A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Operating system-based attacks <s> This short paper describes an attack that exploits the online marketplace’s susceptibility to covert fraud, opaqueness of embedded software, and social engineering to hijack account access and ultimately steal money. The attacker introduces a fatal security flaw into a trusted embedded system (e.g. computer motherboard, network interface card, network router, cell phone), distributes it through the online marketplace at a plausible bargain, and then exploits the security flaw to steal information. Unlike conventional fraud, consumer risk far exceeds the price of the good. As proof of concept, the firmware on a wireless home router is replaced by an open source embedded operating system. Once installed, its DNS server is reconfigured to selectively spoof domain resolution. This instance of malicious embedded software is discussed in depth, including implementation details, attack extensions, and countermeasures. <s> BIB001 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> Operating system-based attacks <s> Embedded systems are the driving force for technological development in many domains such as automotive, healthcare, and industrial control in the emerging post-PC era. As more and more computational and networked devices are integrated into all aspects of our lives in a pervasive and “invisible” way, security becomes critical for the dependability of all smart or intelligent systems built upon these embedded systems. In this paper, we conduct a systematic review of the existing threats and vulnerabilities in embedded systems based on public available data. Moreover, based on the information, we derive an attack taxonomy for embedded systems. We envision that the findings in this paper provide a valuable insight of the threat landscape facing embedded systems. The knowledge can be used for a better understanding and the identification of security risks in system analysis and design. <s> BIB002
Phishing attack: It is one of the most common security challenges either to users or companies to keep their sensitive data secure. An attacker could get access to passwords , credit cards and other sensitive data via hacking an email, phones, or social media BIB001 . Backdoors: With the advent of IoT vision, many developers have proposed different IoT operating system like RTOS and Contik . Such operating systems may contain backdoor in which they could reprogram them to get access sensitive data anytime  . Virus, worm attack: Nowadays, many viruses and worms, like Mirai, Stuxnet, and Brickerbot, have been designed to attack some weaknesses such as lack of updat mechanisms found in IoT objects  . Brute-force search attack: This type of attack has been designed to hack an IoT system by breaking its security mechanisms such as cryptography and authentication using different techniques  . Unknown attack: The authors in BIB002 stated that some common vulnerabilities and exposures (CVE) records have not provided with adequate information to define the preconditions of an attack, which classify as as unknown attack.