## 3 Security and Privacy Attacks and Threats in EC-Based IoT
_Routing information attacks_ can appear in different types: (1) altering attack, in which the routing information will be modified by the attacker, for instance, through routing loops or false error messages; (2) blackhole attack [112, 113], in which a malicious node attracts all the traffic by advertising the shortest path to the destination, then the attacker processes the packets sent to the malicious node or just drops them; (3) gray hole attack [113] is a kind of blackhole attack in which selective packets will be dropped; (4) worm hole attack, in which the attacker records packets at one network location first, the afterward will tunnel them to another location [114]; (5) hello flood attack, in which the attacker sends \"HELLO PACKETS\" to all the other nodes using a high transmission power malicious node claiming that it is their neighbor [115, 116]; and (6) sybil attack, in which the attacker uses/adds nodes with fake identities called sybil nodes that are able to out-vote genuine nodes in the system [117]. 10. The attackers in _forgery attacks_ inject new fraudulent data packets and interfere with the receiver, which causes system damage or failure. These data packets can be inserted into communication links using methods such as inserting malicious data packets that seem legitimate, capturing then modifying data packets, and replicating previously exchanged packets between two EC nodes/devices [8, 32, 92, 109]. 11. The neighboring EC nodes communicate with each other to access or share data, but every node should only communicate with those nodes that need its data. In _unauthorized control access_, attackers can control the whole neighboring nodes if they gain access to one of the unsecured EC nodes [8, 92, 118]. 12. Two types of _integrity attacks against machine learning_ can happen in machine learning methods used in EC-based IoT [92]: (1) causative attack, in which attackers change the training process of machine learning models by manipulating or injecting misleading training data set; and (2) exploratory attack, in which attackers misuse vulnerabilities without changing the training process. 13. In _replay attacks or freshness attacks_, attackers capture and record data traffic for a particular period of time and then use these historical data to replace the current real-time data. This can cause energy and bandwidth consumption of EC nodes and other adverse effects [8, 33, 92, 109]. 14. _Insufficient/inessential logging attacks_ can damage EC-based IoT systems when log files are not encrypted. System and infrastructure developers must log events such as application errors and attempts of unsuccessful/successful authorization/authentication [32, 33, 92]. 15. _Security threats from/on IoT devices_ include mobile botnets, ransomware, and IoT malware [33, 92]. In 2017, over 1.5 million attacks were reported that originated from mobile malware [99]. Such threats can lead to data leakage/corruption or even application death [99, 105]. 16. _Nonstandard frameworks and inadequate testing_ and coding flaws are able to cause serious security and privacy attacks [33]. Nodes usually need to be connected to intermediate servers; therefore, compromise could be increased. EC-based system development is a complicated procedure that needs to combine heterogeneous devices/resources created by diverse manufacturers [119]. Moreover, there is no standard framework or policy for the implementation of EC-based systems. Therefore, some security and privacy flaws of these systems may stay undetected. 17. Functionalities of EC nodes may need to extract personal data from the information generated by user devices. Some of the sensitive information (such as personal activities, preferences, or health status) that must belong to data owners could be shared with other users or network entities without any permission from the data owners, which makes them vulnerable to intruders during data transmission/sharing, causing _privacy leakage_.