## 3 Critical Analysis of Selected Literature
### Human Error: Accidental Network Misconfiguration Vulnerability  
Human errors can result in the incorrect configuration of network firewall rules, as shown in Figure 3, allowing the exploitation of specific ports/TCP/UDP communication into the air-gapped network from an untrusted or less trustworthy network. As observed by [PERSON] et al. [27], common misconfigurations often include firewall settings that allow malware to bypass security measures and exploit vulnerabilities that have existed for years in the devices, such as D-Link router vulnerabilities. Families of malware such as Hydra, Amnesia, NyaDrop and Mirai [28] can be used to get access to the router using built-in default passwords or D-Link authentication bypass exploitation. Another misconfiguration that can grant access to a network for an intruder is leaving default settings enabled on IP cameras and DVR/NVR, including not disabling unnecessary features, ports, services, pages, accounts, or privileges, using default accounts and their passwords, and revealing error handling messages to unauthorised users. With the development of the network virtualization concept, a new type of attack has emerged. Kubernetes, a well-known container orchestrator, can play various roles in the IoT system, ranging from web servers to analytical centers. Older versions of Kubernetes have a flaw that allows the bypassing of authentication for both Kubelet and API access. To find a way to access the Kubernetes and configuration files, the attacker can use Shodan search for open ports Kubelet (10250) and its API server (6443), or can try to access the API server using path host:port/apis/apiextensions.k8s.io, which lists the API endpoints, as shown in Figure 4.  
Figure 4: Results of search for open API server ports with possible unauthenticated access. Figure 3: Exploitation diagram for network misconfiguration in a logically air-gapped network. The impact-associated network configuration vulnerabilities could potentially grant an external attacker access to the more secure internal network entity, which is the main target of the attack. **Use case:** The misconfiguration of the camera exposed the video stream that was supposed to be hidden from public view to internet users at a U.S. airport. According to the law, all cameras at U.S. airports must be part of an air-gapped network; however, in the case of Yellowstone Regional Airport, one of their cameras had guest access enabled and was discoverable by the general public through Google (Figure 5). **Security measures:** To mitigate misconfiguration vulnerabilities in air-gapped networks, network administrators should follow a set of best practices for securing these environments, as outlined in [26]. While many of the security measures detailed in [26] involve cryptographic techniques such as encryption protocols, message authentication digests, and certificates, some of the test cases presented in this report can be employed to identify network or device misconfigurations. Tests T1 and T2 from [26] can be particularly helpful in detecting suspicious activity related to man-in-the-middle and eavesdropping attacks. These tests examine TLS connections, TCP/UDP ports, and data intercepted during interception attempts. [PERSON] et al. [27], [PERSON]. [29] and [PERSON] et al. [30] also emphasized the importance of security measures, especially during initial system setup. The authors in [28] developed a dynamic sandbox for the analysis of IoT malware that exploits the misconfigured settings; the sandbox can capture network and system call traces, as well as configuration file changes. Additionally, [PERSON]. [31] presents a telnet honeypot architecture designed to capture IoT malware, with a specific focus on Telnet access to IoT devices and network nodes. [PERSON]. [29] discovered several severe vulnerabilities during IP camera testing, including an open telnet port, default credentials, and logical errors in start scripts that prevented firmware updates without manual modification.