Consumer, Commercial, and Industrial IoT (In)Security: Attack Taxonomy and Case Studies

Abstract

Internet of Things (IoT) devices are becoming ubiquitous in our lives, with applications spanning from the consumer domain to commercial and industrial systems. The steep growth and vast adoption of IoT devices reinforce the importance of sound and robust cybersecurity practices during the device development life-cycles. IoT-related vulnerabilities, if successfully exploited can affect, not only the device itself, but also the application field in which the IoT device operates. Evidently, identifying and addressing every single vulnerability is an arduous, if not impossible, task. Attack taxonomies can assist in classifying attacks and their corresponding vulnerabilities. Security countermeasures and best practices can then be leveraged to mitigate threats and vulnerabilities before they emerge into catastrophic attacks and ensure overall secure IoT operation. Therefore, in this paper, we provide an attack taxonomy which takes into consideration the different layers of IoT stack, i.e., device, infrastructure, communication, and service, and each layer's designated characteristics which can be exploited by adversaries. Furthermore, using nine real-world cybersecurity incidents, that had targeted IoT devices deployed in the consumer, commercial, and industrial sectors, we describe the IoT-related vulnerabilities, exploitation procedures, attacks, impacts, and potential mitigation mechanisms and protection strategies. These (and many other) incidents highlight the underlying security concerns of IoT systems and demonstrate the potential attack impacts of such connected ecosystems, while the proposed taxonomy provides a systematic procedure to categorize attacks based on the affected layer and corresponding impact.

Analysis of Security Issues and Countermeasures for the Industrial Internet of Things

“…We also argue that the attackers can further attack a communication without redirecting the whole data packet; instead, the attackers can infect selected data packets for specific information. Finally, an attacker can flood the network with unnecessary data packets to collapse the bandwidth or resources of an attacked system, which will consequently impact the performance of the complete system [171].…”

Load-Altering Attacks Against Power Grids Under COVID-19 Low-Inertia Conditions

“…Specifically, we provide the details of attack exploitation of an HVAC system (load-side) which can lead to tampering of operation information and system configuration, leading even to denialof-service (DoS) conditions. A similar type of attack can also be performed on the distributed energy resources (DER) side, e.g., solar inverters, in which firmware backdoors could enable access to weakly encrypted user passwords, which could then be reversed allowing unauthorized access [23], [24].…”

Distributed Energy Resources Cybersecurity Outlook: Vulnerabilities, Attacks, Impacts, and Mitigations

“…The IoT is a network of connected devices including smart appliances (e.g., smart thermostats, air-conditioning, heat pumps, EVCS points, etc. ), enabling the exchange of information between devices and users leveraging wired and wireless connections [80]- [82]. These IoT-enabled devices are connected to the load-end of DERs and their operation is typically orchestrated remotely by their end users.…”