Chapter 2. Vulnerabilities, Attacks, and Countermeasures

This chapter elaborates on attack methods against IoT implementations and deployments, how attacks are organized into attack trees, and how IoT cyber-physical systems complicate the threat landscape. We then rationalize a systematic methodology for incorporating countermeasures to secure the IoT. We will explore both typical and unique vulnerabilities seen within various layers of an IoT technology stack, and describe new ways in which electronic and physical threats interact. We provide a tailored approach to threat modeling to show the reader how to develop and maintain usable threat models in their own organizations.

We will explore vulnerabilities, attacks, and countermeasures, and methods of managing them through the following chapter subsections:

• Primer on threats, vulnerability, and risk
• Primer on attacks and countermeasures
• Today's IoT attacks
• Lessons learned—the use of systematic approaches

Primer on threats, vulnerability, and risks 

A substantial amount of academic wrangling has evolved competing definitions for the concepts of threats, vulnerability, and risks. In the interest of keeping this volume practical and usable, we first revisit in this section what the information assurance industry has termed the five pillars of information assurance. These pillars, or domains, of information assurance represent the highest-level categories of assurance in an information system. Next, we will introduce two additional pillars that are critically important in cyber-physical systems. Once introduced, we then explore IoT threats, vulnerabilities, and risks.

The classic pillars of information assurance

It is nearly impossible to discuss practical aspects of threat, vulnerability, and risk without identifying the essential components of Information Assurance (IA), an important subdomain of IoT security. Succinctly, they are as follows:

• Confidentiality: Keeping sensitive information secret...

Primer on attacks and countermeasures

Now that we have briefly visited threats, vulnerabilities, and risk, let's dive into greater detail on the types and compositions of attacks present in the IoT and how they can be put together to perform attack campaigns. In this section, we will also introduce attack trees (and fault trees) to help readers visualize and communicate how real-world attacks can happen. It is also our hope that they gain wider adoption and use in broader threat modeling activities, not unlike the threat model example later in this chapter.

Common IoT attack types

There are many attack types covered in this book; however, the following list provides some of the most significant as they relate to the IoT:

• Wired and wireless scanning and mapping attacks
• Protocol attacks
• Eavesdropping attacks (loss of confidentiality)
• Cryptographic algorithm and key management attacks
• Spoofing and masquerading (authentication attacks)
• Operating system and application integrity attacks
• Denial of service...

Today's IoT attacks

Many of today's attacks against consumer IoT devices have been largely conducted by researchers with the goal of bettering the state of IoT security. These attacks often gain wide attention, and many times result in changes to the security posture of the device being tested. Conducted responsibly, this type of white hat and gray hat testing is valuable because it helps manufacturers address and fix vulnerabilities before widespread exploitation is achieved by those with less benevolent motives.

It is generally bittersweet news for manufacturers, however. Many manufacturers struggle with how to properly respond to vulnerabilities reported by security researchers. Some organizations actively enlist the aid of the research community, and some organizations operate their own bug bounty programs for which security professionals are encouraged to find and report vulnerabilities (and get rewarded for them). Other organizations, however, turn a blind eye to vulnerabilities reported...

Lessons learned and systematic approaches

IoT systems can be highly complex implementations that encompass many technology layers. Each layer has the potential to introduce new vulnerabilities into the overall IoT system. Our discussions related to potential airline attacks as well as real-world automobile attacks provide glimpses into understanding how overcoming the vulnerabilities of each component within a system is critical in combating highly motivated attackers from reaching their goals. This becomes even more concerning as the IoT intersects safety and security engineering in the physical and electronic worlds. Described earlier, collaboration between the security engineering discipline and other engineering disciplines is needed now to allow system designers to build security into the foundations of their products and guard against attacks that focus specifically on removing, dismantling, or reducing the effectiveness of safety controls in IoT CPS.

An interesting point related to...

Summary

This chapter explored IoT vulnerabilities, attacks, and countermeasures by illustrating how an organization can practically define, characterize, and model an IoT system's threat posture. With a thorough understanding of the security (and in some cases, safety) risks, appropriate security architectural development can commence so that appropriate mitigations are developed and deployed to systems and devices throughout the enterprise.

In Chapter 3, Approaches to Secure Development, we will discuss the IoT security life cycle.