IoT Layered Architecture – Security Threats

1. Perception Layer:

Eavesdropping: Stealing the information transmitted between sender & Receiver.
Node Capture: Getting full control of node like gateway node. That way all types of data including key used to build secure connection along with data in memory.
Fake Node & Malicious node: Adding not a valid or real node to occupy network bandwidth and hardware resources of real node. That causes destruction of whole network.
Replay attack: By eavesdropping between sender & receiver, an intruder capture the very basic identity of sender and start behaving like he is a real sender such that receiver gets impression that data is coming from real sender. That way intruder can send his or her desired command to receiver.
Timing attack: Intruder tries to observe the time consume between request and response that way tries to understand what types of queries are sent, what type of algorithms are used.

Denial of Service (DoS) attack: Consume whole network bandwidth such that authentic user are not allowed to consume services.
Main-in-The-Middle (MiTM) attack: An attacker intercepts between sender & receiver and change the data of communication such that both sender & receiver believe that they are getting data from each other only.
Storage attack: Altering the information stored in storage devices or on cloud specially when multiple types of people are involved into replication of stored data.
Exploit attack: Taking advantages of security vulnerability, weak algorithm, poor hardware or bad programming helps attacker to retrieve precious information.

Cross site scripting attack: Adding client side malicious script like java-script to change the actual code and execute the code what attacker wants to execute.
Malicious Code attack: A code inside the software itself causes damage of overall system. Such type of code is very hard to detect with even anti virus code.

Denial of Service (DoS) attack: As describe above.
Malicious inside attack: Attack happens with the help of someone inside the network with valid authorization.

Exhaustion attack : To exhaust the system resources like battery & memory consumption.
Malwares attack : In the form of viruses, spyware, adware, Trojans horses and worms.

Business Logic attack: Due to flaw in programming like poor coding, password recovery mechanism, poor validation & bad encryption techniques.
Zero-Day attack: Security issues in application and vendor is not aware about it.