A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> TCP-UDP-based attacks <s> We present application-based TCP hijacking (ABTH), a new attack on TCP applications that exploits flaws due to the interplay between TCP and application protocols to inject data into an application session without either server or client applications noticing the spoofing attack. Following the injection of a TCP packet, ABTH resynchronizes the TCP stacks of both the server and the client. To evaluate the feasibility and effectiveness of ABTH, we developed a tool that allows impersonating users of Windows Live Messenger in the matter of few seconds. Due to its generic nature, ABTH can be mounted on a variety of modern protocols for TCP-based applications. Countermeasures to thwart and/or limit the effectiveness of ABTH could include strict Ethernet switching and cryptographic protection of messages. However, the former cannot be guaranteed by the application provider and the latter appears to be still prohibitively expensive for such large-scale applications with hundreds of millions of sporadic users as Windows Live Messenger. <s> BIB001 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> TCP-UDP-based attacks <s> Distributed denial-of-service attacks on public servers have recently become a serious problem. To assure that network services will not be interrupted and more effective defense mechanisms to protect against malicious traffic, especially SYN floods. One problem in detecting SYN flood traffic is that server nodes or firewalls cannot distinguish the SYN packets of normal TCP connections from those of a SYN flood attack. Another problem is single-point defenses (e.g. firewalls) lack the scalability needed to handle an increase in the attack traffic. We have designed a new defense mechanism to detect the SYN flood attacks. First, we introduce a mechanism for detecting SYN flood traffic more accurately by taking into consideration the time variation of arrival traffic. We investigate the statistics regarding the arrival rates of both normal TCP SYN packets and SYN flood attack packets. We then describe a new detection mechanism based on these statistics. Through the trace driven approach defense nodes which receive the alert messages can identify legitimate traffic and block malicious traffic by delegating SYN/ACK packets. <s> BIB002
Unlike application layer of IoT stack, which has different protocols to choose from such as HTTP, CoAP, MQTT, and DDS, transport layer has only two standardized protocols TCP and UDP. The most common attacks targeting these protocols are: TCP-UDP Port scan: One of the most popular methods used by attackers to explore services to compromise them is a port scan attack. If used a port scan tool, an attacker can send a message to each port to test if the port is working to discover some weaknesses  . UDP flood: It is a kind of DoS attack in which an attacker sends a huge number of UDP packets randomly to different ports to force so many objects to send back ICMP packets which may make some object unreachable BIB002 . TCP Hijacking: The first step to achieve such an attack is to monitor a TCP session. In this case, an attacker can detect and guess the sequence numbers and check-sums of the communicated entities. Then, the attacker can inject a malicious TCP packet containing the check-sum and sequence numbers expected by the receiver, who lacks a mechanism to validate the packet source deeming it as a legitimate one BIB001 . TCP SYN flooding: According to  , more than 90 percent of the DoS attacks target the TCP protocol, and the most popular of which is SYN flooding attack. This attack consists of a set of eavesdropped TCP SYN packets directed to victim's port. Web servers such as Mail servers, and FTP servers and the connected objects are vulnerable to such attack BIB002 .