# Attacks on IoT: Side-Channel Power Acquisition Framework for Intrusion Detection
## 4 Attacks
### Reconnaissance
#### 4.1.1 Port Scanning  
A \"port scan\" is technique hackers and security teams use to identify weak points in network security. These weak points may be open ports which hackers can exploit to gain entry to a network or a system. A port scan identifies these open ports and gives the attacker valuable information on the system they are attacking, such as if the system or organisation is using a firewall or any IDS or, for example, if ports are allowed to send and receive packets. Any outdated network-facing software running on the target can also be exposed. Outdated softwares regularly have well-documented vulnerabilities and are easily exploited. The tool Nmap [49] was used to perform this attack on the testbed. Nmap is one of the most popular port-scanning tools and comes preinstalled on many security-focused Linux distributions, for example, Kali [50]. Nmap sends packets and analyses the responses to discover hosts and services on a network. Nmap features many options for probing networks for information; however, only the timing and performance settings were focused on during this work. The settings used are as follows:  
* Insane (T5) speed scan, for use on an extremely fast network. * Aggressive (T4) speed scans, for use on a reliable and relatively fast network. * Normal (T3), the default speed. * Polite (T2), slows down the scan to use less bandwidth and use less target machine resources. * Sneaky (T1), Intrusion-Detection-System evasion with greatly increased delays between actions. * Paranoid (T0), Intrusion-Detection-System evasion with even further increased delays between actions. Figure 3 compares the side-channel current signature across the timing settings of the Nmap tool. Similarities in the side-channel current signature between the upper settings of \"T\" can be seen on the two boards. More specifically, the upper settings of \"T3\", \"T4\", and \"T5\" share a common signature across the two boards. The current level is the only key difference in this signature between the two boards. This behaviour has a much higher amplitude for the Raspberry Pi, at around 0.6 A, versus 0.2 A for the Dragonboard. As \"T5\" and \"T4\" are listed as \"Aggressive\" and \"Insane\" in the Nmap documentation, one would expect these settings to exhibit a much larger current signature than their less aggressive counterparts. However, this is not the case, as viewed in Figure 3. These more aggressive settings have a remarkably similar signature to that of \"T3\"--the default setting. This is because both \"T5\" and \"T4\" assume the attacker is operating on a reliable and reasonably fast network. The Raspberry Pi and the DragonBoard could not handle such a bombardment due to their resource-constrained nature and, thus, the signature is closer to that of \"T3\", a less resource-hungry setting. If these devices were more powerful and the network more reliable, one could reasonably assume much more variation in the side-channel current signatures between \"T3\", \"T4\", and \"T5\". The latter half of Figure 3 investigates the \"Polite\" and IDS evasion settings, \"T2\", \"T1\", and \"T0\". One of the core ways the Nmap tool attempts to be \"Polite\" or avoid IDS detection is by changing delays within the tool's operation. These delays in operation spread the larger signatures witnessed in \"T5\"-\"T3\" over much more extended periods. Instead of attempting to scan all 1000 TCP ports on a system in approximately two seconds (the average time \"T3\"-\"T5\" take to complete), \"T2\" will take approximately ten minutes, \"T1\" over an hour and \"T0\" tens of hours. These values will increase or decrease based on the target system's resources and the complexity of the network being mapped. As seen in Figure 3, there is no clear, recognisable signature for settings \"T2\"-\"T0\", apart from a slight spike in current seen in setting \"T2\" for the DragonBoard.