Noman Haitham Ameen, Abu-Sharkh Osama M F
Computer Engineering Department, King Abdullah II School of Engineering, Princess Sumaya University for Technology, Amman 11941, Jordan.
Sensors (Basel). 2023 Jun 30;23(13):6067. doi: 10.3390/s23136067.
The Internet of Things (IoT) has transformed various domains in our lives by enabling seamless communication and data exchange between interconnected devices, necessitating robust networking infrastructure. This paper presents a comprehensive analysis of code injection attacks in IoT, focusing on the wireless domain. Code injection attacks exploit security weaknesses in applications or software and can have severe consequences, such as data breaches, financial losses, and denial of service. This paper discusses vulnerabilities in IoT systems and examines how wireless frames in state-of-the-art wireless technologies, which serve IoT applications, are exposed to such attacks. To demonstrate the severity of these threats, we introduce a comprehensive framework illustrating code injection attacks in the wireless domain. Several code injection attacks are performed on Wireless Fidelity (Wi-Fi) devices operating on an embedded system commonly used in IoT applications. Our proof of concept reveals that the victims' devices become further exposed to a full range of cyber-attacks following a successful severe code injection attack. We also demonstrate three scenarios where malicious codes had been detected inside the firmware of wireless devices used in IoT applications by performing reverse engineering techniques. Criticality analysis is conducted for the implemented and demonstrated attacks using Intrusion Modes and Criticality Analysis (IMECA). By understanding the vulnerabilities and potential consequences of code injection attacks on IoT networks and devices, researchers and practitioners can develop more secure IoT systems and better protect against these emerging threats.
物联网（IoT）通过实现互联设备之间的无缝通信和数据交换，改变了我们生活中的各个领域，这就需要强大的网络基础设施。本文对物联网中的代码注入攻击进行了全面分析，重点关注无线领域。代码注入攻击利用应用程序或软件中的安全漏洞，可能会造成严重后果，如数据泄露、财务损失和拒绝服务。本文讨论了物联网系统中的漏洞，并研究了为物联网应用服务的先进无线技术中的无线帧是如何受到此类攻击的。为了证明这些威胁的严重性，我们引入了一个全面的框架来说明无线领域的代码注入攻击。我们对运行在物联网应用中常用的嵌入式系统上的无线保真（Wi-Fi）设备进行了多次代码注入攻击。我们的概念验证表明，在成功实施严重的代码注入攻击后，受害者的设备会更容易受到各种网络攻击。我们还通过执行逆向工程技术，展示了在物联网应用中使用的无线设备固件中检测到恶意代码的三种情况。使用入侵模式和关键性分析（IMECA）对实施和演示的攻击进行关键性分析。通过了解代码注入攻击对物联网网络和设备的漏洞及潜在后果，研究人员和从业人员可以开发出更安全的物联网系统，并更好地防范这些新出现的威胁。
