and deciphered if the communication channel is not sufficiently protected, for instance if keying material, security parameters, or configuration settings are exchanged in the clear or if weak or unsuitable cryptographic algorithms are used. Related attacks include man-in-the-middle, session hijacking, or message replay. 4 Denial of Service (DoS) Devices, being resource-constrained, are susceptible to denial of service attacks launched by attackers sending continuous requests to deplete device resources. On the other hand, compromised devices can themselves be used to disrupt the operation of other networks or systems via a Distributed DoS (DDoS) attack. 5 Firmware-level attack An attacker may be able replace device firmware during device commissioning or under the guise of a routine upgrade. 6 Device cloning or substitution A non-trusted factory can clone the physical characteristics, firmware/ software and security configuration of the device. Deployed devices might also be compromised and their software reverse-engineered, allowing for cloning. Cloned devices may be sold cheaply in the market and can contain functional modifications including backdoors. Alternatively, a genuine device may be substituted with a variant or clone during transportation or commissioning. 7 Data leakage Disclosure of sensitive data, intentionally or unintentionally, to unauthorised parties. Confidential data may be captured by an attacker from individual devices, during transit, or from the back-end. 8 Malware Devices can be infected with programs designed to carry out unauthorised actions on a system, possibly using existing vulnerabilities in software or firmware. 9 Weak user/admin credentials and authentication Poor credential management such as weak password choices and lack of multi-factor authentication for the user and administrative interfaces of devices, gateways or back-ends is a common vulnerability in many information systems including IoT. Table 1: IoT Threats and Vulnerabilities