IoT technology has been developed rapidly without giving appropriate consideration to the security of devices. Due to the security vulnerabilities present in the IoT devices, risks related to potential cyberattacks, stealing of confidential information, privacy invasion, etc. are increasing rapidly. It is necessary for the developers or security professionals to test the devices for various vulnerabilities, before integrating the IoT system and products into an infrastructure.

OWASP Top 10 IoT Threats

Source: https://owasp.org

1. Weak, Guessable, or Hardcoded Passwords

Using weak, guessable, or hardcoded passwords allows publicly available or unchangeable credentials to be determined via brute forcing. This also includes backdoors in the firmware or client software that lead to unauthorized access to the deployed devices.

Examples:

• Default passwords like "admin/admin" or "123456" on IP cameras
• Hardcoded credentials in smart home device firmware
• Factory backdoors in IoT devices that are never changed

Solutions:

• Use Automated Password Management (APM)
• Use strong and complex passwords
• Avoid using hard-coded passwords

2. Insecure Network Services

Insecure network services are prone to various attacks like Buffer Overflow Attacks, which cause a denial-of-service scenario, thus leaving the device inaccessible to the user. An attacker uses various automated tools such as port scanners and fuzzers to detect the open ports and exploit them to gain unauthorized access to services.

These insecure network services that are open to the Internet may compromise the confidentiality, authenticity, integrity, or availability of information and also allow remote access to critical information.

Examples:

• Telnet or SSH services exposed on IoT devices without authentication
• Buffer Overflow vulnerabilities in IoT protocols like UPnP
• Open debugging ports that allow remote command execution

Solutions:

• Close open network ports
• Disable UPnP
• Encrypt data prior to net/sec/PKI/TLS communication

3. Insecure Ecosystem Interfaces

Insecure ecosystem interfaces such as Web, backend API, Mobile, and Cloud interfaces outside the device lead to compromised security of the device and its components. Common vulnerabilities in such interfaces include lack of authentication/authorization, lack of Encryption or weak encryption, and lack of input/output filtering.

Examples:

• Mobile apps controlling smart locks without proper API Authorization
• Cloud dashboards for IoT devices using weak encryption
• Web interfaces with SQL injection vulnerabilities in thermostat controls

Solutions:

• Conduct a periodic assessment of interfaces
• Perform sanity checking and output filtering
• Enable account lockout mechanism
• Use a strong password and two-factor authentication

4. Lack of Secure Update Mechanisms

Lack of secure update mechanisms, such as a lack of firmware validation on the device, lack of secure delivery, lack of anti-rollback mechanisms, or lack of notifications of security changes, may be exploited to perform various attacks.

Examples:

• Smart refrigerators that download firmware updates over unencrypted HTTP
• IoT devices without firmware signing verification
• Lack of notification when security patches are available

Solutions:

• Verify the source and integrity of updates
• Encrypt communication between endpoints
• Notify end-users of security updates

5. Use of Insecure or Outdated Components

Use of outdated or older versions of software components or libraries, such as insecure customization of OS platforms or use of third-party hardware or software components from a compromised supply chain, may allow the devices themselves to be compromised.

Examples:

• Using vulnerable OpenSSL versions in IoT gateways (Heartbleed)
• Deprecated MD5 hashing algorithms in smart meter authentication
• Third-party libraries with known CVEs in wearable fitness trackers

Solutions:

• Monitor regularly for unmaintained components
• Remove unused dependencies and unnecessary features
• Avoid third-party software from compromised supply chain

6. Insufficient Privacy Protection

Insufficient privacy protection allows the user's personal information stored on the devices or ecosystem to be compromised.

Examples:

• Smart TVs collecting viewing habits without user consent
• Fitness trackers sharing location data with third-party advertisers
• Voice assistants storing conversations without clear privacy policies

Solutions:

• Minimize data collection
• Anonymize collected data
• Provide end-users with the ability to decide what data is collected

7. Insecure Data Transfer and Storage

Lack of encryption and access control of data that is in transit or at rest may result in leakage of sensitive information to malicious users.

Examples:

• Smart door locks sending unlock commands over unencrypted Bluetooth
• Health monitors transmitting patient data without net/sec/PKI/TLS encryption
• IoT sensors storing sensitive data locally without Access Controls

Solutions:

• Encrypt communication between endpoints
• Maintain SSL/net/sec/PKI/TLS implementations
• Avoid using propriety encryption solutions

8. Lack of Device Management

Lack of appropriate security support through device management on devices deployed in production, including asset management, update management, secure decommissioning, system monitoring, and response capabilities, may open the door to various attacks.

Examples:

• Lack of inventory tracking for deployed IoT sensors in a smart city
• No remote wipe capability for stolen company tablets
• Inability to push security updates to field-deployed devices

Solutions:

• Blacklist malicious devices from suspicious sources
• Validate all asset attributes
• Secure decommissioning of devices

9. Insecure Default Settings

Insecure or insufficient device settings restrict the operators from modifying configurations to make the device more secure.

Examples:

• Routers shipping with admin passwords enabled by default
• Smart plugs with WPS enabled out of the box
• Baby monitors with remote access enabled without user knowledge

Solutions:

• Change the default usernames and passwords
• Custom modify the privacy and security settings
• Disable remote access to IoT devices when not in use

10. Lack of Physical Hardening

Lack of physical hardening measures allows potential attackers to acquire sensitive information that helps them in performing a remote attack or obtaining local control of the device.

Examples:

• USB ports on IoT devices without physical tamper protection
• Lack of secure boot mechanisms allowing firmware modification
• JTAG debugging interfaces left accessible in production devices

Solutions:

• Set unique password for BIOS/firmware
• Configure device boot order to prevent unauthorized booting
• Minimize external ports such as USB ports