IoT Flashcards

1
Q

5 types of IoT

A

Consumer
Commercial
Industrial
Infrastructure
Military

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an IoT?

A

IoT are devices that can be assigned IP addresses or unique identifiers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why is IoT vulnerable?

A

IoT devices collect information about users and their environment, including personally identifiable, commercially confidential and/or sensitive data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why does IoT infrastructure have security challenges?

A

There is limited collaboration for initiatives to secure systems and ensuring interoperability between them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is one exploit example?

A

Chrysler’s in-vehicle connectivity system hacking Jeep’s media center, windshield wipers, air conditioner and accelerator.
Mirai IoT botnet attacking journalist website and Dyn’s network making Amazon, Twitter and Netflix to be unavailable for hours.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a constrained node?

A

IoT devices that are typically battery-operated and has low computing power.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a constrained network?

A

A network of constrained nodes resulting to low throughput, high packet loss and asymmetric link characteristics (eg. A-B better quality transmission than B-A).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What it RPL?

A

Routing Protocol for Low power and Lossy Network which can also known as distance vector as it manipulates vectors (tables) of distances from other nodes in the LLN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Explain direction metric

A

Next hop address and output port.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain distance metric

A

Cost-based (eg. energy needed, number of hops).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Why is RPL also known as Source Routing Protocol?

A

Sender can partially or completely specify the route that the packet should take through the LLN.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are border routers?

A

Routers that route between the local network and an external one (e.g. Internet) or to the cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Why are (RPL) Source Routing Protocol used?

A

Allows easier troubleshooting and enables a node to discover all the possible routes to a host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

2 mode of operations for RPL

A

Storing and non-storing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is storing mode?

A

Intermediate routers maintaining route tables. A downward routing table is kept at each node and traffic travels only as far as the common parent. Searching for the destination each node at a time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is non-storing mode?

A

Node broadcasting message to everyone to where the receiver is when it replies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the difference with DODAG and DAG?

A

DODAG has only 1 root node

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a DODAG?

A

It is a direction oriented directed acylic graph. A graph with directed edges and no cycles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

ETX rank computation formula

A

Rank (X) = Rank (parent) + ETX (X, parent)

The higher the link quality the lower link cost and a lower ETX.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Residual energy rank computation formula

A

Rank (X) = Rank (parent) + (MAX_energy_ – X_energy_)

The higher the link quality the lower link cost and a higher energy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

MinHopRankIncrease rank computation formula

A

Rank (X) = Rank (parent) + (ROOT_energy_ - NODE_energy_) + MinHopRankIncrease

Parent + Step + MinHopRankIncrease

22
Q

What is MRHOF?

A

Minimum Rank Hysteresis Objective Function is to find path with minimum rank.

23
Q

How does MRHOF work?

A

If PARENT_pathcost_ + switchTreshold > CANDIDATE_pathcost_,
switch to CANDIDATE, else maintain PARENT.

24
Q

What is switchtreshold formula?

A

(PARENTcost) + (PARENTlink) - (CANDIDATEcost + CANDIDATElink)

25
Q

4 types of ICMP control messages used in RPL

A

DAO (Destination Advertisement Object)
DIO (DODAG Information Object)
DIS (DODAG Information Solicitation)
DAO-ACK (Destination Advertisement Object Acknowledgement)

26
Q

DAO function

A

It is used to propagate destination information upwards along the DODAG.

27
Q

DIO function

A

Information response to the DIS request. Information contains discovery of an RPL instance, learning its configuration parameters, selecting DODAG parent set and maintaining DODAG.

28
Q

DIS function

A

Looking for information in the form of an information object. It is used to solicit (probe for) a DODAG Information Object from a RPL node.

29
Q

DAO-ACK function

A

An acknowledgement message back to sender of DAO.

30
Q

How does DODAG Construction Messages work?

A

DIS allows new nodes to discover the DODAG topology and join it. DIO messages carry information about the DODAG and the node’s relative position. Selected parent nodes are informed via DAO messages.

31
Q

How does downward construction work?

A

Leaf node will send DAO messages to the neighbouring node up till the root node. There are 2 types, storing and non-storing where storing is links through parent nodes while non-storing is direct link to root.

32
Q

How does upward construction work?

A

Root node will send DIO messages to the child nodes down till the leaf node.

33
Q

How does DODAG self heal?

A

A new version number is propagated ensuring that reconstructed routes are cycle-free, routing table entries are updated and inconsistencies are removed from DODAG.
Nodes in new DODAG can assume new routing positions without being constrained by their ranks in old DODAG.

34
Q

What is trickle timer used for?

A

The trickle time controls the healing rate.

35
Q

What are 3 attack categories in RPL-based networks

A

Resources
Topology
Traffic

36
Q

What are resource attacks and its sub-categories

A

Resource attacks causes exhaustion of network resources and impacts its performance.
Sub-categories: Direct and indirect

37
Q

What are topology attacks and its sub-categories

A

Topology attacks aim to disrupt normal network operation and may cause isolation of 1 or more nodes.
Sub-categories: Sub-optimization and isolation

38
Q

What are traffic attacks and its sub-categories

A

Traffic attack targets network traffic. Malicious node(s) are introduced inside the network, without disrupting operations.
Sub-categories: Eavesdropping and misappropriation

39
Q

What is Flooding Table Attacks?

(Resouce-direct)

A

A malicious node generates large amount of traffic with illegitimate DIS messages, causing nodes within range to send DIO messages and reset their trickle timers leading to decrease in packet delivery rate while increasing end-to-end packet latency.

40
Q

What is Routing Table Overload Attacks?

(Resouce-direct)

A

A malicious node uses DAO messages to advertise fake routes which saturate the routing table of the targeted victim node. It prevents building of new legitimate routes and could lead to memory overflow event.

41
Q

What is Increased Rank Attacks?

(Resouce-indirect)

A

A malicious node advertises false rank information creating a loop in the DODAG and if there is no alternate parent, packets cannot reach the root.

42
Q

What is DAG Inconsistency Attacks?

(Resouce-indirect)

A

A malicious node manipulates the RPL IPv6 header setting Rank-Error bit to 1 forcing target to drop packets. Dropped packets cause a reset of trickle timer which increases network overhead.

43
Q

What is Version Number Modification Attacks?

(Resouce-indirect)

A

An attacker node generates DIO messages with false version numbers forcing re-build of routing tree which can cause disruption in network traffic.

44
Q

What is Routing Table Falsification Attacks?

(Topology-Sub Optimization)

A

A malicious node advertises routes that are not in the sub-DODAG. Targeted nodes have wrong routes in their routing table causing network sub-optimization. As a result, longer path inducing delay, packet drops or network congestion.

45
Q

What is Sinkhole Attacks?

(Topology-Sub Optimization)

A

A malicious node attracts a lot of traffic by advertising falsified control messages for preferred routing paths. After received the traffic in an illegitimate manner, it modifies or drops it. As such, it can be used to send bogus information to the root.

46
Q

What is Wormhole Attacks?

(Topology-Sub Optimization)

A

2 malicious nodes tunnel routing information to another part of the network, nodes which are actually distant, see each other as if they are in the same neighborhood and create non-optimized routes according to the objective function. This affects network availability by dropping data or disrupting route paths.

47
Q

What is Routing Information Replay Attacks?

(Topology-Sub Optimization)

A

A malicious node replays the rank parent’s node to child nodes in its sub-DODAG. This causes child nodes to choose the malicious node as the preferred parent and route through it.

48
Q

What is Blackhole Attacks?

(Topology-Isolation)

A

A malicious node (single black hole) or many malicious nodes (colluding black hole) advertise itself as best route towards the root then drop all packets that it is supposed to forward. This causes loss of large part of network availability can be seen as a type of denial-of-service attack.

49
Q

What is DAO Inconsistency Attacks?

(Topology-Isolation)

A

A malicious node uses the Forwarding-Error flag to make RPL routers remove legitimate downward routes and thus isolating nodes from the DODAG.

50
Q

What is Sniffing and Analysis Attacks?

(Traffic-Eavesdropping)

A

Passive listening within malicious node’s focal communication range to packets transmission over the network.

51
Q

What is Decreased Rank Attacks?

(Traffic-Misappropriation)

A

A malicious node advertises false rank information causing it to be selected as preferred parent then be privy to confidential/private information.

52
Q

What is Identity Attacks?

(Traffic-Misappropriation)

A

Spoofing attack where malicious node copies identity of a valid node onto another physical node. Sybil attacks where malicious node assumes multiple logical identities on the same physical node.