# Comprehensive Study of IoT Vulnerabilities and Countermeasures
## 3 IoT Vulnerability Layers
### Network Vulnerabilities
#### 3.3.1 WiFi and Ethernet Based Networks  
WiFi- and Ethernet-based networks form the cornerstone of connectivity within the IoT ecosystem, linking devices through cloud platforms or localized home networks. This architecture empowers users to engage with IoT devices from virtually any location--imagine adjusting a smart thermostat from another continent. Such flexibility drives the seamless exchange of data across vast distances, yet it simultaneously exposes a critical vulnerability as follows: the broader the network's reach, the greater the opportunity for adversaries to intercept or disrupt communications. Among the most accessible threats are Denial of Service (DoS), Distributed Denial of Service (DDoS), and Energy-Oriented Distributed Denial of Service (E-DDoS) attacks, each exploiting the openness of these networks in distinct ways [87]. A typical DDoS attack, as illustrated in Figure 8, hinges on the attacker pinpointing the target device's IP address within the network. From there, they bombard it with an overwhelming volume of traffic--think a barrage of meaningless packets--aimed at saturating its bandwidth. The result is predictable; the network slows, resources divert, and eventually the system collapses, forcing the device offline [88]. Beyond this blunt disruption, E-DDoS attacks pursue a subtler goal as follows: exhausting the device's power reserves. Rather than outright crashing the network, these overload the hardware--potentially frying a PCB component or inflating energy costs--representing an insidious twist of the DoS paradigm [87]. Their commonality stems from their scattershot nature, often targeting entire device clusters rather than individual units. Mitigating DoS and DDoS attacks requires network traffic filtering and rate limiting to detect and block malicious traffic patterns before they overwhelm a system. Deploying firewalls and intrusion detection systems (IDS) can help identify anomalous spikes in traffic, while blackholing and rate-limiting strategies can drop excess requests from untrusted sources. To counteract E-DDoS, IoT devices should incorporate power-aware intrusion detection, allowing them to recognize and mitigate excessive resource consumption attempts. Additionally, network segmentation can isolate critical devices from direct exposure, ensuring that a single attack does not cripple an entire IoT ecosystem. Figure 8: DDoS attack. This image has been completely re-modified; however, the idea of the image was inspired by [88]. As depicted in Figure 9, DoS-style attacks split into three categories, each exploiting a different network facet. Volume-based attacks flood protocols like TCP, ICMP, or UDP with raw data, clogging bandwidth and overwhelming internal queues. Protocol-based attacks--think SYN floods, Ping of Death, or Smurf attacks--target resource allocation. A SYN flood ties up connections by leaving them half-open, a Ping of Death delivers oversized packets to destabilize servers, and a Smurf attack amplifies traffic by echoing requests across all network nodes [87]. Then there are application-layer attacks, such as Slowloris, HTTP floods, or SMTP exploits. Slowloris sustains partial HTTP requests to monopolize server connections, HTTP floods swamp applications with legitimate-looking queries, and SMTP attacks probe mail servers for data leaks [87]. Each leverages the network's own mechanisms against it, turning openness into a liability. These DoS variants, while pervasive, barely scratch the surface of network threats. Traffic monitoring attacks, like WiFi fingerprinting, offer a quieter menace. By analyzing a building's camera system bit-rate over WiFi, an attacker could infer internal movements--like tracking occupancy--without direct access [89]. These are not granular data, but they are enough to guess device roles or activities. More aggressive are packet analysis attacks, where tools like Wireshark or air sniffers capture TCP/IP traffic.