# Security Vulnerabilities in LPWANs--An Attack Vector Analysis for the IoT Ecosystem
## 4 Attack Vectors in the IoT Ecosystem  
The Internet of Things ecosystem is presented as an integrative model in which plenty of the objects around us are expected to be networked and connected to the Internet to arrange new types of services and increase its efficiency [92; 93]. This type of device can improve the execution of our daily tasks, but the increasing connectivity and computational power of such devices result in a natural increase of related vulnerabilities (hardware, firmware, communications), which can be exploited and therefore increase the probability of being attacked. Additionally, some Internet of Things devices can be classified as security-critical and their malfunction can lead to irreversible harm to the physical system being controlled and to the users who depend on it [94]. The main activities stage of an IoT application includes data acquisition, data processing, data storage, and data transmission [11]. Generally, the IoT ecosystem includes a physical environment where the device is deployed to perform some specific function (i.e., operate as a sensor or actuator), which communicate through a LPWAN up to the cloud, where data is then pre-processed and aggregated for analytics on the business side of the network. However, there are several constraints and challenges associated with the design, development, and deployment of IoT applications, which include limited resources, interoperability, device heterogeneity, and security. Additionally, many companies tend to accelerate the development of their products, often leaving security behind [95]. This may cause several security issues in the IoT ecosystem, such as backdoors that are inadvertently created in the design and development stages. Therefore, due to the pervasiveness of IoT technologies, its designers and developers must reinforce security into applications and devices from scratch, rather than chasing the loss. Given this, it is crucial to have a specific and precise set of attack vectors to easily put forward a strategy to better respond to increasing threats that affect the overall IoT ecosystem. This approach will ensure that vulnerable points are identified in a general architecture and specific responses are used to prevent an attack or to mitigate its impact if it occurs. Thus, it is relevant to describe in detail all the attack vectors and provide, for each of them, a defense strategy. To systematize this environment, a set of attack vectors for LPWAN-based IoT applications is proposed in Figure 12, which includes three different communication networks, namely LPWAN, Backhaul Network, and Internet, of which, different types of malicious attacks can be put forward. In the attack vectors set, IoT devices are represented by a bicycle and a temperature sensor, that communicate using LPWAN technologies. These communications are carried out wirelessly to the LPWAN gateways,which are connected using a backhaul network with the LPWAN server. This architecture is common to those found in technologies like LoRaWAN [96; 97; 98; 99; 100; 101], Sigfox [102; 103; 104] and NB-IoT [50; 64; 105]. The gateways form the bridge between IoT devices and the LPWAN server through a backhaul network. In turn, the LPWAN server uses an internet connection (typically over HTTPS) to the Cloud/Analytics Services to process the data transmitted by the IoT devices. After processing, information is transmitted using an internet connection (typically over HTTPS) to client applications on the business side. As described in Figure 12, a malicious agent, typically, can explore six different attack vectors, which may represent, the physical environment, infrastructure elements (such as gateways), communication networks and protocols, and network servers. Table 4 compiles and maps the attacks identified in Section 3 to the attack vectors depicted in Figure 12, respectively, with focus on the physical environment, where IoT devices are deployed, and in the LPWAN and backhaul networks.