# Comprehensive Study of IoT Vulnerabilities and Countermeasures
## 3 IoT Vulnerability Layers
### Hardware Vulnerabilities
#### 3.1.2 Hardware Reverse Engineering and Micro-Probing  
Reverse engineering seeks to unravel the mechanisms driving a device's operation [70]. When applied to hardware, this process equips the investigator with comprehensive insight into a device's architecture, exposing its strengths, vulnerabilities, and operational intricacies. Such attacks are categorized into three distinct types--invasive, semi-invasive, and non-invasive--as delineated in Figure 5[71]. Each approach varies in its methodology and impact on the target device, offering attackers a spectrum of strategies to extract critical information. Non-invasive attacks target data extraction without altering the physical packaging or structure of the integrated circuit (IC) or printed circuit board (PCB). These attacks may be executed passively--observing emissions or behavior--or actively, through deliberate manipulation [71]. Examples include brute-force assaults and fault injection, where the attacker deploys an array of tools to probe the device's resilience. Such tools range from off-the-shelf instruments to custom-built apparatuses. A notable instance is the voltage glitch attack, wherein a precisely timed voltage spike is delivered to a specific circuit segment--often during boot--to bypass security measures or extract data [72]. Here, RF emissions play a subtle yet critical role as follows: devices under stress may leak electromagnetic signals, revealing timing patterns or internal states when monitored with a spectrum analyzer or software-defined radio (SDR). These non-invasive techniques prioritize stealth, leaving the device intact while yielding substantial insights into its operation. To mitigate non-invasive attacks, countermeasures must focus on reducing data leakage and increasing system resilience against external probing. Implementing side-channel attack countermeasures--such as randomized execution timing, power analysis countermeasures, and shielding critical components--can help reduce the information attackers can glean from passive observations. Glitch detection circuits should be integrated to recognize abnormal voltage fluctuations and halt execution when suspicious behavior is detected. Additionally, employing hardware-based encryption with secure key storage ensures that even if attackers monitor electromagnetic emissions, the data remain indecipherable. In contrast, invasive and semi-invasive attacks necessitate direct access to the IC or PCB's internal components, often leaving tangible evidence of interference [71]. Invasive methods involve physical interaction with the hardware--soldering wires to contact points, probing electrical buses, or even mechanically dissecting chips to expose their secrets. Meanwhile, semi-invasive approaches leverage optical techniques, such as microscopy,  
Figure 5: Reverse engineering and inspection attacks. This image has been completely re-modified; however, the idea of the image was inspired by [71]. laser-based fault injection, or optical probing, to interact with the device at a microscopic level without fully dismantling it [71]. The toolkit for these attacks is extensive, encompassing JTagulators, logic analyzers, oscilloscopes, signal generators, power supplies, X-ray machines, and lasers, among others [71]. RF considerations emerge here as well; probing a chip's internal buses may induce unintended RF emissions, which an attacker can capture to map signal pathways or decode data flows, while such methods frequently damage the device--rendering it inoperable or visibly altered--they offer unparalleled access to its inner workings [73]. The trade-off is clear, the deeper the intrusion, the richer the data harvest, albeit at the cost of subtlety. To defend against invasive and semi-invasive attacks, manufacturers must implement hardware security techniques at the physical layer. Anti-tamper coatings, active mesh defenses, and sensor-based intrusion detection can detect and respond to physical interference.