The Internet of Things (IoT) is a system of interrelated computing devices, mechanical and digital machines equipped with unique identifiers (UIDs) which have the ability to collecting, sharing, and analyzing data over a networking without requiring human-to-human or human-to-computer interactions. It is an interconnection of heterogeneous entities where the term “entity” refers to a human, sensor, or anything that may request or provide a service. As more wireless networks come online, the total number of IoT devices around the world will only expand the scope of IoT devices and applications. Vendors are now leveraging IPv6 address schemes with high-speed Internet connections to improve the design and performance of IoT devices, thus creating an increased growth and demand for new IoT products.
IoT is playing a key role in transforming everyday life with a greater connectivity and functionality generating data faster than most applications can process and filter. By combining these connected devices with automated systems, it is possible to gather information, analyze it, and create an action or event to help someone with a task or learn from a process. However, many IoT devices have several operational limitations on the computational power available to them. These constraints often make them unable to implement basic security measures and have a low price and consumer focus of many devices makes a robust security patching system uncommon.
The scope of IoT applications has opened the door for many new business opportunities and revenue streams. Many businesses who implement IoT services to have a better view of operational expenses creating a better marketing insight based on consumer behavior and product placement. This can lead to a reduction in the total time it many take for a product to be available to a consumer. IoT also offers businesses just-in-time training for employees to improve labor efficiency to increasing organizational productivity. Logistics and supply chains are improved with IoT by creating a unique identifier for individual items from supply chains to make intelligent choices on how to deliver goods and services more efficiently to consumers. IoT helps manufacturing companies to measure a product’s performance, diagnose errors, and improve a product’s quality, performance, and support.
II. IoT reference model
The initial proposed IoT reference model consists of three levels and represents IoT as an extended version of wireless sensor networks (WSN).
In 2014, a new IoT Reference Model was created by Cisco and consists of the following seven levels and has data generally flowing in a bidirectional manner.
|7||Collaboration and processes (People & Business Processes)||User-side|
|6||Application (Reporting, Analytics, Control)||Server/Cloud-side|
|5||Data Abstraction (Aggregation & Access)|
|4||Data Accumulation (Storage)|
|3||Edge Computing (Data Analysis & Transformation)||Edge-side|
|2||Connectivity (Communication & Processing Units)|
|1||Physical Devices & Controllers (Devices)|
Level 1 – This level is concerned with physical devices at the edge-side, this contains the physical devices such as: smart controllers, sensors, and RFID reader. Data confidentiality and integrity is considered from here upward.
Level 2 – This level contains all communication and processing units that enable the transmission of data or commands by using routing and switching protocols. Communication happens between IoT devices in the first level and components in the second level, including communication across data networks.
Level 3 – Edge Computing, is simple data processing that is initiated and is essential for reducing computation loads in the higher levels as well as providing a fast response to events. Learning algorithms are implemented at this level.
Level 4 – Data Accumulation, data is combined from multiple sources to enable the conversion of data in motion to data at rest. At this level, data is converted into a format from network packets to database tables then is determined if it’s of interest to higher levels through filtering and selective storing for future analysis or shared with high levels computing servers.
Level 5 – Data Abstraction, this provides the opportunity to read and store data such that further processing becomes simpler or more efficient. Services at this level may include data normalization/denormalization then indexing and consolidating data into one place with access to multiple data stores.
Level 6 – Applications information interpretation and software cooperates with data accumulation and data abstraction levels.
Level 7 – This level involves users and business processes using IoT applications and their analytical data to make informed choices.
III. Fog and Edge Computing in IoT
IoT vendors are implementing edge and fog computing technology to providing enhanced data analysis and management to increase the scope of possible IoT applications. In computer networking, the control plane is the part of the router architecture that is concerned with the network topology or the information generated in the routing table that defines what to do with incoming packets. The data plane is the part of the software the processes the data requests. Fog computing is a standard that defines how edge computing should work and it facilitates the operation of computation, storage, and networking services between IoT devices and cloud computing centers. This enables computing services to reside at the edge of the network as opposed to servers in a data center. Whereas, the control plane is the part of the software that configures, and shuts downs the data plane. In Fog computing, there is only one centralized computing device responsible for processing data from different endpoints in the networks. This style of architecture uses edge devices to carry data out from substantial amount of computation storage and communication locally then sending it over the Internet backbone. Fog computing can be perceived both in large cloud systems and big data structures, referring to the growing difficulties in accessing information objectively. This brings data closer to the user as compared to storing data far from the end point in data centers, providing location awareness, low latency, and improves the overall quality of service.
Edge computing is located at the edge of the network, this how IoT data is collected and analyzed directly by controllers or sensors then transmitted to a nearby computing device for analysis. This brings processing closer to the data source and does not need to be sent to a remote cloud or other centralized system for processing. This eliminates the distance and time it takes to send data to a centralized source, which improves the speed and performance of data transport, as well as devices and applications on the edge. Instead of completely depending on a cluster of clouds for computing and data storage, edge computing can prove intelligent services by leveraging local computing and local edge devices. Edge computing applications can pre-process, filter, score, and aggregate data.
|Edge Computing||Fog Computing|
|Pushes communication capabilities, processing power, and intelligence data directly into devices; programmable automation controllers||Pushes intelligence data to the local area network and processes data either in IoT gateway or a fog node.|
IV. The Vulnerabilities of IoT
Security is a significant challenge for company to adopt and deploy IoT innovations. There is not much motivation for vendors to change with little or no consequences for selling insecure devices since device can be manufactured very cheaply and are not maintained with regular patches and updates by vendors. An example of a major security concert for integrated circuits is hardware trojans. A malicious modification of an integrated circuit (IC) enables an attacker to use the circuit or exploit its functionality obtain access to data or software running on the integrated circuitry.
- Externally Activated (Antenna or sensor)
- Internally Activated (Given Condition; Logic)
IoT systems are higher security risk for several other reasons: insecure network interface or services, insufficient authentication/authorization. These systems might include data or services that were not designed to be connected to the global Internet. These systems may not have a well-defined perimeter and are continuously changing due to device and user mobility.
IoT systems are highly diverse in character with respect to communication medium and protocols, platforms and devices. As a result, IoT systems, or portions, could be physically unprotected and/or controlled by different parties. Also, IoT devices could be autonomous entities that control other IoT devices. Routing Attacks against IoT network will affect how packets are routed in by being spoofed, redirected or misdirected to another network. An attacker can inject fraudulent packets into communication links using three different methods: insertion, manipulation, or replication.
There are several communication vulnerabilities in IoT devices sometimes as a result of a lack of transport encryption/integrity verification this may cause packet being intentionally listening to private conversions over the communication lines by a third party. As a result, there are several privacy concerns with IoT devices such as: Insufficient security configurability, insecure software/firmware, and poor physical security.
DOS Attacks is standard attacks used against IoT devices that jams the transmission of radio signals by either continuous jamming by blocking all transmissions or intermittent jamming by reducing the performance of systems. There are three well know types of DOS attacks against edge computing nodes: battery draining, sleep deprivation, and outage attacks. When a DoS battery draining attack happens nodes usually must carry small batteries with very limited energy capacity. In a Sleep Deprivation attack, the victim is a battery powered node with a limited energy capacity the attacker attempts to send an undesired set of requests that seem to be legitimate. Lastly an outage attacks happens when an edge node outage occurs when an edge device steps performing its normal operations
V. Botnets and Internet of Things
A botnet is a robot network of compromised machines, or bots, that run malicious, or bots, that run malicious software under the command-and-control of a bot master. Bots can automatically scan entire network ranges and propagate themselves using known vulnerabilities and weak passwords an on other machines. Once a machine is compromised, a small program is installed for future activation by the bot master, who at a certain time can instruct the bots in the network to execute actions. A network of infected machines or bots (zombies) that has a command-and-control infrastructure and is used for various malicious activities. Botnet architecture has evolved over time in an effect to evade detection and disruption. Bot programs are constructed as clients with communicate via existing servers. This allows the bot master to perform all control form a remote location, which obfuscates their traffic in a Client-Server or Peer-to-Peer network.
Once the software is downloaded, the botnet will now contact its matter computer and let it know that everything is ready to go. An individual botnet device can be simultaneously compromised type of attack and often at the same time. Servers may choose to outline rules on the behavior of internet bots. This informs the web robot about which areas of the website should not be processed or scanned.
The text file, robots.txt, is normally place on the root of a webserver to govern a bot’s behavior on that server, then it can be used by search engines to categorize websites. Robots that choose to follow the instructions try to fetch this file and read the instructions before fetching any other file from the website. If this file does not exist, web robots assume that the website owner is not wishing to place any limitations on crawling the entire site.
Botnets can be used to perform Distributed Denial of Service (DDoS) attacks, steal data, send spam, allow an attacker to access the devise and its connection, or mine cryptocurrency. A Distributed Denial of Service (DDoS) attack is a malicious attempt to make a server or a network resource unavailable to users. It is achieved by saturating a service, which results in its temporary suspension or interruption. The goal of the attacks is to overwhelm a target application with an extreme number of requests per second (RPS) with high CPU and memory usage. A single machine used to either target a software vulnerability of flood a targeted resource with packets, requests, and queries. Application layer type DDoS attacks occur by Http floods, slow attacks, or Zero-day assaults.
|Network layer DDoS Attacks|
|UDP Floods||Gigabits per second (GPS)|
|SYN Floods||Packets per second (PPS)|
|NTP Amplification||Consume the targets upstream bandwidth|
VI. The Mirai Botnet
On October 12th, 2016, a massive DDoS attack left much of the internet inaccessible on the United States East Coast. This was a first of a novel category of botnets that exploit IoT device & systems, turning IoT devices that ran a Linux operating system into a remotely controlled bots that can be used as port of a botnet in large scale network attacks. It primarily targets online consumer devices such as: IP cameras and/or home routers. Mirai has two core purposes to locate and compromised IoT devices to further grow the botnet and launch DDoS attacks based on instructions received from a remote command and control. Mirai performs wide-ranging scans of IP addresses, continuously scan the internet of the IP address of IoT devices. Yet, there is hardcoded list of IP address ranges which Mirai bots are programmed that it will not infect during scans. These addresses belong to the US Postal Service, the Department of Defense, the Internet Assigned Numbers Authority (IANA), Hewlett-Packard and General Electric.
Mirai identifies Locating under-secured IoT devices that could be remotely accessed vulnerable IoT devices using a table common factory default username & passwords, and log into them to infect them with the Mirai malware. Attack function enable it to HTTP flood and OSI layers 3 to 4. DDoS attacks when attacking HTTP floods, Mirai bot hide behind default user-agents. Infect devices will continue to function normally, except for occasional sluggishness, and an increased use of bandwidth.
If an IoT device becomes infected with the Mirai, an administrator should immediately disconnect the device from the network, then reboot the device. Since Mirai malware exists in dynamic memory rebooting the device clears the malware. Afterwards ensure that the previous password for accessing the device has been changed to a strong password. If you reconnect before changing the password, the device could be quickly infected again with the Mirai malware.
VII. Countermeasures/ Protection Techniques of IoT Devices
The following are basic protection techniques suggested by the Cybersecurity and Infrastructure Security Agency (CISA) that would provide basic IoT security protection against a 3rd party or hostile attacker. A many IoT devices might not have powerful processors or enough memory to have an intrusion-detection analysis will likely occur at a gateway device.
An IoT device owner should stop using default/generic passwords and disable all remote (WAN) access to the device. Ensure that all default passwords on the IoT devices have been changed. Updating devices with security patches from the manufacture, when available. Even if a device has a have known software vulnerabilities, patches or work arounds might not be downloaded for a very long period; thus intrusion-detection technique becomes more important.
Device administrators must disable universal plug and play (UPnP) on routers, unless necessary. Lastly, a networking administrator should monitor port 48101 for suspicious traffic on as infected devices often attempt spread malware by using this port to send results to a 3rd party or threat actor. Also, monitoring TCP ports 23 and 2323 for 3rd party to attempts to gain unauthorized control over IoT devices using the network terminal.
As more developers and vendors push new IoT devices and services to the Internet this will lead to the discovery of new IoT threats and attacks against users and systems to control a system or steal data. Most IoT system are designed to a specific application or service and testing the security of the system might be complex and time consuming, but it’s necessary as the number of new devices deployed to the Internet increases each week. Some security threats might not be as widely recognized or known as other are, but new threats to IoT devices and application should be made aware by security professionals and publicly available to developers and administrators to minizine the scope of possible risk to users and devices.
Bertino, E., & Islam, N. (2017, February 2017). Botnets and Internet of Things Security. Computer, 76-79.
Burgess, M. (2018, February 16). What is the Internet of Things? WIRED explains. Retrieved from WIRED: https://www.wired.co.uk/article/internet-of-things-what-is-explained-iot
Cisco. (2014). The Internet of Things Reference Model. Cisco.
CLOUDFLARE. (2020). What is a DDoS Attack? Retrieved from CLOUDFLARE: https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/
Cybersecurity and Infrastructure Security Agency. (2017, October 17). Alert (TA16-288A) – Heightened DDoS Threat Posed by Mirai and Other Botnets. Retrieved from Cybersecurity and Infrastructure Security Agency: https://www.us-cert.gov/ncas/alerts/TA16-288A
Fruhlinger, J. (2018, March 9). The Mirai botnet explained: How teen scammers and CCTV cameras almost brought down the internet. Retrieved from CSO: https://www.csoonline.com/article/3258748/the-mirai-botnet-explained-how-teen-scammers-and-cctv-cameras-almost-brought-down-the-internet.html
Herzberg, B., Zeifman, I., & Bekerman, D. (2016, October 26). Breaking Down Mirai: An IoT DDoS Botnet Analysis. Retrieved from Imperva: https://www.imperva.com/blog/malware-analysis-mirai-ddos-botnet/
MOSENIA, A., & JHA, N. (2017). A Comprehensive Study of Security of Internet-of-Things. IEEE Transactions on Emerging Topics in Computing, 586-602.
Norton. (2020). What is a distributed denial of service attack (DDoS) and what can you do about them? Retrieved from Norton: https://us.norton.com/internetsecurity-emerging-threats-what-is-a-ddos-attack-30sectech-by-norton.html
Shah, H. (n.d.). Edge computing and Fog computing for enterprise IoT. Retrieved from SIMFORM: https://www.simform.com/iot-edge-fog-computing/