A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> In this paper we present a practically feasible attack on RSA-based sessions in SSL/TLS protocols. We show that incorporating a version number check over PKCS#1 plaintext used in the SSL/TLS creates a side channel that allows an attacker to invert the RSA encryption. The attacker can then either recover the premaster-secret or sign a message on behalf of the server. Practical tests showed that two thirds of randomly chosen Internet SSL/TLS servers were vulnerable. The attack is an extension of Bleichenbacher’s attack on PKCS#1 (v. 1.5). We introduce the concept of a bad-version oracle (BVO) that covers the side channel leakage, and present several methods that speed up the original algorithm. Our attack was successfully tested in practice and the results of complexity measurements are presented in the paper. <s> BIB001 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> We present a novel, automated way to find differential paths for MD5. As an application we have shown how, at an approximate expected cost of 250calls to the MD5 compression function, for any two chosen message prefixes Pand P?, suffixes Sand S? can be constructed such that the concatenated values P||Sand P?||S? collide under MD5. Although the practical attack potential of this construction of chosen-prefix collisionsis limited, it is of greater concern than random collisions for MD5. To illustrate the practicality of our method, we constructed two MD5 based X.509 certificates with identical signatures but different public keys anddifferent Distinguished Name fields, whereas our previous construction of colliding X.509 certificates required identical name fields. We speculate on other possibilities for abusing chosen-prefix collisions. More details than can be included here can be found on www.win.tue.nl/hashclash/ChosenPrefixCollisions/ . <s> BIB002 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> Cloud Computing represents a new computing model that poses many demanding security issues at all levels, e.g., network, host, application, and data levels. The variety of the delivery models presents different security challenges depending on the model and consumers' Quality of Service (QoS) requirements. Confidentiality, Integrity, Availability, Authenticity, and Privacy are essential concerns for both Cloud providers and consumers as well. Infrastructure as a Service (IaaS) serves as the foundation layer for the other delivery models, and a lack of security in this layer will certainly affect the other delivery models, i.e., PaaS, and SaaS that are built upon IaaS layer. This paper presents an elaborated study of IaaS components' security and determines vulnerabilities and countermeasures. Finally, as a result of this research, we propose a Security Model for IaaS (SMI) to guide security assessment and enhancement in IaaS layer. <s> BIB003 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> In meteorology, the most destructive extratropical cyclones evolve with the formation of a bent-back front and cloud head separated from the main polar-front, creating a hook that completely encircles a pocket of warm air with colder air. The most damaging winds occur near the tip of the hook. The cloud hook formation provides a useful analogy for cloud computing, in which the most acute obstacles with outsourced services (i.e., the cloud hook) are security and privacy issues. This paper identifies key issues, which are believed to have long-term significance in cloud computing security and privacy, based on documented problems and exhibited weaknesses. <s> BIB004 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> As companies turn to cloud computing technology to streamline and save money, security is a fundamental concern. Loss of certain control and lack of trust make this transition difficult unless you know how to handle it. Securing the Cloud discusses making the move to the cloud while securing your peice of it! The cloud offers felxibility, adaptability, scalability, and in the case of security-resilience. This book details the strengths and weaknesses of securing your company's information with different cloud approaches. Attacks can focus on your infrastructure, communications network, data, or services. The author offers a clear and concise framework to secure your business' assets while making the most of this new technology. Provides a sturdy and stable framework to secure your piece of the cloud, consideringalternate approaches such as private vs. public clouds, SaaS vs. IaaS,and loss of control and lack of trustDiscusses the cloud's impact on security roles, highlighting security as a service, data backup and disaster recoveryDetails the benefits of moving to the cloud-solving for limited availability of space, power and storage <s> BIB005 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> This paper describes a cross-protocol attack on all versions of TLS; it can be seen as an extension of the Wagner and Schneier attack on SSL 3.0. The attack presents valid explicit elliptic curve Diffie-Hellman parameters signed by a server to a client that incorrectly interprets these parameters as valid plain Diffie-Hellman parameters. Our attack enables an adversary to successfully impersonate a server to a random client after obtaining 240 signed elliptic curve keys from the original server. While attacking a specific client is improbable due to the high number of signed keys required during the lifetime of one TLS handshake, it is not completely unrealistic for a setting where the server has high computational power and the attacker contents itself with recovering one out of many session keys. We remark that popular open-source server implementations are not susceptible to this attack, since they typically do not support the explicit curve option. Finally we propose a fix that renders the protocol immune to this family of cross-protocol attacks. <s> BIB006 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> The Transport Layer Security (TLS) protocol aims to provide confidentiality and integrity of data in transit across untrusted networks. TLS has become the de facto secure protocol of choice for Internet and mobile applications. DTLS is a variant of TLS that is growing in importance. In this paper, we present distinguishing and plaintext recovery attacks against TLS and DTLS. The attacks are based on a delicate timing analysis of decryption processing in the two protocols. We include experimental results demonstrating the feasibility of the attacks in realistic network environments for several different implementations of TLS and DTLS, including the leading OpenSSL implementations. We provide countermeasures for the attacks. Finally, we discuss the wider implications of our attacks for the cryptographic design used by TLS and DTLS. <s> BIB007 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> Cloud computing is a model to provide convenient, on-demand access to a shared pool configurable computing resources. In cloud computing, IT-related capabilities are provided as services, accessible without requiring detailed knowledge of the underlying technologies, and with minimal management effort. The great savings promised by the cloud are however offset by the perceived security threats feared by users. This paper gives an overview of cloud computing, and discusses related security challenges. We emphasize that although there are many technological approaches that can improve cloud security, there are currently no one-size-fits-all solutions, and future work has to tackle challenges such as service level agreements for security, as well as holistic mechanisms for ensuring accountability in the cloud. <s> BIB008 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> Over the last few years, there have been several serious attacks on ::: Transport Layer Security (TLS), including attacks on its most commonly ::: used ciphers and modes of operation. This document summarizes these ::: attacks, with the goal of motivating generic and protocol-specific ::: recommendations on the usage of TLS and Datagram TLS (DTLS). <s> BIB009 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Beast: <s> Abstract Recent technological advances have sparked the popularity and success of cloud. This new paradigm is gaining an expanding interest, since it provides cost efficient architectures that support the transmission, storage, and intensive computing of data. However, these promising storage services bring many challenging design issues, considerably due to both loss of data control and abstract nature of clouds. The objective of this survey is to provide a consistent view about both data security concerns and privacy issues that are faced by clients in cloud storage environments. This survey brings a critical comparative analysis of cryptographic defense mechanisms, and beyond this, it explores research directions and technology trends to address the protection of outsourced data in cloud infrastructures. <s> BIB010
The beast attack depends heavily on exploiting the vulnerabilities in TLS 1.0, as it implements Cipher Block Chaining (CBC). Having used HTTP to run over TLS, the attacker can use the CBC to decrypt either parts of message or HTTP cookies  . Diffie-Hellman Parameters: All TLS versions are vulnerable to some attacks known as cross-protocol attacks when Diffie-Helman and Elliptic Curve Diffie-Hellman parameters are used to exchange the pre-shared key BIB006 . Klima03: It is a kind of Certificate and RSA-related attacks on TLS. The process of deriving all session keys depends entirely on premaster-secret value. So, the entire captured SSL/TLS could be decrypted once an attacker get the premaster-secret value BIB001 . Time: It is a type of compression attacks using TLS with TLS-level compression, which may help an active adversary to decrypt the cipher-text, particularly cookies BIB009 . Padding oracle(Thirteen): This type of attack is introwww.ijacsa.thesai.org BIB009 duced as a result of using the MAC-then-encrypt in all TLS versions. A thirteen is a new type of such attack in which a timing side channel is utilizing to decrypt the ciphertext BIB007 . Xmpp bomb: This type of attack can be used to launch a DoS attack specially when the attacker sends a valid compressed request with lot of white spaces  . XMPPloit: This attack depends heavily on XMPP weaknesses and the main goal of which is to act as a gateway between clients and server forcing clients to send their messages without encryption. Man-in-the middle (MITM): Because MQTT has been designed to send its usernames and passwords without any encryption, it is vulnerable to the MITM attack  . Buffer overflow: The buffer overflow attack can be happened as a consequence of opening a port on MQTT protocol  . An overview of all communication protocol attacks, their compromised security goals, and their available defense mechanisms is presented in Table VIII. 3) Data at rest-based attacks: In this section, we will identify all potential threats and possible attacks targeting only IoT data at rest resided either locally in IoT objects or remotely in the cloud, as most of the attacks targeting data in motion have been implicitly discussed in protocols attacks. A brief description of all attacks targeting IoT data at rest is presented below and depicted in Fig. 14. Data exposure: An IoT data is subjected to several attacks due to storing them remotely on the data centers with no supervision of their holders. The number of attacks will be increased, as the malicious objects can get access to these data once they are not properly protected due to the lack of encryption and key management BIB008 . Additionally, data may place in different data centers distributed at different geographical countries, and have a high power to access this data without permission of their holders BIB010 . Data loss: IoT objects and cloud providers should be equipped with data loss prevention to deal with high possibility of losing data, causing harmful consequences such as a ransomware attack  . Account hijacking: Weak passwords and social engineering might be used to perform an account hijacking. An attacker may compromise, manipulate, and redirect the sensitive data  . In the cloud environment, application program interfaces such as SoAP, REST, and HTTP have been used to provides different services. However, many issues have been identified with such interfaces, and the most notable of which are week passwords, insufficient authorization inspections, and input data validation BIB003 . Data scavenging: Being recoverable, IoT data are vulnerable to many attacks if they are not properly destroyed or removed BIB004 . Data leakage The lack of the secure methods of processing, storing, and transmitting data is the main consequence of this attack, for example, storing unencrypted data either on the cloud or on IoT objects  . DoS: Making IoT data inaccessible by legitimate users is the main objective of such attack. Dos attack exploit the vulnerabilities of the application interface programs (API)  , BIB003 . Data manipulation: Illegal manipulating of data at rest can be achieved in two ways: 1) exploiting different vulnerabilities in API like SQL injection, and cross site scripting; and 2) taking advantage of weak security mechanisms such as small passwords  . Virtual Machine (VM) Escape: VM escape exploits weaknesses of hyper-visor. The objective of such attack is to dominate the underlying infrastructure gready for its configuration flexibility and code complexity, which matches companies needs BIB004 . VM Hopping: Due to the hyper-visor complexity, the unlimited resource allocation, and its configuration flexibility on the cloud, attackers may be able to attack one VM to gain access to another one BIB005 . Malicious VM creation: As many VM images are dewww.ijacsa.thesai.org  ployed in unattended environments, an attacker could build legitimate VM account containing a malicious code like Trojan horse  . Insecure VM migration: An attacker could get access to data illegally during the immigration process of a VM to a malicious or a trusted host, which may expose its data to the network  . Brute-force attack: This type of attack depends on a trial and error method in order to get information such as user passwords or personal identification number (PIN). Brute force attack uses automated software to generate a huge number of sequential guesses to decrpypt the the ciphertext  . Hash collision: The main objective of the collision attack is to discover two input strings of a hash function that gives the same hash value. Because hash functions have variable input lengths and a short fixed length output, there is a possibility that two different inputs generate the same output and this case is known as a collision BIB002 . An overview of all data at rest attacks, their compromised security goals, and their available defense mechanisms is presented in Table IX .