Threats, Vulnerabilities and Attack Surfaces

Introduction

An Internet of Things (IoT) system connects physical objects, sensors, actuators, gateways, networks, applications and cloud services. This connectivity creates operational value, but it also enlarges the number of places where an attacker may interfere with confidentiality, integrity, availability, safety or privacy.

IoT security therefore begins with a systematic question: Where can an adversary interact with the system, and what weaknesses could make that interaction successful? The answer is not limited to the device itself. A sensor may be secure while its mobile application exposes credentials; a gateway may be correctly configured while a supplier delivers vulnerable firmware; and a cloud service may be well protected while users retain default passwords.

This chapter examines IoT attack surfaces and common threats across the device, physical, firmware, network, application, cloud, human and supply-chain domains. It also introduces threat intelligence, attack trees and the OWASP IoT risk categories as practical methods for analysis.

Learning Objectives

By the end of this chapter, a learner should be able to:

• distinguish threats, vulnerabilities, risks and attack surfaces;
• identify major IoT attack surfaces and typical weaknesses in each;
• explain common attacks against IoT devices and supporting services;
• apply threat intelligence to IoT risk assessment;
• construct a simple attack tree;
• use the OWASP IoT risk categories to organize security findings;
• recommend practical controls for a small IoT deployment; and
• discuss ethical, privacy, governance and supply-chain responsibilities.

1. Fundamental Concepts

1.1 Assets, threats, vulnerabilities and risk

An asset is something valuable that requires protection. In IoT, assets include sensor readings, actuator commands, device identities, cryptographic keys, personal data, operational availability and physical processes.

A threat is a potential cause of harm. Examples include a criminal attempting to take control of cameras, a botnet scanning the Internet, malicious insiders, equipment failure and a compromised supplier.

A vulnerability is a weakness that can be exploited. Examples include a hard-coded password, an unencrypted management interface, an outdated library or an exposed debug port.

An attack is an intentional action that attempts to exploit a vulnerability. An impact is the resulting harm, such as data disclosure, unsafe actuator operation or service interruption.

Risk is commonly described qualitatively as a combination of likelihood and impact. A simple risk-ranking expression is:

Likelihood and impact may be rated using ordinal scales such as 1 to 5. These numbers are decision-support scores, not physical measurements. They should not be treated as precise probabilities unless a validated quantitative method is used. A high-impact safety failure may require priority even when its likelihood is low.

1.2 Attack surface and attack vector

The attack surface is the collection of interfaces, components and pathways through which an attacker may reach an asset. An attack vector is the particular method used, such as password guessing, malicious firmware, packet injection or social engineering.

Attack surfaces may be:

• External, such as Internet-facing APIs and wireless interfaces;
• Internal, such as debug connectors and local administrative ports;
• Logical, such as authentication protocols and software APIs; or
• Physical, such as removable storage, buttons and exposed circuit boards.

Attack-surface analysis considers both intentional interfaces and accidental ones. A device may intentionally provide a web dashboard but unintentionally expose a serial console through a test header.

1.3 Security properties in IoT

IoT security must protect more than data confidentiality:

• Confidentiality: only authorized parties can view information.
• Integrity: data, commands and firmware are not altered improperly.
• Availability: services and devices remain usable when required.
• Authenticity: an entity or message is genuine.
• Accountability: actions can be traced to responsible identities.
• Safety: security failures do not create unacceptable physical harm.
• Privacy: personal information is collected and used appropriately.

The importance of each property depends on context. Confidentiality may dominate in a health-monitoring system, while integrity and safety may dominate in industrial control.

2. The IoT Attack-Surface Model

A useful assessment follows the complete lifecycle: manufacture, provisioning, deployment, operation, maintenance and disposal. The following surfaces are closely connected rather than isolated.

2.1 Device attack surface

The device includes sensors, actuators, processors, memory, operating systems, local storage, ports and interfaces. Typical weaknesses include:

• default or shared credentials;
• unnecessary services and open ports;
• insecure local APIs;
• insufficient input validation;
• exposed secrets in configuration files;
• weak random-number generation;
• lack of secure boot; and
• insecure storage of keys or personal data.

Resource constraints do not remove the need for security. They may require lightweight cryptography, efficient logging and carefully designed update mechanisms, but they do not justify permanent default passwords or unauthenticated administrative access.

2.2 Physical attack surface

An attacker with physical access may inspect memory, attach probes, remove flash storage, press reset buttons, replace components or access debug interfaces such as UART, JTAG or SWD. Physical attacks may allow extraction of keys, bypassing of software controls or installation of modified firmware.

Controls include tamper-evident enclosures, disabling production debug interfaces, secure key storage, encrypted storage, authenticated recovery procedures and restrictions on physical access. Physical protection must be proportionate: a consumer sensor and a payment terminal do not face identical risks.

2.3 Firmware and software attack surface

Firmware controls device behavior and often runs with high privilege. Vulnerabilities may arise from memory-safety errors, command injection, insecure update logic, obsolete libraries, unsafe parsers or embedded credentials.

A secure update process should provide:

1. authenticity verification using signed images;
2. integrity checking during download and installation;
3. rollback protection or controlled rollback;
4. recovery from interrupted updates; and
5. a supported process for vulnerability disclosure and patch delivery.

Encryption alone does not prove that firmware is trustworthy. Confidential firmware can still be malicious or altered. Digital signatures provide authenticity when signing keys and verification procedures are properly managed.

2.4 Network attack surface

IoT devices communicate through Ethernet, Wi-Fi, Bluetooth, Zigbee, cellular networks, LoRaWAN or proprietary protocols. Network threats include eavesdropping, replay, spoofing, man-in-the-middle attacks, denial of service, routing attacks and unauthorized scanning.

Important controls include mutual authentication, secure transport, network segmentation, firewall rules, rate limiting, secure configuration and monitoring. A flat network allows compromise of one low-value sensor to become a pathway toward valuable enterprise systems. Segmentation limits this lateral movement.

Security mechanisms must also protect message freshness. An attacker who records a valid “unlock” command may replay it later unless the protocol uses nonces, timestamps, sequence numbers or another suitable freshness mechanism.

2.5 Application and API attack surface

Mobile applications, web dashboards and APIs often expose more functionality than the device itself. Common problems include broken authentication, excessive privileges, insecure direct object references, injection, poor session management and inadequate authorization checks.

Authorization must be enforced server-side. Hiding an administrative button in a mobile application does not prevent a user from calling the underlying API directly. APIs should validate input, restrict objects to the requesting tenant, apply least privilege and generate useful security logs.

2.6 Cloud and backend attack surface

Cloud services aggregate telemetry and frequently issue commands to thousands of devices. Their attack surface includes identity-management systems, storage buckets, message brokers, serverless functions, databases, administrative consoles and third-party integrations.

Common weaknesses include overly broad cloud permissions, exposed storage, insecure secrets, poor tenant isolation, unprotected management interfaces and inadequate monitoring. Cloud security follows a shared-responsibility model: the provider secures parts of the infrastructure, while the IoT organization remains responsible for configuration, identities, applications and data handling.

2.7 Human attack surface

People operate, install, maintain and support IoT systems. Human weaknesses include password reuse, phishing, unsafe commissioning, unauthorized sharing of credentials, poor incident reporting and misunderstanding of device warnings.

Effective controls combine technical and organizational measures: individual accounts, multifactor authentication, role-based access, training, clear procedures, separation of duties and rapid revocation when staff change roles.

2.8 Supply-chain attack surface

IoT products depend on chip manufacturers, operating-system vendors, contract manufacturers, firmware libraries, cloud providers, logistics companies and maintenance contractors. A compromised update server, counterfeit component or vulnerable third-party library can affect many customers simultaneously.

Supply-chain management should include supplier due diligence, software bills of materials (SBOMs), signed releases, provenance records, vulnerability-notification obligations, secure build pipelines and defined support periods. Security claims must be verifiable rather than accepted solely on the basis of supplier reputation.

3. Common IoT Attacks

3.1 Credential attacks

Attackers use default passwords, password spraying, credential stuffing and brute force. IoT devices are especially exposed when manufacturers reuse credentials across a product line. Defenses include unique initial credentials, forced change at first use, rate limiting, account lockout with care for availability, multifactor authentication and passwordless device identity where suitable.

3.2 Malware and botnets

A botnet infects devices and uses them for scanning, distributed denial-of-service attacks, spam or proxy services. Weak remote-management services and unpatched firmware are frequent entry points. Network egress controls, vulnerability management, secure updates and monitoring for unusual traffic reduce exposure.

3.3 Eavesdropping and traffic manipulation

Unprotected traffic can reveal locations, routines, health information or operational data. Manipulation may cause incorrect readings or dangerous commands. Properly configured encryption and authenticated protocols reduce these risks, but certificate validation, key rotation and endpoint identity are equally important.

3.4 Replay and command injection

In a replay attack, a valid message is captured and transmitted again. In command injection, attacker-controlled input is interpreted as a command by a shell, database or device interpreter. Input validation, parameterized interfaces, message freshness and strict command authorization are essential defenses.

3.5 Denial of service

An attacker may exhaust bandwidth, battery, memory, CPU capacity or cloud quotas. Wireless jamming and repeated authentication requests can be particularly effective against constrained devices. Resilience measures include resource quotas, back-off strategies, filtering, redundancy and safe failure modes.

3.6 Firmware replacement and downgrade

An attacker may install an altered image or force a device to use an older vulnerable version. Secure boot, signed firmware, version counters and protected update keys help prevent these attacks. Recovery systems must be secured because an unrestricted recovery mode can defeat other controls.

3.7 Physical extraction and cloning

If device secrets are copied, an attacker may impersonate many devices. Hardware-backed key storage, device-unique credentials, tamper resistance and certificate revocation reduce the consequences. Organizations should plan for key compromise rather than assuming it is impossible.

4. Threat Intelligence for IoT

Threat intelligence is processed information about adversaries, campaigns, vulnerabilities, indicators and defensive actions. It is more useful than a raw list of suspicious IP addresses because it explains relevance and likely behavior.

Sources may include vulnerability databases, vendor advisories, national computer emergency response teams, security researchers, internal logs, honeypots and information-sharing communities. Intelligence should be evaluated for reliability, timeliness, specificity and relevance to the organization’s technologies.

A practical workflow is:

1. Define requirements: identify assets, technologies and decisions needing support.
2. Collect information: gather advisories, telemetry and vulnerability reports.
3. Process and enrich: connect indicators to device models, firmware versions and business owners.
4. Analyze: determine likely attack paths and required controls.
5. Disseminate: provide actionable findings to engineers, operators and managers.
6. Review: measure whether intelligence improved detection or reduced exposure.

Indicators of compromise may include unusual DNS requests, unexpected outbound connections, repeated login failures, altered firmware measurements or abnormal command frequency. Indicators should not be used blindly: an IP address can be shared by legitimate and malicious users, and indicators become obsolete.

5. Attack Trees

An attack tree models how an attacker could achieve a top-level goal. The root is the attacker’s objective; branches represent subgoals. An OR relationship means any child may achieve the parent goal. An AND relationship means all required children must be completed.

Illustrative attack tree: unauthorized actuator control

Goal: Operate an industrial actuator without authorization.

• OR:
• compromise the operator account;
• exploit the device network; or
• alter the device firmware.

• Compromise the operator account (AND):
• obtain a password; and
• bypass or satisfy additional authentication.

• Exploit the device network (AND):
• reach the segmented network; and
• send an accepted command.

The tree encourages analysts to ask what evidence and controls apply to each branch. Multifactor authentication can reduce the account branch; segmentation can reduce network reachability; signed firmware can reduce the firmware branch. The model is not a probability calculation unless probabilities and dependencies are defined carefully. It is primarily a structured reasoning tool.

6. OWASP IoT Risk Categories

The OWASP Internet of Things Top 10 is a widely used awareness and assessment framework. Its categories are not a complete risk register, but they provide a useful checklist.

The framework should be applied across the ecosystem. For example, “lack of secure update mechanism” concerns not only the device updater but also signing infrastructure, distribution servers, operational approval and recovery procedures.

7. Applied Case: Connected Cold-Chain Monitoring

Background

This illustrative case concerns a company using battery-powered temperature sensors in refrigerated food transport. Sensors transmit measurements through cellular gateways to a cloud dashboard. Alerts are sent to logistics staff when temperature thresholds are exceeded.

Problem

An assessment found that several sensors used a common default password, transmitted telemetry through an unencrypted local protocol and had no documented firmware-support period. The cloud dashboard used a shared operations account. A gateway was connected to both the sensor network and the corporate office network.

Analysis

The assets were temperature records, shipment location, customer information, gateway credentials and the integrity of alarm messages. Threats included credential attacks, false readings, denial of service and lateral movement from a compromised gateway.

An attack tree for “suppress a genuine temperature alarm” included:

• compromise a sensor and falsify readings;
• compromise the gateway and block messages; or
• compromise the cloud account and alter alert rules.

The findings mapped to several OWASP categories: weak passwords, insecure data transfer, lack of device management, insecure default settings and insecure ecosystem interfaces.

Approach and solution

The company replaced shared passwords with device-unique credentials and individual cloud accounts. It introduced role-based access and multifactor authentication for administrators. Gateways were placed in a segmented network, and only required outbound connections were permitted. Telemetry was authenticated and encrypted. Firmware updates were signed, and a device inventory recorded model, owner, firmware version and support status.

A monitoring rule identified gateways making unexpected outbound connections. The organization also established a supplier requirement for vulnerability notification and an SBOM for future releases.

Outcome

The changes reduced the likelihood that one compromised sensor could affect the corporate network or falsify the complete monitoring chain. They also improved incident response because operators could identify affected devices and revoke individual credentials.

Learning points

Security was not solved by purchasing a stronger sensor. The risk arose from interactions among credentials, protocols, gateways, cloud accounts, network architecture and supplier practices. IoT assessment must therefore follow data and control flows across the whole ecosystem.

8. Assessment and Secure-Design Practices

A practical assessment can proceed as follows:

1. Create an asset and data-flow inventory.
2. Identify trust boundaries and exposed interfaces.
3. Record device models, firmware versions, owners and support status.
4. Identify threats using advisories, threat intelligence and stakeholder knowledge.
5. Build attack trees for high-consequence goals.
6. Map findings to OWASP categories and organizational controls.
7. Rank risks by likelihood, impact, exploitability and safety consequences.
8. Select preventive, detective and recovery controls.
9. Test controls through code review, configuration review, penetration testing and update exercises.
10. Reassess after changes, incidents or newly disclosed vulnerabilities.

Secure design should follow least privilege, defense in depth, secure defaults, fail-safe behavior, complete mediation and separation of duties. Testing must be authorized and performed safely; probing operational devices without permission can disrupt services or create physical danger.

9. Governance, Ethics and Contemporary Developments

IoT systems often process personal information indirectly. A smart building may infer occupancy, health conditions or work patterns even when users do not actively submit such data. Organizations should define purpose, minimize collection, limit retention, protect access and provide appropriate transparency.

Safety-critical deployments require coordinated security and safety engineering. A security control that blocks all commands during an attack may itself create unsafe conditions. Recovery and manual override procedures must be tested.

Regulatory obligations vary by jurisdiction, but common expectations include reasonable security, breach response, privacy protection, vulnerability management and product support. Procurement contracts should specify security updates, disclosure timelines, access control, audit rights and end-of-life responsibilities.

Artificial intelligence can assist anomaly detection, vulnerability prioritization and log analysis. However, AI-generated alerts may produce false positives, and models can be manipulated or trained on poor data. AI should support, not replace, human judgment, verified evidence and established incident procedures.

Challenges and Limitations

IoT security is difficult because devices may remain deployed for many years, have limited computing resources, depend on unavailable vendors and operate in physically uncontrolled environments. Legacy protocols may not support modern authentication. Security updates can be costly or impossible after product discontinuation.

Frameworks and checklists also have limitations. OWASP categories organize common weaknesses but do not calculate business impact. Attack trees reveal logic but may omit organizational dependencies. Threat intelligence can be incomplete or biased toward well-observed attacks. Consequently, assessment requires technical evidence, operational knowledge and continuing review.

Chapter Summary

IoT attack surfaces extend across devices, physical interfaces, firmware, networks, applications, cloud services, people and the supply chain. Threats exploit vulnerabilities to affect confidentiality, integrity, availability, authenticity, privacy or safety. Effective analysis begins with an asset and data-flow inventory, then examines trust boundaries and lifecycle processes.

Threat intelligence provides context about adversaries and vulnerabilities. Attack trees structure reasoning about how an attacker may achieve a harmful goal, using OR and AND relationships. The OWASP IoT risk categories provide a practical checklist covering passwords, services, ecosystem interfaces, updates, components, privacy, data protection, device management, defaults and physical hardening.

Strong IoT security combines secure defaults, unique identities, least privilege, segmentation, authenticated updates, protected keys, monitoring, supplier governance and tested recovery. Because IoT systems connect digital and physical environments, security decisions must also consider safety, privacy, ethics and long-term support.

Key Terms

Attack surface: The set of interfaces and pathways through which a system may be attacked.

Attack vector: A particular method used to exploit a system.

Asset: Something valuable that requires protection.

Attack tree: A hierarchical model of subgoals leading to an attacker’s objective.

Authenticity: Assurance that an entity, message or software package is genuine.

Confidentiality: Protection against unauthorized disclosure.

Firmware: Software embedded in or closely controlling a device.

Integrity: Protection against unauthorized alteration.

Least privilege: Giving an identity only the access required for its role.

Man-in-the-middle attack: Interception and possible alteration of communication between parties.

OWASP IoT Top 10: A recognized list of common IoT security risk categories.

Replay attack: Reusing a previously valid message or transaction.

Risk: The potential for harm arising from threats exploiting vulnerabilities.

Security update: A software or firmware change intended to correct weaknesses or improve protection.

Supply-chain attack: An attack introduced through a supplier, component, dependency or distribution process.

Threat: A potential cause of harm.

Threat intelligence: Analyzed information about threats, adversaries, vulnerabilities and defensive actions.

Vulnerability: A weakness that can be exploited.

Zero trust: An approach that continuously verifies access rather than assuming trust based on network location.

Review Questions

Short Answer Questions

1. Define an IoT attack surface and give two examples.
2. Distinguish a threat from a vulnerability.
3. Why are signed firmware updates important?
4. What is the purpose of network segmentation in an IoT deployment?
5. State two risks associated with shared default passwords.

Long Answer Questions

1. Explain the major IoT attack surfaces and show how weaknesses in two surfaces can combine in a single attack.
2. Describe a practical threat-intelligence workflow for a connected-device organization.
3. Explain how attack trees use OR and AND relationships to analyze IoT attacks.
4. Discuss the ten OWASP IoT risk categories and propose one control for each.
5. Explain why privacy and safety must be considered alongside confidentiality, integrity and availability.

Analytical / Application Questions

1. A sensor network uses default passwords, an unencrypted protocol and a gateway connected to the office network. Identify the principal attack paths and recommend controls in priority order.
2. Construct an attack tree for unauthorized control of a smart-building door lock. Label each relationship as OR or AND and identify preventive and detective controls.
3. A supplier announces a critical vulnerability in a library used by 8,000 deployed devices, but only some devices can receive updates. Design an assessment and response plan covering inventory, prioritization, mitigation, communication and end-of-life decisions.

Multiple Choice Questions with Answers

Question 1

Which statement best defines an IoT attack surface?

A. The total monetary value of an IoT product

B. The collection of interfaces and pathways through which a system may be attacked

C. The physical area covered by a wireless signal

D. The number of devices connected to a cloud service

Correct Answer: B. The collection of interfaces and pathways through which a system may be attacked

Question 2

Which control most directly prevents installation of an altered firmware image?

A. Network address translation

B. Signed firmware with signature verification

C. Increasing wireless transmission power

D. Disabling application logging

Correct Answer: B. Signed firmware with signature verification

Question 3

In an attack tree, an OR relationship means that:

A. All child conditions must be completed

B. Only defenders may use the branch

C. Any one of the child conditions may achieve the parent goal

D. The attack has no possible consequence

Correct Answer: C. Any one of the child conditions may achieve the parent goal

Question 4

Which is an example of an insecure ecosystem interface?

A. A correctly configured enclosure

B. A mobile application with broken server-side authorization

C. A unique device certificate

D. A disabled production debug port

Correct Answer: B. A mobile application with broken server-side authorization

Question 5

What is the main security benefit of network segmentation?

A. It guarantees that passwords cannot be guessed

B. It limits movement from a compromised device to other systems

C. It eliminates the need for firmware updates

D. It makes all traffic anonymous

Correct Answer: B. It limits movement from a compromised device to other systems

Question 6

Which attack reuses a previously captured valid command?

A. Replay attack

B. Supply-chain attack

C. Phishing attack

D. Buffer backup attack

Correct Answer: A. Replay attack

Question 7

Which practice best addresses weak, guessable or hardcoded passwords?

A. Using one shared password for easier maintenance

B. Publishing the password in installation documentation

C. Assigning unique credentials and enforcing strong authentication

D. Disabling all audit logs

Correct Answer: C. Assigning unique credentials and enforcing strong authentication

Question 8

Which item is most directly associated with supply-chain security?

A. Software bills of materials and supplier vulnerability obligations

B. Increasing the brightness of device indicators

C. Removing all device inventories

D. Allowing unsigned third-party updates

Correct Answer: A. Software bills of materials and supplier vulnerability obligations

Question 9

Why is encryption alone insufficient for firmware security?

A. Encrypted firmware cannot be stored on flash memory

B. Encryption does not by itself prove that firmware is authentic

C. Encryption always prevents availability

D. Encrypted firmware cannot be updated

Correct Answer: B. Encryption does not by itself prove that firmware is authentic

Question 10

Which activity is an appropriate use of threat intelligence?

A. Ignoring vendor advisories until an incident occurs

B. Relating vulnerability reports to deployed device models and firmware versions

C. Treating every reported IP address as permanently malicious

D. Replacing authorization with a list of indicators

Correct Answer: B. Relating vulnerability reports to deployed device models and firmware versions