Sri Lanka Institute of Information technology

2022

Introduction to Cyber Security – IE2022

Topic: IoT creates new Cybersecurity threats.
Year 2,
Semester 1

Student Registration Number Student Name

IT21160684 Premarathna G.T. T

Y2. S1.WD.CS.02. G01

MALABE CAMPUS

1|Page IT21160684
Contents
1. Abstract......................................................................................................... 3
2. Introduction .................................................................................................. 4
2.1 Introduction to IoT................................................................................... 4
2.2 Introduction to IoT Threats ................................................................... 6
2.2.3 Vulnerabilities of IoT applications .................................................... 6
2.3 Primary security goals of IoT [] ............................................................. 7
3. Evolution ....................................................................................................... 8
3.1 Possible attacks ................................................................................. 15
4. Future developments in the area........................................................... 17
4.1 IoT companies and a circular economy [] ........................................ 17
4.2 IoT security improvements [] ............................................................ 18
4.3 AI & IoT [] ............................................................................................... 18
4.4 IoT Networks decentralized [] ........................................................... 19
5. Conclusion ................................................................................................. 19

2|Page IT21160684
1. Abstract

Internet of Things (IoT) devices are rapidly becoming ubiquitous, while IoT services are
becoming ubiquitous. Their success has not gone unnoticed, and the number of threats
and attacks against IoT devices and services is also increasing. Cyber-attacks are not
new to the IoT, but as the Internet of Things becomes deeply connected to our lives and
societies, it is necessary to step up and take cyber defenses seriously. So, there is a
real need to secure the IoT, which in turn has resulted in a need to comprehensively
understand the threats and attacks on the IoT infrastructure .
IoT devices collect and process information from remote locations and have greatly
increased the productivity of distributed systems or individuals. Due to the limited power
budget, IoT devices typically do not include security features such as advanced data
encryption and device authentication. In general, the hardware components deployed in
IoT devices do not come from high-end markets. As a result, the integrity and security
assurance of most IoT devices is questionable. For example, an adversary can
implement a hardware Trojan (HT) into the manufacturing process of IoT hardware
devices to cause information leakage or malfunctions .
This article is an attempt to classify the types of threats, we examine IoT security threats
with a particular emphasis on attacks that aim to compromise the communication
interface between IoT devices and their main processing host. First, we introduce What
is Internet of things (IoT) and an introduction to IoT threats. Second, we will explore the
security vulnerabilities of IoT and primary security goals of IoT. Third, we discuss about
evolution in IoT threats and analyze the security threats. in addition to analyzing and
characterizing the intruders and attacks faced by IoT devices and services.

3|Page IT21160684
2. Introduction

2.1 Introduction to IoT

Many people and organizations have provided different definitions of IoT. IoT is
not a new concept. In the previous era, the Internet connected people, so it was
called the "Internet of People." A few years ago, the Internet was not widely
available in industries, research institutes and the government sector . The
concept of M2M, machine-to-machine, was introduced to allow machines to talk
to each other using some wired or wireless technology to make collaborative
decisions and perform some tasks. It is also known as Sensor Network.
Nowadays, the internet is widely available to every person at a low cost, so these
IoT objects (cloud/web server/node/sensor/machine/application) have direct
connectivity to the internet and send their data through the internet to objects
Security and all these IoT objects are considered things, so it is called "Internet of
Things". [1] Cisco gave its name as "The Internet of Things". Bruce Schneier[2]
named it "World Size Web" . In the Terminator movie, "Skynet" was the name of
the IoT concept. Now let's discuss more about things in IoT. Things are primarily
identified as objects of the physical world and objects of the information world
(virtual). Things have unique identities and able to communicate with each other
through a communication layer. Physical things are the environment, sensors,
electro-electronic devices, actuators, etc. while IoT applications (web/mobile
applications), Twitter, Facebook, Thingspeak, Blynk, etc. are virtual things that
can be stored, processed and accessed.
Therefore, IoT is a connected network of physical and virtual objects (devices,
vehicles, buildings and other items with electronics, software, web application,
mobile application, sensors and network connection, etc.) that allows these
objects to collect and exchange data as described in ( Wikipedia, n.d.).
Therefore, as shown in Ex1, IoT is an environment that connects people and
processes with physical/virtual objects (sensors) through some connection
technologies .
In IoT by accessing web/mobile IoT applications such as CRM system, remote
monitoring/maintenance/supply chain management, location tracking and many
more people can participate. Eg: In location tracking applications in at certain
intervals the GPS sensors send their location data to their configured server, to
the server that processes the data and stores it in the database, the mobile
application and the web application provide an interface for the user to access
this data and take the necessary action/decision based on the request of the
application.
At the core of IoT are sensors and actuators. There are many known sensors
that are readily available in the market and widely used by people, government
and industry as per the application requirements as shown in Ex2.

4|Page IT21160684
EX 1

EX 2

5|Page IT21160684
Few Actuators, Sensors, Development Boards and Power Supplies are described as
below .
1. Raspbery PI
2. Arduino
3. NodeMCU
4. Bluetooth Module
5. Solenoid Value
6. Water flow sensor
7. Ultra-sonic sensor
8. Soil moisture sensor

2.2 Introduction to IoT Threats

Anyone who uses the Internet is well aware of the risk of cyber-attacks that bombard
computers almost every day. Viruses, worms, Trojan horses, botnets and other forms of
malware have become all too familiar parts of the online experience, as have persistent
efforts to breach security.
The fact that IoT systems necessarily contain sensors that collect data from the physical
world exposes them to a whole new attack vector. In addition to a number of traditional
online threats, flooding a sensor with electromagnetic radiation can cause it to
malfunction. Even worse, a more sophisticated attacker can send carefully calibrated
false information to the sensor that can cause the system to take actions that the actual
situation does not warrant. For example, something as simple as falsifying location data
can cause a connected car to veer far off course.

2.2.3 Vulnerabilities of IoT applications

A typical IoT device has no security features beyond a default password. This
security oversight allows remote attackers to control the entire system using unpatched
vulnerabilities. The more ways devices can connect, the more opportunities
cybercriminals have to exploit. IoT vulnerabilities therefore include non-Internet
weaknesses such as those found between Bluetooth devices. IoT devices are
considered the weakest element of a wireless system, allowing hackers to penetrate the
network, control computers or even spread malware. Here are a few reasons:
Lack of security software: Most IoT devices do not have the ability to incorporate
antivirus or firewall protection . They are therefore easily exploitable.
Lack of cyber security awareness: Modern times have witnessed an ever-increasing
number of industries going digital. But relying on inherently vulnerable IoT devices is

6|Page IT21160684
itself a major cybersecurity flaw that many companies are ignoring—and threat actors
are exploiting.
Large attack surface: Wireless connections between IoT devices present a wider
attack surface with countless entry points that hackers can access remotely.

2.3 Primary security goals of IoT [3]

To succeed in implementing effective IoT security, we need to be aware of the
primary security goals. Traditional security goals are generally known as “CIA-triad
(Confidentiality, Integrity, and Availability)”.

Confidentiality
Confidentiality is an important security feature in IoT but may not be mandatory in
some scenarios where data is presented publicly but in most situations, sensitive data
must not be disclosed or read by unauthorized entities. As an example, patient data,
private business data and/or military data, as well as security credentials and secret
keys, must be hidden from unauthorized entities.

Integrity
To provide reliable services to IoT users, integrity is a mandatory security feature in
most cases. Different systems in the IoT have different integrity requirements. For
example, a remote patient monitoring system will have a high integrity check against
random errors due to information sensitivity. As a result of communication, data may be
lost or manipulated, causing loss of human life.
Availability
The user of the device (or the device itself) must be able to access the services
whenever and wherever needed. The various hardware and software components in
IoT devices must be robust to provide services even in the presence of malicious
entities or adverse situations. Different systems have different availability requirements.
For example, fire monitoring or health care monitoring systems would likely have higher
availability requirements than roadside pollution sensors

7|Page IT21160684
3. Evolution

IoT devices are finding their way into our lives through various sectors such as
homes, businesses, and the like on. With this rapid increase in the connectivity of
embedded devices, the solutions are set to revolutionize it manufacturing, industry,
supply chain management, logistics, retail, infrastructure management, food
manufacturing, surveillance and many other sectors that combine data collection,
monitoring and analysis.
At the same time, it is necessary to process and understand the huge amount of data
from which they are developed thousands of devices, artificial intelligence, machine
learning, big data and other trending technologies. Making everything "smart" in the
consumer space often seems like a solution in search of a problem. Manufacturers of
home appliances such as smart TVs, wearables, toys, home automation systems,
automobiles, etc. rush to bring the next big thing to market and add connectivity to
seemingly every new thing product.
As the market and technology advance, more standards and best practices should
emerge to guide the IoT equipment manufacturers in developing and delivering safer
products. IoT devices can pose a security threat in multiple ways because they are
often connected to a higher value goals. Therefore, ensuring the security and
governance of the Internet of Things is essential in this rapid innovation device.

According to evolution of IoT attacks, there are 3 Eras.

• First Era – The age of exploration (2005-2009)
• Second Era – The age of exploitation (2011- 2019)
• Third Era – The age of protection (2020)

8|Page IT21160684
 First Era – The age of exploration (2005-2009)
Security is not priority for early IoT/ embedded devices. Most cyberattacks are limited to
malware and viruses impacting windows based embedded control systems. Instead of
actively putting up a defense, organizations assume no one would bother to attack
these devices running in isolated networks.
• Security methods and technologies include
• Security by obscurity
• Minimal security, often easily passed
• Secure protocols (SSH of SSL) used in a few systems (no other security
controls)
• Air gapped networks
Second Era – The age of exploitation (2011- 2019)
The number of connected devices is exploding, and cloud connectivity is becoming
commonplace. Criminals improve their ability to monetize attacks on IoT devices
through crypto mining, ad-click fraud, and spam email campaigns. Nation state actors
use IoT devices for politically motivated attacks. While many security technologies are
being adopted, their use is inconsistent, incomplete and sometimes flawed, resulting in
many devices that are still vulnerable.
• Security protocols (TLS and SSH)
• Secure boot
• TPM or Secure Element for secure key storage
• Hardened operating systems
• Embedded fire wall

Third Era – The age of protection (2020)

Connected devices are ubiquitous in every area of life, from transportation and
manufacturing to medicine and environment. In response to this growing number and
severity of attacks, governments and industrial groups began to enact legislation
requiring higher levels of security for IoT devices. Because hackers will continue to find
“soft targets” in legacy and new devices implemented without strong security measures,
companies worldwide are beginning to build strong security controls in to IoT devices,
using security frameworks and unidentified solutions with key security technologies that
work together to provide multiple layers of protection. Chief components include.
• Security protocols (TLS and SSH)
• Secure boot
• TPM or Secure Element for secure key storage
• Hardened operating systems
• Embedded fire wall and intrusion detection
• Data at rest protection

9|Page IT21160684
IoT attacks since 2005 – 2020[4]

STUXNET VIRUS 2005 [4]

Used to attack a uranium enrichment facility at Natanz, Iran, this virus was an early
indicator of IoT vulnerabilities and how they can lead to critical national infrastructure
breaches.

HACKABLE HEART MONITORS 2008

Researchers found that implantable cardiac defibrillators (ICDs) could be externally
controlled, allowing intruders to intercept medical information and manipulate the device
by taking advantage of the unencrypted signals in the ICD's built-in radio.

PUERTO RICO SMART METERS 2009

An electrical utility in Puerto Rico lost hundreds of millions of dollars after the power
consumption figure was manipulated, allowing smart meters to be controlled by external
devices, thus not accurately measuring the amount of power used.

MEDTRONIC INSULIN PUMPS 2011

Software and a special antenna enabled researchers to locate and seize control of any
device within 300 ft through its radio transmitters, potentially making it pump excessive
quantities of insulin into the blood.

WATER UTILITY SYSTEM (SCADA) | 2011

Hackers destroyed a water pipe outside of an Illinois city by gaining access to the
industrial control system. They were able to burn out one of the utility's pumps by
causing the SCADA system that controlled the pump to turn the pump on and off
repeatedly.

BASHLITE BOTNET 2014

BASHLITE infected more than 2M devices in two years. Spreading through brute-force,
BASHLITE was able to launch several types of large-scale DDoS attacks
simultaneously. A 2020 version can also deploy cryptocurrency mining and bricking
malware.

UNIVERSITY OF MICHIGAN TRAFFIC LIGHTS 2014

Researchers seized control of an entire system of 100+ intersections from a single
access point. Easily hacked, the traffic light system used wireless radios for its
communication infrastructure, with very basic encryption and no password.

GERMAN STEEL MILL HACK 2014

Hackers used spear phishing to infiltrate a German steel mill's network and manipulate
its controls to compromise a multitude of systems, including industrial components on
the production network and a blast furnace, which could not be properly shut down,
resulting in substantial damage.

10 | P a g e IT21160684
BMW CONNECTED DRIVE SYSTEM 2015
Researchers exploited a vulnerability in BMW's Connected Drive system and imitated
BMW servers to send remote unlocking instructions to vehicles. The test took
advantage of the remote unlocking feature, which could be requested via a BMW
assistance line.

UKRAINIAN POWER GRID 2015

Hackers compromised the internal corporate network through spear phishing malware
emails. They were then able to seize control of the SCADA network and turn
substations off, leaving 230K people without electricity. The malware also disabled lot
control devices by implanting malicious firmware on the devices.

TESLA MODEL S REMOTE HACK 2016

Researchers remotely hacked an unmodified Tesla Model S and took over the
multimedia system and dashboard display, managing to switch on the turning signals,
and to open the doors without using a key. They also managed to activate the
windshield wipers, fold in the side mirror, and open the trunk while the car was moving.
MIRAI BOTNET 2016
The infamous IoT botnet Miral took advantage of IoT devices with weak or default
passwords and gained control of large numbers of compromised closed-circuit TV
cameras and routers, using them to launch a DDoS attack that crippled large swathes of
the internet including Twitter, the Guardian, Netflix, Reddit, and CNN. The source code
was then released into the wild.
FITBIT VULNERABILITY 2017
Researchers found that some Fitbit products were vulnerable to intrusions, and that
messages transmitted between fitness trackers and cloud servers could be intercepted.
Once inside the internal network, hackers could manipulate and share data with third
parties.
REAPER BOTNET 2017
An evolution of Mirai, the Reaper Botnet is believed to have infected up to 1M devices,
making it the largest IoT botnet in history. It took control of embedded devices, infecting
cameras, routers, storage boxes, and more. Reaper is especially dangerous because its
code can be easily updated to launch subsequent attacks via queued botnets.
AMNESIA BOTNET 2017
Amnesia targeted an unpatched remote code execution flaw in DVR devices, affecting
approximately 227K devices, gaining full control, and allowing attackers to launch
broad, Mirai-sized DDoS attacks on targets globally.
SAUDI PETROL CHEMICAL PLANT ATTACK 2018
Attackers gained remote access to an engineering workstation by deploying malware,
which reprogrammed SIS controllers. It then managed to trigger an explosion that
caused physical damage to the plant's infrastructure.

11 | P a g e IT21160684
THINKPHP EXPLOITATION 2018
Attackers leveraged CVE-2018-20062, a remote code execution (RCE) vulnerability in
Chinese open-source PHP framework ThinkPHP to implant a variety of malware used to
spread cryptocurrency miners. While primarily targeting web servers, it also infected a
large number of IoT devices.
AMAZON RING HACK 2019
A hacker was able to watch and communicate with an 8-year-old girl in Mississippi by
hacking an Amazon Ring camera her parents had installed in her bedroom, using a
password found in an online database of previously compromised login information.
FANCY BEAR VS. SPORTS 2019
Fancy Bear, the Russian-sponsored hacker group, conducted significant cyberattacks
on 16 national and international sports and anti-doping organizations. In a number of
these attacks, IoT devices were used as a point of ingress.
SILEX LINUX MALWARE 2019
A hacker used a new strain of malware to brick up to 4K insecure IoT devices running
on the Linux or Unix operating systems that had known or guessable default passwords.
The malware would trash devices' storage, remove firewalls, and network configuration,
and ultimately brick them, causing them to not be able to boot.

PHILIPS HUE LIGHTBULB 2020

Researchers showed how a single smart light bulb can infect an entire network by
seizing control and loading it with malware, forcing it to malfunction.
SWEYNTOOTH FAMILY 2020
Researchers spotted a family of 12 vulnerabilities in BLE software development kits
belonging to 6 major system-on-a-chip vendors. The vulnerabilities allow intruders
within radio range to trigger crashes, deadlocks, buffer overflows, and even bypass
security.
KAIJI MALWARE 2020
Researchers discovered a malware strain specifically built to infect loT devices and
Linux-based servers. The Kaiji botnet is coded from scratch and executes brute-force
attacks through SSH ports exposed on the internet. While the initially discovered
version of the malware seems incomplete, researchers are closely monitoring its
development.

Era Attack
STUXNET VIRUS 2005
First Era – The age of exploration Risk: Operational disruption
(2005-2009) HACKABLE HEART MONITORS 2008
Risk: Safety

12 | P a g e IT21160684
 PUERTO RICO SMART METERS 2009
Risk: Operational disruption
MEDTRONIC INSULIN PUMPS 2011
Second Era – The age of exploitation Risk: Safety
(2011- 2019) WATER UTILITY SYSTEM (SCADA) 2011
Risk: Operational disruption
FITBIT VULNERABILITY 2017
Risk: Data loss
REAPER BOTNET 2017
Risk: Denial of Service
AMNESIA BOTNET 2017
Risk: Denial of Service
PERSIRAI BOTNET 2017
Risk: Denial of Service
SAUDI PETROL CHEMICAL PLANT
ATTACK 2018
Risk: Operational disruption
BASHLITE BOTNET 2014
Risk: Denial of service
UNIVERSITY OF MICHIGAN TRAFFIC
LIGHTS 2014
Risk: Safety
GERMAN STEEL MILL HACK 2014
Risk: Operational disruption
BMW CONNECTED DRIVE SYSTEM 2015
Risk: Financial
FIAT CHRYSLER REMOTE CONTROL 2015
Risk: Safety
UKRAINIAN POWER GRID 2015
Risk: Operational disruption
THINKPHP EXPLOITATION 2018
Risk: Denial of Service
AMAZON RING HACK 2019
Risk: Safety
FANCY BEAR VS. SPORTS 2019
Risk: Operational disruption
SILEX LINUX MALWARE 2019
Risk: Operational disruption
TWO MILLION TAKEOVER 2019
Risk: Safety
TESLA MODEL S REMOTE HACK 2016
Risk: Safety
MIRAI BOTNET 2016
Risk: Denial of Service
NYADROP SELF-UPDATING MALWARE
2016
Risk: Denial of Service
HAJIME VIGILANTE BOTNET 2016
Risk: Operational disruption

13 | P a g e IT21160684
 CCTV BOTNET 2016
Risk: Denial of Service
PHILIPS HUE LIGHTBULB 2020
Third Era – The age of protection Risk: Denial of Service
(2020) SWEYNTOOTH FAMILY 2020
Risk: Denial of Service
DARK NEXUS BOTNET 2020
Risk: Denial of Service
KAIJI MALWARE 2020
Risk: Denial of Service

*Source: Malware Int

14 | P a g e IT21160684
3.1 Possible attacks5

The Internet of Things application is used by many users, but at the same time
may expose users to unprecedented security threats and challenges. Most IoT devices
are directly connected to the Internet and share their data with some level trust without
performing any security tests. So, most of the attacks that are out there cyberspace is
also possible in IoT. IoT uses a Wireless Sensor Network as its foundation WSN attacks
are also in the IoT environment [6].

• Man-in-the-middle attack [7]: Unencrypted communications or poorly protected

IoT networks can be exploited by attackers who inject traffic between devices
and cloud applications. An attacker disrupts, interrupts, or spoofs communication
between two systems. For example, fake temperature data forged and
transmitted to the cloud. Similarly, an attacker can disable vulnerable HVAC
systems during a heat wave, creating a disastrous scenario for service providers
with affected models.

• Hardware Trojan [8]: One of the main security issues for ICs is hardware Trojan
horses. They maliciously modify integrated circuits to allow attackers to exploit
them features and gain access to software that works on them.

• Data and Identity Theft [9]: Data generated by the unprotected wearables and
smart devices provide cyber attackers large amounts of targeted personal
information that can potentially misused for fraudulent transactions and identify
theft.

• Device Hijacking [10]: An attacker hijacks and effectively takes control of the
device. These attacks are difficult detect because the attacker does not change
the basic device functionality. Only one device is needed for this potentially re-

15 | P a g e IT21160684
 infecting all smart devices in the home. For example, an attacker who initially
compromises the thermostat can theoretically gain access to the entire network
and remotely unlock the door or change the PIN code of the keypad to restrict
entry.
In addition, there are several types of hijacking,
Browser hijacking Clipboard hijacking
Domain hijacking IP hijacking
Session hijacking

• Distributed Denial of Service (DDoS) [11]: Denial-of-service attack (DoS attack)

attempts to impersonate a computer or network a resource unavailable to its
intended users temporarily or unlimited interruption of services of the host
connected to Internet. In a distributed denial-of-service (DDoS) attack the
inbound traffic flooding the target comes from more resources, making it difficult
to stop a cyber offensive it simply blocks one source. For example, Mirai is
malware that turns Linux network devices into remote controlled "boots" that can
be used as part botnet in large-scale network attacks. It primarily targets online
consumer devices such as IP cameras and home routers.

• Physical attack [12]: In some IoT application objects deployed in a hostile

environment such objects are vulnerable to physical access that may lead to
hardware/firmware attacks. With physical access to the object, the attacker can
derive valuable cryptographic information, change the operating system, and
vandalize the circuit, all of which can lead to long-term destruction.

• Collision Attacks [13]: This type of attacks can be launched on the link layer.
One way is by adding noise in communication channel, which lead to
retransmission of packets and drainage of limited power resources.

• SQL Injection Attack [14]: Attackers use a web or mobile application interface
execute SQL statements for read, write, and delete operations. This kind

16 | P a g e IT21160684
 an attack can not only obtain a user's private data, but also endanger the whole
database system. When web applications are attacked by SQL injection,
the current page shows different results compared to the actual information
discussed.

• Malicious node [15]: In the IoT environment, some node is acquired illegally
access the IoT network and other objects and interfere with the functions and
environmental safety.

• Side channel attacks [16]: This is a powerful attack against encryption

techniques that can affect their security and reliability. In a side-channel attack at
the edge node level, objects are performing their normal operations, there is a
possibility that such objects can reveal critical information, side-channel attacks
at the communication level are not invasive because they only elicit intentionally
leaked information.

• Routing Attacks17: Many routing protocols for data transmission in the IoT
environment
used in the network. The malicious node modified the packet, generated fake
packets,
edit the route. According to literature study, there are Sybil, Gray Hole,
Wormhole,
Hello flood and Selective-forwarding types of attacks are possible in it

4. Future developments in the area

In today's world, we can create customized customer experiences with ecosystems
of connected devices almost anywhere, including our homes, cars, nursing homes,
and factories. But customer demands are constantly changing businesses and their
engineers need to innovate while building trust as connected devices come with
many privacy challenges. So, what should you watch out for in the future of IoT?

4.1 IoT companies and a circular economy [18]

IoT companies are helping to pave the way for the future through waste
minimization, energy efficiency and greater personal autonomy. However, for a
connected device system to be sustainable, it must be feedback-rich and responsive,
and actions must be linked through data. Some of the ways to achieve a responsive and
usable system include:

• Extending the use cycle with predictive maintenance instead of a "break-fix"

production model.

17 | P a g e IT21160684
 • Increase utilization and reduce unplanned downtime.
• Pooling assets for reuse, refurbishing or recycling with better information on
condition and usage history.
An interesting case study is Michelin adding sensors to tires to better understand wear
over time. This data is useful for customers to know when to replace or replace their
tires, saving them money and increasing safety. But it also means that Michelin can shift
its business model to leasing tires instead of selling them. The data from the sensors
will tell the company how to maintain the tires, so Michelin has a new commercial
interest in making the tires last as long as possible because the company now owns
them.

4.2 IoT security improvements [19]

The challenge for businesses focusing on the Internet of Things is that it requires
not only a full team of mechanical, electrical and firmware engineers for the
hardware, but also a software team to design and manage the cloud
infrastructure and application developers so that your users can understand data
and make your own decisions.

Although the technology has been around for years, IoT is still relatively in its
infancy when it comes to regulation and security. Many companies want to be the
first to bring their product to market, so security often takes a back seat. It's easy
for consumers and businesses alike to think, “Why would someone hack my Wi-
Fi coffee maker?” The coffee maker isn't something you need to worry about, but
if your connected car or baby monitor were to be compromised, this flawed
security could have very real consequences.

As more devices become public, the attack surface grows. Surveys show that
security improvements are more important than purchase costs. For the future of
IoT, customers must be in control of their data and companies must improve trust
by addressing public concerns about privacy and security.

4.3 AI & IoT [20]

IoT provides data, but it is only valuable if the data is actionable. Artificial
intelligence helps provide context and creativity to drive intelligent actions from
collected data. There are 3 levels of usefulness of AI and IoT:

• Basic: Prediction to predict and mitigate risk events using real-time data
to determine when machinery and equipment will fail.
• Middle: Prescriptive force (vehicles can correct course when a car veers
from the center of a lane, rail track sensors can warn of track failure).

18 | P a g e IT21160684
 • Advanced: Provides adaptive or autonomous response (blood glucose
sensors can alter insulin delivery levels in response to changing patient
needs).
Artificial intelligence can offer risk management such as detecting
fraudulent behavior in ATMs, predicting an insurance driver based on driving
patterns or predictive maintenance – reducing maintenance time, increasing
equipment uptime and improving overall maintenance costs.

4.4 IoT Networks decentralized [21]

More is being placed on cloud service providers such as AWS and Azure,
creating a single point of failure problem for connected systems. Unfortunately,
this also presents them as a growing target for attacks as they gain more market
share and thus an increase in potential attack.
A blockchain approach to decentralized networks is a distributed ledger of
transactions shared among network nodes instead of a central server; however,
encryption and authentication of blockchain transactions are computationally
intensive, and IoT devices typically have limited computing power.
As more devices connect to the Internet of Things, they will strain cloud
infrastructure and maintenance costs. We will need to reduce our reliance on
cloud platforms for data analysis and faster data-based decision making.
Companies and enterprises will need to consider the options of transferring data
to the cloud (if it is really needed) or processing at the edge.

5. Conclusion

IoT makes people’s lives easier with its variety of applications. To do this task most
of IoT objects use internet so they are directly vulnerable with internet threats. IoT
faces a number of threats that must be recognized in order to take protective
measures. Therefore, in this paper, security challenges and security threats for IoT
have been introduced. The overall objective was to identify the assets and document
the potential threats, attacks and vulnerabilities facing the IoT.
An overview of the most important IoT security issues was provided, with a special
focus on security challenges related to IoT devices and services. Security issues
such as confidentiality, privacy and entity trust have been identified. We have shown
that security and privacy challenges need to be addressed to create safer and more
accessible IoT devices and services. The discussion also focused on cyber threats
involving actors, motivations and capabilities driven by the unique characteristics of
cyberspace. It has been proven that threats from intelligence agencies and criminal
groups are likely to be more difficult to defeat than threats from individual hackers.

19 | P a g e IT21160684
 This is because their targets can be much less predictable, while the impact of an
individual attack is expected to be less severe.
It was concluded that much work remains to be done in the area of IoT security, by
both vendors and end-users. It is important for upcoming standards to address the
shortcomings of current IoT security mechanisms. In addition, we discussed about
future developments areas in IoT and IoT security improvements about future.

6. Referencess
[1]
https://books.google.lk/books?id=Q9PQDwAAQBAJ&printsec=frontcover#v=onepage
&q&f=false
[2] https://en.wikipedia.org/wiki/Bruce_Schneier
[3]https://www.gbnews.ch/iot-security-goals-and-
attacks/#:~:text=Traditional%20security%20goals%20are%20generally,objects%20can
%20access%20sensitive%20data.
[4]
https://www.prnewswire.com/news-releases/evolution-of-iot-attacks-study-exposes-
the-arms-race-between-cybercriminals-and-cybersecurity-301066116.html
[5] https://www.globalsign.com/en-ae/blog/iot-security-threats-and-defenses

[6]https://books.google.lk/books?id=Q9PQDwAAQBAJ&printsec=frontcover#v=onepage

&q&f=false
[7] https://www.imperva.com/learn/application-security/man-in-the-middle-attack-mitm/
[8]https://www.geeksforgeeks.org/hardware-trojan/

[9]
https://www.trendmicro.com/vinfo/it/security/news/online-privacy/identity-theft-and-
the-value-of-your-personal-
data#:~:text=Identity%20theft%20happens%20when%20your,media%2C%20and%20cr
edit%20card%20details.
[10] https://www.techtarget.com/searchsecurity/definition/hijacking
[11] https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/
[12]https://www.fldoe.org/safe-schools/sesir-discipline-data/physical-attack.stml

20 | P a g e IT21160684
[13]https://link.springer.com/referenceworkentry/10.1007/978-1-4419-5906-

5_564#:~:text=Definition,according%20to%20a%20uniform%20distribution.
[14] https://portswigger.net/web-security/sql-injection
[15 ] https://link.springer.com/article/10.1007/s41870-018-0168-2

[16] https://en.wikipedia.org/wiki/Side-channel_attack

[17] https://uomustansiriyah.edu.iq/media/lectures/6/6_2017_10_29!08_29_48_PM.pdf

[18] https://www.mistywest.com/posts/what-can-we-expect-for-the-future-of-iot/

[19]https://www.mistywest.com/posts/what-can-we-expect-for-the-future-of-iot/

[20]https://www.mistywest.com/posts/what-can-we-expect-for-the-future-of-iot/

[21] https://www.mistywest.com/posts/what-can-we-expect-for-the-future-of-iot/

21 | P a g e IT21160684