IoT SECURITY ASSESSMENT & THREAT LANDSCAPE REPORT

Analysis of Vulnerabilities, Attack Surfaces, and Defense Architecture

• Author: Abdul Wahab (Cyber Security Student)
• Date: August 2026
• Classification: ACADEMIC RESEARCH
• Subject: IoT Devices
• Teacher: Farakh Fareed

Executive Summary

The primary theme for the 2018 OWASP Internet of Things Top 10 is simplicity. Rather than having separate lists for risks vs. threats vs. vulnerabilities, or for developers vs. enterprises vs. consumers, the project team elected to have a single, unified list that captures the top things to avoid when dealing with IoT Security. Fostering cybersecurity in the IoT ecosystem, across industry sectors and at scale.

An initial public draft (IPD) of NIST SP 800-213 Revision 1, IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements is out now for your review and comment! The IPD reflects current needs, with lessons learned from stakeholders who use these guidelines. Particularly, it’s focused on providing clearer guidance, more relevant content, and better alignment to today’s environment. (https://nvlpubs.nist.gov/nistpubs/ir/2019/NIST.IR.8228.pdf)

Introduction & IoT Attack Surface

The Internet of Things (IoT) refers to a network of physical devices, vehicles, appliances, and other physical objects that are embedded with sensors, software, and network connectivity, allowing them to collect and share data. IoT enables these smart devices to communicate with each other and with other internet-enabled devices. Like smartphones and gateways, creating a vast network of interconnected devices that can exchange data and perform various tasks autonomously. For this research, our primary goal is to define an attack surface for networks utilizing the IoT (Internet of Things) devices. The IoT consists of systems of integrated objects, computing devices, digital, or mechanical machines that are given the ability to transmit and

receive the data over a network without the need for human interaction. An attacker or an unauthorized user can take advantage of these attack vectors to penetrate and change or extract data from the threat environment. By designing an IoT architecture and breaking it down into

several zones, we focus on each zone to identify any vulnerability or weaknesses within a system that allows unauthorized privileges, as well as any attacks that can target that area.

IoT Architectural Vulnerabilities

Vulnerabilities in IoT are weaknesses or flaws in device design, communication, software, or

hardware that could be exploited by attackers to steal data, gain unauthorized control, or disrupt services. These vulnerabilities are present across various IoT layers: device, network, cloud, and application.

IoT security must be layered, addressing vulnerabilities at every point in the system. These models follow the five-layer IoT :

1. Perception Layer (Sensing/Device Layer)
2. Network Layer
3. Middleware Layer
4. Application/Service Layer
5. Cloud/Storage Layer

Threat Landscape & OWASP IoT Top 10 :

Billions of active IoT and edge devices expand enterprise and consumer exposure. Bots constantly scan for default passwords and unpatched ports.

Remote Code Execution (RCE)

• • Exploitable vulnerabilities in cash registers and other IoT devices
  • Ability to execute arbitrary commands, often chained with “;” separators

Malware Infiltration

• • Known malware (e.g., “Tsunami”, Mirai Botnet variants)
  • Unknown malware with seemingly legitimate signatures
  • Example: Malware communicating with suspicious domains (e.g., pokdeng.com)

Multi-Stage Exploits

A sophisticated attack pattern observed in recent IoT breaches:

• • Initial connection via exposed web server (commonly on Port 8080)
  • Secondary connection to a new, apparently “legitimate” domain
  • Execution of a new, seemingly “legitimate” process (e.g., hacked.sh)

Tunnels Server Exploitation

• • Persistent SSH connections to all devices in a network
  • Potential for widespread access across global device networks
  • Exploitation of shared certificates and super user credentials

Weak or Hardcoded Passwords

Many IoT devices use default or hardcoded credentials that users never change. This allows attackers to gain instant unauthorized access without complex techniques.

Insecure Network Services

Devices often expose unnecessary services like Telnet or FTP, increasing the attack surface. These services may lack proper authentication or contain exploitable flaws.

Insecure Ecosystem Interfaces

Web apps, mobile apps, and APIs controlling IoT devices may lack proper validation and access controls. Attackers can exploit these interfaces to manipulate devices or extract data.

Lack of Secure Update Mechanisms

IoT devices may not verify firmware authenticity before installing updates. This allows attackers to push malicious or modified firmware.

Use of Outdated Components

Devices often rely on outdated libraries with known vulnerabilities. These can be exploited using publicly available exploits.

Insufficient Privacy Protection

Sensitive data collected by devices is not properly secured or access-controlled. This can lead to data leaks or unauthorized tracking.

Insecure Data Transfer and Storage

Data may be transmitted in plaintext or stored without encryption. Attackers can intercept or retrieve this data easily.

Lack of Device Management

Organizations may not track or monitor IoT devices effectively. This leads to unmanaged or vulnerable devices remaining active.

Insecure Default Settings

Devices are often deployed with insecure configurations like open access or disabled logging. These defaults create easy entry points.

Lack of Physical Hardening

IoT devices can be physically accessed and tampered with. Attackers can extract firmware or manipulate hardware.

Real-World Case Study / Attack Scenario

The Mirai botnet attack of 2016 was a massive cyber-attack that affected millions of devices connected to the Internet of Things (IoT). The attack was carried out by a malware called Mirai, which targeted vulnerable IoT devices and turned them into bots that could be used for Distributed Denial of Service (DDoS) attacks. This case study explores the Mirai botnet attack, its impact, and the lessons learned from the incident.

Press enter or click to view image in full size

Working of Botnet. The Mirai botnet attack occurred in late 2016, when the Mirai malware was used to launch a series of DDoS attacks. Mirai is a type of malware that targets IoT devices, such as routers, cameras, and other connected devices, that are protected by default passwords or are running unpatched software.

More than 600,000+ IoT devices infected (CCTV cameras, routers, DVRs) and Krebs on Security ne 620 Gbps attack survive kiya. Dyn DNS pe attack Twitter, Netflix. And Default telnet credentials brute-forced

And according to Verkada Cameras Breach March 2021, more than 1500000 cameras were exposed.