# Malware Analysis in IoT & Android Systems with Defensive Mechanism
## 3 Type of Attacks on IoT and IIoT Devices
### Physical Attack and Countermeasures  
In this scenario, the attacker physically accesses the device and network, and harms them in a significant way. Different physical attacks may be carried out by tampering with physical devices, i.e., disconnection of the network cable, replacing evidence instruments, rotating surveillance cameras, MCI (Malicious code Injection), RF Interference/Jamming attacks, DDoS attacks, Fake Node Injection attacks, Sleep Denial attacks, SCA (Side-Channel Attack), and PDoS (Permanent DoS). In this attack, the system becomes a completely nonoperational state.  
In [2], the authors examined the security and vulnerability of both industrial and commercial IoT devices. Their experiment and analysis found that home automation systems or commercial IoT systems are more vulnerable to brute force attacks for login credentials. Smart meters have the possibility of ransomware attacks [1]. Devices used for virtual personal assistance, such as Google Home and Amazon Echo, are prone to voice masquerading and squatting attacks. An attacker can use similarly paraphrased names or pronounced names to hijack voice commands, and in this voice, masquerade an attack. The attacker uses skill to impersonate a legitimate voice in order to eavesdrop on user conversations and user data.  
**Countermeasures against Physical Attacks**: Security measures for this issue include the inbuilt variability of the integrated circuit with the physical unclonable function (PUF) for mutual authentication. Mutual authentication takes place via challenge-response mechanics, where the output depends on the device's microstructure. This makes PUF unclonable, tamper-proof from physical attacks, and eliminates malicious code injection. The work conducted by [15] focuses on providing a method of energy-efficient architecture with increased security capabilities. To solve the energy problem, i.e., sleep denial attack, they have proposed a CUTE-mote (Customizable and Trustable End device more) for heterogeneous architecture. The diverse architecture is developed by the hybridization of MCU (Micro Controller Unit), Contiki OS, and RCU (reconfigurable computing unit) with an IEEE-802.15.4 radio transceiver. Experiments have shown that by considering the thread metric benchmark and smart fusion of two SOC hardware platforms, the proposed system is capable of preventing cyber-physical attacks such as jamming attacks and provides a strong countermeasure against sleep denial attacks.  
To solve the issue of distributed systems, one solution is the PAuthKey (Pervasive Authentication Protocol). In the proposed protocol, the implicit certificate is obtained from the cluster head, and later, a secured link is maintained between sensor nodes, peer nodes, and the end-user. The authentication scheme depends on the respective arrangement of sensor nodes, and the scheme is liable to provide a guarantee of application-layer security. This is capable of impersonating attacks, masquerade attacks, and fake node injection attacks.  
Article [16] provides a lightweight encryption algorithm to counter side-channel attacks. The lightweight and software-based solutions have been chosen by the authors due to the power concern of IoT devices, faster communication, and dynamic capability of software algorithms. According to the authors, masking techniques also make it hard to analyze encryption and decryption keys and protect against side-channel attacks. Other security measures for this kind of attack are power analysis, timing analysis, and physical unclonable function.