Lecture 9 - What are Some IOT Vulnerabilities (Extraction from Main Set)

Question 1

Deficient physical security

Answer 1

• Unauthorized physical access possible

Question 2

Improper Encryption

Answer 2

• Resource limitations of IoT affects encryption

Question 2

Inadequate authentication

Answer 2

• Simple authentication due to limited processingpower and energy

Question 3

Insufficient energy harvesting

Answer 3

• Stored energy can be drained by an attacker by legitimate or corrupt messages.

Question 4

Unnecessary open ports

Answer 4

• IoT devices have unnecessarily open ports while running vulnerable services

Question 4

Insufficient Access control

Answer 4

• IoT devices in conjunction with their cloud management solutions do not force a password of sufficient complexity
• Default user credentials not forced to change
• Most of the users have elevated permissions and can be misused.

Question 5

Improper patch management capabilities

Answer 5

• Manufacturers either do not recurrently maintain security patches or do not have in place automated patch-update mechanisms.
• Moreover, even available update mechanisms lack integrity guarantees, rendering them susceptible to being maliciously modified

Question 6

Weak programming practices

Answer 6

• IoT manufacturers release firmware with known vulnerabilities

Question 7

Insufficient audit mechanisms

Answer 7

• IoT devices lack thorough logging procedures, rendering it possible to conceal IoT-generated malicious activities