A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> FMS attack: This type of attack was released in 2001 by <s> The 802.11 encryption standard Wired Equivalent Privacy (WEP) is still widely used today despite the numerous discussions on its insecurity. In this paper, we present a novel vulnerability which allows an attacker to send arbitrary data on a WEP network after having eavesdropped a single data packet. Furthermore, we present techniques for real-time decryption of data packets, which may be used under common circumstances. Vendor produced mitigation techniques which cause frequent WEP re-keying prevent traditional attacks, whereas our attack remains effective even in such scenarios. We implemented a fully automatic version of this attack which demonstrates its practicality and feasibility in real networks. As even rapidly re-keyed networks can be quickly compromised, we believe WEP must now be abandoned rather than patched yet again. <s> BIB001 </s> A Comprehensive IoT Attacks Survey based on a Building-blocked Reference Model <s> FMS attack: This type of attack was released in 2001 by <s> This paper presents new attacks against TKIP within IEEE 802.11 based networks. Using the known Beck-Tews attack, we define schemas to con- tinuously generate new keystreams, which allow more and longer arbitrary packets to be injected into the network. We further describe an attack against the Michael message integrity code, that allows an attacker to concatenate a known with an unknown valid TKIP packet such that the unknown MIC at the end is still valid for the new entire packet. Based on this, a schema to decrypt all traffic that flows towards the client is described. <s> BIB002
Fluhere, Shamir, and Mantin. The attackers have compromised the WEP protocol due to its vulnerabilities. It is a stream cipher attack in which attackers could recover the encryption key used to encrypt exchange by knowing Initialization vectors (IV). However, the possibility of this attack on RC4-based SSL(TLS) is very difficult as the key generation depends on a hash function  . Korek attack: Korek, an unknown participant on NetStuumbler.org security forums, has discovered a new attack on Wired Equivalent Privacy (WEP) protocol  . Such attack depends on FMS-attack to find the key. Furthermore, he has released an A-neg attack through which the attackers could reduce the key generation possibilities to discover the key faster  . Chopchop attack: The Chopchop attack was developed by Korek. Instead of compromising a vulnerability in the RC4 algorithm, such attack focuses on the design defects in WEP protocol such as the vulnerability in CRC 32 check-sum and the absence of replay protection. Chopchop attack allows an attacker to encrypt the exchange messages without knowing the key  . Fragmentation attack: A fragmentation attack has been discussed on the context of WEP protocol and the first implementation of such attack was published by Bittqu et al. BIB001 . To successfully perform this attack, eavesdropping a packet is required. All packets transmitted over 802.11 network have homogeneous headers and, which helps the attacker to guess the first 8 bytes of the headers by XORing these 8 bytes and 8 bytes of cipher text, to get 8 bytes from the IV BIB001 ,  . PTW Attack: The Pyshkin Tews Weinmann (PTW) attack was released in 2007. This attack has introduced two new principals: 1) Jenkins relationship proposed to guess the key with less minimum attempts; and 2) multiple bytes prediction instead of guessing bytes indvidually BIB001 . Google Replay Attack: By setting Google.com as a home page, an attacker could simply discover a part of key stream using Google log downloaded every time the users open the Google website. The main difficulty of this attack is how to know exactly when users will download the Google log  . Michael Attacks: Michael's algorithm is used to generate a hash function. However, Reck and Tews in [53] discovered a method in which they could reverse this algorithm. Also, Beck in BIB002 found a method to execute attack based on Michael's flaws by exploiting its internal state to be reset when it reaching a particular point. In this case, an attacker could inject some code in a packet. Ohigashi-Morii Attack: This type of attack was introduced as an extension to Beck-Tews attack on WPA-TKIP. In fact, this attack is effective for all modes of WPA. The time of injecting a malicious packet is minimized approximately from 15 to one minute in the best case  . The Hole196 Vulnerability: This vulnerability has been discovered by Sohail Ahmad in  . Ahmed found that there is a hole in standard 802.11 protocols exactly on the page 196. An attacker, who is an unauthorized user of the network, could send a fake ARP request with access point MAC address and other users will update their ARP tables upon the request. After updating their ARP tables, users will transmit their packets to attacker's MAC address instead of access point. The attacker, in this scenario, can get the packets decrypted by the access point, read them, and re-encrypt these packets with his own key  . Dictionary Attack: A dictionary attack is a technique in which an attacker could breach into a password-protected WiFi by guessing its passphrase by attempting millions or billions of possibilities, for instance words in a dictionary.  .