A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> ZigBee-based attacks <s> We implemented an attack against WEP, the link-layer security protocol for 802.11 networks. The attack was described in a recent paper by Fluhrer, Mantin, and Shamir. With our implementation, and permission of the network administrator, we were able to recover the 128 bit secret key used in a production network, with a passive attack. The WEP standard uses RC4 IVs improperly, and the attack exploits this design failure. This paper describes the attack, how we implemented it, and some optimizations to make the attack more efficient. We conclude that 802.11 WEP is totally insecure, and we provide some recommendations. <s> BIB001 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> ZigBee-based attacks <s> In this paper, we describe two attacks on IEEE 802.11 based wireless LANs. The first attack is an improved key recovery attack on WEP, which reduces the average number of packets an attacker has to intercept to recover the secret key. The second attack is (according to our knowledge) the first practical attack on WPA secured wireless networks, besides launching a dictionary attack when a weak pre-shared key (PSK) is used. The attack works if the network is using TKIP to encrypt the traffic. An attacker, who has about 12-15 minutes access to the network is then able to decrypt an ARP request or response and send 7 packets with custom content to network. <s> BIB002 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> ZigBee-based attacks <s> This paper presents new attacks against TKIP within IEEE 802.11 based networks. Using the known Beck-Tews attack, we define schemas to con- tinuously generate new keystreams, which allow more and longer arbitrary packets to be injected into the network. We further describe an attack against the Michael message integrity code, that allows an attacker to concatenate a known with an unknown valid TKIP packet such that the unknown MIC at the end is still valid for the new entire packet. Based on this, a schema to decrypt all traffic that flows towards the client is described. <s> BIB003 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> ZigBee-based attacks <s> Abstract In recent years, a significant increasing in development of Wireless networks is noticed; they become an entire part of the Internet and demonstrate effectiveness in handling communication for reduced public LAN and military applications. This is mainly due to their mobility and low cost solutions; nevertheless, they are also prone to several attacks related to data integrity, Deni of Service and eavesdropping. This paper discusses wireless security protocols, their limitations and weakness. We present also an overview of the FMS (Fluhrer, Mantin, Shamir), a recovery key attack and demonstrate its effectiveness in reducing the average number of intercept packets based on a well choice of IV (initialization vectors). Some comparative experiments on ciphertext-only attacks were performed in order to study the efficiency of such technique and underline encountered difficulties. <s> BIB004 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> ZigBee-based attacks <s> This chapter introduces the first fully implemented two-way authentication security scheme for Internet-of-Things (IoT) based on existing Internet standards, specifically the Datagram Transport Layer Security (DTLS) protocol. By relying on an established standard, existing implementations, engineering techniques, and security infrastructure can be reused, which enables an easy security uptake. The proposed security scheme uses two public key cryptography algorithms, RSA (Rivest, Shamir und Adleman) and Elliptic Curve Cryptography (ECC), tailored for the resource heterogeneous nature of IoT devices. The two-way authentication solution presented is designed to work over standard communication stacks that offer UDP/IPv6 networking for Low power Wireless Personal Area Networks (LoWPANs). A prototype implementation of DTLS is presented here in the context of a system architecture, and the scheme’s feasibility (low overheads and high interoperability) is demonstrated through extensive evaluations on the DTLS-supporting platform OPAL as clusterhead with children of different IoT hardware platforms. <s> BIB005
Sniffing: Because most ZigBee networks do not use any encryption technique, they might be vulnerable to sniffing attacks. The attacker can intercept some packets to perform malicious activities using KillerBess's zbdump tool  . Replay attack: Replay attack depends heavily on network traffic interception. Being able to intercept the packets, the attacker could re-transmit the intercepted data as if they sent The use of RC4-based SSL (TLS), the use of higher-level security mechanisms such as IPsec BIB001 Korek, Chopchop, Fragmentation, PTW, Google replay P, I, AU, TW, NR, C The use of a very short rekeying time, disabling the sending of MIC failure report ,disabling TKIP and using a CCMP only network BIB002 , the use of higher-level security mechanisms such as IPsec, DTLS, HTTP/TLS or CoAP/DTLS, DTLS for CoAp BIB005 Michael P, I, AU, TW, NR, C Deactivating QoS or settingthe rekeying timout to a low value BIB003 , disable TKIP and switch to the more secure CCMP Ohigashi-Morii P, I, AU, TW, NR, C Security protocols based on AES BIB004 Dictionary Attack P, I, AU, TW, NR, C The use of salt technique  by a legitimate user. The main consequence of such an attack relies on the content of the packets being re-transmitted  . Obtaining the key: What makes ZigBee protocol vulnerable to such an attack is that its keys need to be re-installed over the air if its objects are re-flashing  . Redirecting Communication: In the ZigBee network, an attacker could redirect and eavesdrop its packets. This attack attack could be used to launch a MITM attack, the main objective of this attack is intercepting and changing the transmitted data  .