See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/332277406 Demystifying IoT Security: An Exhaustive Survey on IoT Vulnerabilities and a First Empirical Look on Internet-scale IoT Exploitations Article in IEEE Communications Surveys & Tutorials · April 2019 CITATIONS READS 48 2,649 5 authors, including: Nataliia Neshenko Elias Bou-Harb Florida Atlantic University University of Texas at San Antonio 12 PUBLICATIONS 84 CITATIONS 85 PUBLICATIONS 785 CITATIONS SEE PROFILE SEE PROFILE Jorge Crichigno Georges Kaddoum University of South Carolina École de Technologie Supérieure 80 PUBLICATIONS 484 CITATIONS 249 PUBLICATIONS 3,798 CITATIONS SEE PROFILE SEE PROFILE Some of the authors of this publication are also working on these related projects: Explicit feedback for congestion control inScience DMZ cyberinfrastructures based onprogramable data-plane switches View project Deep Learning View project All content following this page was uploaded by Elias Bou-Harb on 08 April 2019. The user has requested enhancement of the downloaded file. 1 Demystifying IoT Security: An Exhaustive Survey on IoT Vulnerabilities and a First Empirical Look on Internet-scale IoT Exploitations Nataliia Neshenko, Elias Bou-Harb, Jorge Crichigno, Georges Kaddoum and Nasir Ghani Abstract—The security issue impacting the Internet-of-Things physical therapy [4], while the Autism Glass [5] aims at aiding (IoT) paradigm has recently attracted significant attention from autistic children to recognize emotions of other people in real- the research community. To this end, several surveys were put time [6]. forward addressing various IoT-centric topics including intrusion detection systems, threat modeling and emerging technologies. Safety-centric IoT solutions endeavor to minimize haz- In contrast, in this work, we exclusively focus on the ever- ardous scenarios and situations. For example, the concept of evolving IoT vulnerabilities. In this context, we initially pro- connected vehicles prevents the driver from deviating from vide a comprehensive classification of state-of-the-art surveys, proper trajectory paths or bumping into objects. Further, which address various dimensions of the IoT paradigm. This such concept enables the automatic emergency notification aims at facilitating IoT research endeavors by amalgamating, comparing and contrasting dispersed research contributions. of nearest road and medical assistance in case of accidents Subsequently, we provide a unique taxonomy, which sheds [7]. Additionally, autonomous, self-driving mining equipment the light on IoT vulnerabilities, their attack vectors, impacts keeps workers away from unsafe areas, while location and on numerous security objectives, attacks which exploit such proximity IoT sensors allow miners to avoid dangerous situa- vulnerabilities, corresponding remediation methodologies and tions [8]. Moreover, deployed IoT sensors at factories monitor currently offered operational cyber security capabilities to infer and monitor such weaknesses. This aims at providing the reader environmental pollution and chemical leaks in water supply, with a multidimensional research perspective related to IoT while smoke, toxic gases and temperature sensors coupled with vulnerabilities, including their technical details and consequences, warning systems prevent ecological disasters [9]. Indeed, a which is postulated to be leveraged for remediation objectives. number of case-studies have reported on the significant impact Additionally, motivated by the lack of empirical (and malicious) of IoT on natural resources’ integrity and consumption. For data related to the IoT paradigm, this work also presents a first look on Internet-scale IoT exploitations by drawing upon more instance, water pressure sensors in pipelines monitor flow than 1.2 GB of macroscopic, passive measurements’ data. This activity and notify operators in case of a leak, while smart aims at practically highlighting the severity of the IoT problem, IoT devices and systems enable citizens to control water and while providing operational situational awareness capabilities, energy consumption [9]. In fact, the IoT notion is introducing which undoubtedly would aid in the mitigation task, at large. notable solutions for contemporary operations, well-being and Insightful findings, inferences and outcomes in addition to open challenges and research problems are also disclosed in this safety. In this context, several ongoing IoT endeavors promise work, which we hope would pave the way for future research to transform modern life and business models, hence improv- endeavors addressing theoretical and empirical aspects related to ing efficiency, service level, and customer satisfaction. the imperative topic of IoT security. The undeniable benefits proposed by the IoT paradigm, nev- Index Terms—Internet of Things, IoT Vulnerabilities, IoT ertheless, are coupled with serious security flaws. Profit-driven Data, IoT Security businesses and time-to-market along with the shortage of related legislation have stimulated manufacturers to overlook security considerations and to design potentially vulnerable I. INTRODUCTION IoT devices, opening the door for adversaries, which often HE CONCEPTION of the prominent Internet-of-Things exploit such devices with little or no effort. The negligence of T (IoT) notion is envisioned to improve the quality of mod- a number of security considerations enables the exposure of ern life. People-centric IoT solutions, for instance, significantly sensitive information ranging from unprotected video stream- enhance daily routines of elderly and disabled people, thus ing of baby monitors [10] to the uploading of unauthorized increasing their autonomy and self-confidence [1]. Implantable voice recordings, emails and passwords by Internet-connected and wearable IoT devices monitor and extract vital measure- IoT toys [11], [12]. Moreover, poorly designed devices allow ments to enable the real-time emergency alerting in order the execution of arbitrary commands and re-programming of to increase patients’ chances of survival [2]. This emerging device firmware [13]. Indeed, given the Internet-wide deploy- technology is also being leveraged to reduce response times ment of IoT devices, such malicious manipulations have a in reacting to abrupt health incidents such as the sudden profound impact on the security and the resiliency of the entire infant death syndrome during sleep [3]. Moreover, advanced Internet. Among the many cases that recently attracted the solutions for in-home rehabilitation strive to revolutionize public attention, the cyber attack launched by the IoT-specific NN and EBH are with FAU, USA; NG is with USF, USA; JC is with USC, malware Mirai [14] provides a clear example of the severity of USA; GK is with ETS, Canada the threat caused by instrumenting exploited IoT devices. In 2 this case, the primary DNS provider in the US, Dyn, became the light on currently offered IoT cyber security situational the target of an orchestrated Denial of Service (DoS) attack, awareness capabilities, which endeavor to identify, attribute, jeopardizing the profit and reputation of its clients. In fact, characterize and respond to such vulnerabilities or their Dyn lost nearly 8% of its customers right after the mentioned possible exploitation attempts. Further, given that the problem attack [15]. of IoT security is still at its infancy due to the lack of Such and other security incidents impair the confidence in IoT-relevant empirical data and IoT-specific attack signatures the IoT paradigm, hindering its widespread implementation [21], we note the shortage of literature approaches, which can in consumer markets and critical infrastructure. While the practically identify Internet-wide compromised IoT devices, disclosure of private and confidential information coupled with in near real-time, and address this research development gap the launch of debilitating DoS attacks cause various privacy by exploring unique empirical data. violations and business disruptions, the most significant danger from exposed IoT devices remains the threat to Specifically, in this survey, we uniquely approach IoT secu- people’s lives and well-being. Security risks rendered by rity by analyzing the aforementioned dimensions as they inter- unauthorized access and reconfiguration of IoT medical relay with certain identified IoT vulnerabilities. Specifically, devices, including implantable cardiac devices, have been we frame the contributions of this survey as follows: already confirmed by the US Food and Drug Administration • Amalgamating and classifying currently available IoT- (FDA) [16]. Moreover, the hacking of traffic lights [17] relevant literature surveys to highlight research trends in and connected vehicles [18], [19] not only causes havoc this emerging field and to facilitate research initiation by and increases pollution, but also possesses the capability to new researchers through eliminating repetitive research cause injury and drastic accidents leading to fatalities. While efforts. benefits from using these IoT devices and corresponding • Introducing a unique taxonomy by emphasizing and technologies possibly outweigh the risks, undoubtedly, IoT discussing IoT vulnerabilities in the context of various, security at large should be carefully and promptly addressed. previously unanalyzed dimensions through comparing, contrasting and analyzing near 100 research contribu- Several technical difficulties, including limited storage, tions.