5 Classical Cyber-Attacks in the Internet of Things – Maximum Potential for Nuisance
There have long been all sorts of attacks. What is new, on the other hand, is the scale of these attacks and the relative simplicity with which they operate in the Internet of Things (IoT). Little or no protection at all, the millions of connected IoT devices are potential victims of cyber-attacks, and even if these attacks are conventional, the potential damage will be on an entirely different scale.
At the core, the IoT consists of connecting and networking devices that were not necessarily so far. Clearly, all of these devices – from the brand new connected refrigerator to the connected car – create a new entry point on your network with an increased risk for security and privacy.
If this type of attack frequently follows the same procedure as before, their impact varies enormously depending on the ecosystem, the target device, its environment, the level of protection available, and many other parameters.
1. The botnets
A botnet is a network of systems associated with each other for the purpose of taking remote control and distributing malware . Controlled by botnets operators via C & C (command and control) servers, they are used on a large scale by cyber-criminals to commit several types of packages: theft of confidential data, exploitation of online banking data, attacks by DDos or spam and phishing (e-mails of phishing scams).
The botnets and the thingbots are made up of several different devices, all interconnected: from fixed or portable computers, to smartphones and tablets to “smart” devices. These objects share two common features: they are connectable to the Internet and capable of automatically transferring data over a network.
Anti-spam technologies are able to locate in a rather reliable way if a machine sends thousands of similar emails. This is much more difficult if emails are sent from multiple devices belonging to a network of zombies. These machines all have one goal: send thousands of e-mail requests to their target in hopes of dropping the platform that is struggling to resist the avalanche of queries.
2. The concept of attack Man-in-the-Middle or middle man
The concept of Man-in-the-Middle (MiM) refers to an attack by a pirate who seeks to interrupt and intercept communication between two distinct systems. This type of attack can be dangerous because the hacker discreetly intercepts messages between two parties to transmit them, while they think they communicate directly with each other. In possession of the original message, the aggressor is able to trap the recipient by making him believe that the message he receives is legitimate. Many cases of MiM attacks have already been reported, such as piracy of smart vehicles and refrigerators.
Due to the nature of pirated “objects”, these attacks can be extremely dangerous in IoT. They may include industrial tools and equipment, vehicles or harmless connected objects such as connected televisions or automatic gate opening systems.
3. Data Theft and Identity Theft
The negligence of manufacturers and users to protect their connected devices (mobiles, tablets, reading lights, smartwatch …) makes the game of thugs and opportunists.
In the case of identity theft, the strategy is to amass data, and with a little patience, there is a lot of data to recover. Between the general data available on the Internet, information retrieved on social networks, intelligent watches, activity sensors to which, if necessary, data from intelligent counters and refrigerators, and other objects connected … If you combine all of this data, your personal identity is no secret … The more information you find about someone, the easier it is to launch a sophisticated targeted attack to usurp his identity.
4. Social engineering
Social engineering is the art of manipulating people to get them to reveal confidential information. If the type of information sought by the perpetrators can vary, when they attack someone, the perpetrators usually try to lure their targets to encourage them to give them passwords or bank details. They may also attempt to access a computer to install malicious software that will allow them to access personal data and gain control over the computer. The privileged weapon of attacks by social engineering is often phishing e-mail that prompts you to give information or to redirect you to banking or e-commerce sites which, despite an apparent legitimacy, are in fact usurped.
5. Denial of service attacks
Denial of service (DoS) attacks are reported when a generally operational service is unavailable. While there may be several reasons, this is often due to the inability of the infrastructure to cope with an activity overload. In a Distributed Denial of Service (DDoS) attack, a multitude of systems target a single target. Through a botnet, these attacks use a large number of programmed machines (often without the knowledge of their owner) to request a service at the same time.
Unlike hacking such as phishing or brute force attacks, DoS attacks are generally not aimed at stealing information or causing a security flaw. Nevertheless, the damage to a company’s reputation can be financially cumbersome and time-consuming. For fear of encountering other problems of security and unavailability of their services, customers often decide to switch to competition.
Issues of Concern
Confidentiality is a major challenge for IoT. How will consumer data be used and by whom? An environment in which everything is connected to the Internet – home, office, vehicles, appliances, office equipment, etc. – challenges customers and companies: where are these data and, of course, how they will be used? Companies will need to evaluate their privacy and data security rules to increase their level of play and to ensure the protection and confidentiality of the data collected. It is only when companies take the issue seriously that confidentiality can be guaranteed.
Over time, your business will likely face all kinds of attacks. The important thing is that you do not get distracted by the feat of the week.
Invest your time and money in a strong security structure, concentrate on the most common attacks, regularly train your teams so they can spot attacks as they happen, and focus on threats that are most likely to have the greatest impact on your business. Answers to security concerns exist: there is a need to strengthen security, authentication and data management.
