# Security Vulnerabilities in LPWANs--An Attack Vector Analysis for the IoT Ecosystem
## 5 Discussion  
In the systematic review, it is possible to verify that all the defined keywords and the approach used to compile the results, cf. Figure 5, make this analysis more simple and intuitive. From the results obtained, it is possible to observe that the LPWAN protocols with most related-works are LoRaWAN and NB-IoT. The technology that ranked higher was LoRaWAN, due to its higher penetration in academia. However, this does not guarantee that these are the most used protocols in LPWAN, but rather, the protocols that have been more used in research and development, due to their higher maturity and openness to researchers in academia. The major limitation of our approach is the fact that only the IEEExplore database was used, which despite being the most suitable in terms of using elaborated queries to the research, ends up restricting this research. Furthermore, the application domains in which more results were also obtained, it was in the context of \"smart monitoring\" that resulted in 60% of the responses (among the contexts \"smart campus\", \"smart environment\", \"smart monitoring\"). This may reveal, for example, that the \"smart campus\" environment is still under the process of developing and implementation on new application contexts that make use of the type of LPWAN technologies. In our perspective, this may be because smart campus environments have a high number of users daily pending, and eventually, devices connected to the network, which may originate a wide spectrum of possible threats to this type of network. In this research, it was possible to identify the most relevant types of attacks, vulnerabilities, threats, and possible defenses regarding LPWAN technologies. Some of the attacks were identified individually, giving a detailed description of how they can be exploited and carried out. After identifying the main focal points of the identified attacks, the research was carried out to find possible solutions to protect, mitigate or even eliminate these security weaknesses. Moreover, it was crucial to relate the attacks and vulnerabilities analyzed in the State-of-the-Art review, with these types of technologies, creating a connection in this document. Most of the described attacks are present in LoRa technology. In total, five different types of attacks were identified, which exploit certain vulnerabilities found in this sort of technology. Furthermore, some responses that could be adopted have also been identified to mitigate these threats. One of the main solutions is to update the LoRaWAN protocol to its latest version 1.1, which already has some security improvements compared to its older versions. LoRaWAN v1.1, officially released in October 2017, has been a big upgrade to the specification of the protocol. Concerning the entire network architecture, LoRaWAN v1.1 presents mechanisms such as handover roaming [106] of the end devices such that the Network Server can act according to different roles specified, and a new security architecture which includes the Join Server which allows the end devices to connect to the network [73]. Since Sigfox devices are not IP-addressable, the likelihood of being attacked is reduced, since there is no OTAA mechanism, such as in the LoRaWAN protocol. In Sigfox communications, a user can decide whether to encrypt the message using the encryption solutions provided by its proprietary infrastructure, or by using their encryption methods if necessary [43]. After conducting the research regarding security vulnerabilities in LPWAN, a set of attack vectors for a generic IoT application was introduced, which presents common security flaws that may arise in a general application case. In this work, the focus was on the LPWAN and Backhaul communication zones, although the Bit-Flipping attack can be performed between the network server and the application server. With the elaboration of each attack vector, it is possible to obtain a vision of the critical zones where a possible attacker can initiate a malicious action.