# Security Vulnerabilities in LPWANs--An Attack Vector Analysis for the IoT Ecosystem
## 3 State-of-the-Art Review
### Attacks and Defense Strategies
#### 3.4.1 Physical-Related Attacks  
If an intended individual gets access to an IoT device or a gateway, without strong hardware security policies, the whole device or even the network may be assumed as compromised. The gateway in LoRaWAN is a single failure point for the network, and it could be manipulated to disconnect hundreds of end-devices [47]. Besides, physical access by malicious entities may compromise the security keys and other data [43]. The messages could be manipulated and sent as if they had been originated from the IoT device, every  
\begin{table}
\begin{tabular}{c p{284.5 pt}} \hline \hline
**Attack Type** & **Description** \\ \hline Physical & Attacks targeting hardware components such as device theft or malicious node injection. \\ Software & Attacks exploiting systems by using malicious software such as worms, viruses. \\ Encryption & Attacks intended to crack ciphered data. \\ Data Privacy & Attacks where sensitive and protected data are modified, copied without permission or erased. \\ Network & Unauthorized access or mapping of the network to impact availability or obtain sensitive information. \\ \hline \hline \end{tabular}
\end{table}
Table 3: Types of possible attacks. Adapted from [62].  
message passing through it could be intercepted or even the device could be destroyed. If security keys are stolen, the confidentiality and integrity of the message are compromised, because the attacker can intercept, decrypt or forge any messages sent within the LPWAN system [64]. Some types of attacks that can arise are:  
**-****Theft of devices**: The theft of physical objects helps the intruder to obtain physical access to the systems to perform several attacks that breach people's privacy and disrupt the system's availability and confidentiality [65].  
**-****Social Engineering:** This attack aims to manipulate individuals to divulge confidential and sensitive data [66] about the network or the devices.  
**-****Sleep Deprivation Attack:** This attack aims to increase the power consumption of the IoT device to decrease their lifetime by keeping the devices awake, resulting in more power consumption and forcing the IoT devices to shut down [67].  
**-****Malicious Node Injection:** A new malicious IoT device is physically inserted by the attacker between two or more devices to be used as a regular IoT device. It can be used to modify, capture, retrieve, process, and redirect incorrect information to other devices [68].  
**-****Environment:** Changing the air temperature (e.g., with a hairdryer). This could trigger an alarm because the values measured by the temperature sensor had dramatically been changed. Using a light cigarette next to a smoke sensor, that could trigger an alarm, c.f. Figure 6.  
**Defense Strategies**: End devices should be physically protected to prevent a malicious entity to perform a system reset. This is hard to achieve in different IoT deployment environments. Design changes such as non-volatile memory may preserve the counter value in between resets [69]. Hardware Security Module (HSM) should be implemented. It contains security keys and cryptography functions (e.g., encryption algorithms) and must be tamper-proof to guarantee that the keys are deleted when an attacker tries to extract them. If no HSM is used, the keys have to be preserved in unsafe storage conditions (e.g., simple non-volatile memory) and may be at risk of being extracted by malicious individuals [64].