Automatic Verification and Execution of Cyber Attack on IoT Devices

Abstract

Internet of Things (IoT) devices are becoming a part of our daily life; from health monitors to critical infrastructure, they are used everywhere. This makes them ideal targets for malicious actors to exploit for nefarious purposes. Recent attacks like the Mirai botnet are just examples in which default credentials were used to exploit thousands of devices. This raises major concerns about IoT device security. In this work, we aimed to investigate security of IoT devices through performing automatic penetration test on IoT devices. A penetration test is a way of detecting security problems, but manually testing billions of IoT devices is infeasible. This work has therefore examined autonomous penetration testing on IoT devices. In recent studies, automated attack execution models were developed for modeling automated attacks in cyber ranges. We have (1) investigated how such models can be applied for performing autonomous IoT penetration testing. Furthermore, we have (2) investigated if some well known and severe Wi-Fi related vulnerabilities still exist in IoT devices. Through a case study, we have shown that the such models can be used to model and design autonomous penetration testing agents for IoT devices. In addition, we have demonstrated that well-known vulnerabilities are present in deployed and currently sold products used in IoT devices, and that they can be both autonomously revealed through our developed system.

Applications of LLMs for Generating Cyber Security Exercise Scenarios

“…It also emphasizes the use of domain-specific language for scenario modeling and the integration of various cyber exercise components, aiming to automate the entire cybersecurity exercise life cycle. In their study, F. Lemjan et al [19] investigated the security vulnerabilities of Internet of Things (IoT) devices, emphasizing the need for autonomous penetration testing to address these risks. The research explores automated attack execution models for simulating attacks in cyber ranges and applies these models to autonomously test IoT device security.…”

A Raise of Security Concern in IoT Devices: Measuring IoT Security Through Penetration Testing Framework

“…According to this study, devices that are currently on the market and used worldwide are vulnerable to attacks that could be detrimental to users. Faeroy, Yamin [72], who examined vulnerabilities in IoT devices, such as autonomous monitoring and tracking systems, developed an autonomous agent whose decision-making process paralleled the execution plan model (EP Model). The seven-step PTES comprising (1) pre-engagement interactions, (2) intelligence gathering, (3) threat modeling, (4) vulnerability analysis, (5) exploitation, (6) post-exploitation, and (7) reporting was used in this study.…”

“…Security assessments must be regularly performed against these devices www.ijacsa.thesai.org to prevent cyber intruders from manipulating user devices. Nevertheless, recent research [8,[70][71][72][73][77][78][79] has not offered a solution for normal users to conduct penetration testing. Given the multitude of incomprehensible steps and software to normal users, this approach requires security experts.…”

“…Although the penetration testing conducted by IT expert they are struggling to perform penetration testing on multiple IoT devices manually. Faeroy, Yamin [72] explained that penetration testing IoT devices do not significantly vary from penetration testing larger computer systems. Meanwhile, Suren, Heiding [51] observed that conventional penetration testing has been well-documented over the years as opposed to the IoT ecosystem.…”

Code Integrity and Confidentiality: An Active Data Approach for Active and Healthy Ageing

“…For this purpose, it proposes a novel encryption method called LRO-S to secure sensitive patient data and improve the safety and adaptability of medical professionals’ access to Cloud-based patient-sensitive data. The work in [ 9 ] focused on enabling penetration testing techniques in healthcare IoT devices, in an automatic and systematic manner. Finally, the work in [ 10 ] provides a rigorous and updated state-of-the-art revision of the available mechanisms for healthcare IoT devices.…”