# Security Vulnerabilities in LPWANs--An Attack Vector Analysis for the IoT Ecosystem
## 3 State-of-the-Art Review
### Attacks and Defense Strategies
#### 3.4.2 Bit-Flipping Attack  
Bit-Flipping is a common encryption attack, cf. Figure 7, which focuses on obtaining the cipher keys during communications. In LoRaWAN, different research studies have identified a security vulnerability that can lead to a bit flipping attack [70]. The goal of this attack is to demonstrate that the integrity between the network server and the application server is not protected. If the attacker captures traffic, the application server cannot detect if the message is from the attacker or the network server [71]. The network server in practice is usually fixed by a network operator, and because of the infrastructure, the network server is not able to eavesdrop on the application data. The application server in practice usually belongs to application owners. The application server and the  
Figure 6: Example of physical-related attack. network server work together in the process of join procedure and traffic control [72]. LoRaWAN messages are both encrypted and provided with a message integrity check. The cryptographic message integrity code on the payload data and header information is checked and terminated by the infrastructure provider, while the payload encryption using the AppSKey is undone by the application provider [69]. Uplink messages are encrypted and then signed. After the network server receives the messages, it uses the NwkSKey to control the signature. Encrypted messages are received on a network server and then processed on the application server. Between the network and the application server, the data may be transformed during manipulation because the integrity of the encrypted text is no longer controlled when the messages arrive at the application server [73]. This means that in between the infrastructure operator's network server and the IoT solution provider's application server, the data cannot be checked for integrity and authenticity [69]. If an attacker gains access to a network server, he can eavesdrop on the communication between the network and the application server, which can potentially result in a bit flipping attack [71]. Bit flipping attack can be performed in a simple method, but besides simple, it can cause tragic damage even though this attack is not specifically against the cipher itself [73]. In this security attack, it is possible to change specific fields without decryption of the ciphertext [74]. The bit flipping attack is workable in specific encryption modes where a plaintext has the same bit order with a ciphertext [75], cf. Figure 7. An attacker can modify specific fields, just by modulating bits in the same positions of the ciphertext [70]. With this, it is only necessary to change certain fields of the ciphertext, for later when deciphered, the plaintext will be manipulated, cf. Figure 7b). **Defense Strategies**: A malicious bit flipping of the sensor values in between the infrastructure operator and application provider is achievable due to the too-early termination of the message integrity code in the system architecture [69]. A secure transmission method between the network server and the application server should be selected and utilized. Since the protocol allows providers to choose the transmission method between two servers, there are numerous decisions, for example, Ethernet, WiFi, 3G. For this situation, since LoRaWAN did not provide any insurance strategy between the two servers, the security between the network server and the application server relies upon the transmission method  
Figure 7: Bit-Flipping attack example with manipulated sensor data. Adapted from [70]. selected by the provider. Consequently, the application owner should be comfortable with the security of the transmission method and be aware of potential threats [72]. The straight solution to avoid an attack featuring a malicious change of the payload content is to run the integrity check value at the application server and not at the network server. Theoretically, a modern protocol design should implement authenticated encryption instead of simple encryption [69].