IoT | The good, the bad and the connected

AntoinetteHodes · ‎2024-08-12

The Current IoT Threat Landscape

With an estimated 30 billion connected devices by 2025, the IoT ecosystem is vast and diverse. Each device, however, represents a potential entry point for cyber threats. This connectivity comes with a dark side. IoT devices are increasingly becoming targets for cyberattacks, with waterhole, sinkhole, and blackhole attacks emerging as significant threats. While these terms might sound like the stuff of science fiction, they represent real and pressing dangers in the digital landscape. Here’s what you need to know about these attacks and the hidden risks they pose.

Unseen Dangers | IoT Waterhole, Sinkhole and Blackhole Attacks

In the interconnected realm of IoT devices, data streams freely across devices and networks. Offering in depth visibility and efficiency. However, lurking within these streams are cybersecurity threats: waterhole, sinkhole, and blackhole attacks. Each of these attacks are capable of stealing or corrupting data, crippling networks and bypassing traditional security protocols.

So let me outline these 3 the attack types:

Waterhole Attacks | Hidden Traps

In this type of attack, cybercriminals exploit (known) vulnerabilities in IoT devices to gain unauthorized access. They target devices like smart TVs, home automation systems or other smart assets. Once compromised, these devices can be used as a gateway to infiltrate the user's network or steal sensitive information. Waterhole attacks are the chameleons of the cybersecurity landscape. Example of such an attack cloud be compromising a popular firmware update server (a resource that many assets depend on) and turning it into a deceptive trap. Waterhole attacks can compromise the supply chain, affecting a wide range of devices from a single entry point.

Sinkhole attacks | Redirections of Doom

On the other hand, sinkhole attacks cybercriminals redirect network traffic from IoT assets to a malicious server controlled by them. This is achieved by tampering with the device's DNS settings, manipulation of routing or by manipulating network protocols. In this way cybercriminals can intercept data, launch further attacks or render the IoT asset. A sinkhole attack is often employed as an initial step before launching more destructive attacks or in combination with man-in-the-middle (MitM) attacks. Example here could be compromise IoMT assets and steal sensitive data. Or imagine edge-based IoT assets that can devastate, disrupt and compromise the whole functioning of the complete IoT ecosystem.

Blackhole attacks | The Data Abyss

Blackhole attacks take it even further by not just intercepting, but also discarding the data, creating a void where information simply disappears. Blackhole attacks can cause silent failures where devices appear operational but are effectively cut off, making detection difficult. Let's say we have a smart bulb that needs to communicate with the central hub. Under normal circumstances, the smart bulb sends a signal to the hub, the hub acknowledges it, and a connection is established for data exchange. With blackhole attacks, the malicious device advertises itself to the smart bulb as the quickest path for sending data. The smart bulb, unaware of the malintent, sends its information to the attacker's device.

From this point, two things can happen:

The malicious node can simply drop all the packets, causing a denial-of-service (DoS) ,the "black hole"
Before dropping the packets, the malicious node could analyze or manipulate them, leading to compromised security or corrupted data

This could result in an unresponsive smart bulb or worse compromised sensitive data. Now imagine that the smart bulb is a city’s smart traffic control system or a healthcare management system! In the broader IoT ecosystem, blackhole attacks are particularly dangerous because they can disrupt critical data flow, leading to significant service and security issues in systems like healthcare monitoring, automated manufacturing or critical infrastructure control.

Chips that think, programs that hallucinate and systems that deceive

The future threat landscape of IoT has some new tricks for us. If we take a look how these attacks could advance, we see a real new danger on the horizon. AI plays a crucial part in this.

Adaptive IoT Blackhole attacks, the silent killers | Adaptive blackhole attacks are an advanced form of denial-of-service (DoS) attack. They target IoT devices by intelligently dropping packets of data, preventing devices from communicating with their control servers. These attacks adapt to network conditions to maximize their effectiveness. In the research community, there's ongoing discussion about blackhole attacks that are not static but adaptive. They could change their strategies based on network traffic patterns, making detection even harder. They may also employ ML (machine learning) to optimize the attack in real time.

Polymorphic IoT Sinkhole attacks, the shapeshifters | Polymorphic sinkhole attacks involve redirecting IoT device traffic to malicious servers while continuously changing their attack signatures to evade detection. These attacks can mimic legitimate network behavior, making them particularly insidious. Advanced sinkhole attacks employ polymorphic code, which changes its signature each time it runs, to avoid detection by security systems that rely on signature-based detection methods (for example IPS and IDS)

AI-Powered IoT Waterhole Attacks, the intelligent traps | AI-powered waterhole attacks target websites and online services. With usage of AI (Artificial Intelligence), cybercriminals can even more effectively compromise these sites and deliver tailored malware to visitors’ devices. As AI can be used these attacks to analyze user behavior over time and predict when and where they are most likely to access the network. This would help a cybercriminal to optimize the timing and positioning of their malicious 'watering holes'.

Winning the Cyber War and how to avoid the cyber quicksand

As you probably know I always advocate for the “Zero Tolerance” approach when it comes to IoT. With the focus on prevention. However that is not always possible, due to limited hardware resources. Think of sensors that don’t have an option install a top notch security solution. Sensors typically focus on detecting specific events or conditions, such as motion or environmental changes. They lack the capability to analyze threats, respond to security breaches, or adapt to evolving cyber threats. For effective security, especially in the increasingly connected world of EVs, a comprehensive detection system is needed that can monitor data flows, identify anomalies and recognize potential vulnerabilities. Detection systems leverage advanced algorithms and ML to assess sensor data in real time, enabling proactive responses to unauthorized access or cyberattacks. Offering and ensuring a robust security framework that goes beyond simple monitoring. And then is recommended to have state of the art detection, like advanced threat detection. Deploy advanced threat detection systems that use ML to identify anomalous behaviour indicative of these sophisticated attacks. Another recommendation would be regular security audits and risk assessments. Furthermore behavioral monitoring is key to detect unusual patterns that may indicate an ongoing adaptive, polymorphic or AI-powered attack. So adaptation for the “Zero Tolerance” approach is needed to sure safe and safety are guaranteed, as well as business continuity.

Are you a member of CheckMates?