Exploring IoT security vulnerabilities in LPWANS : the IPVC BIRA bicycle use case

• Autor(a) principal: Torres, Nuno Miguel Gramoso Rodrigues
• Data de Publicação: 2022
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/20.500.11960/2738
• topic: LPWAN; IoT; Cybersecurity; Hacking; LoRaWAN; Smart campus; Smart mobility; Cibersegurança; Campus inteligente; Mobilidade inteligente

Due to its pervasive nature, the Internet of Things (IoT) is demanding for Low Power Wide Area Networks (LPWAN) since wirelessly connected devices need battery-efficient and long-range communications. By using LPWAN technologies, the IoT devices are less dependent on common infrastructures, can operate using small batteries (up to 10 years), and can be easily deployed within wide areas (above 2 km). On the other hand, LPWANbased IoT applications need to be secure since its data could contain confidential users’ information. This work provides a systematic overview regarding the security vulnerabilities that exist in LPWANs, followed by a literature review with the main goals of substantiating an attack vector analysis specifically designed for the IoT ecosystem. With the knowledge from the systematic overview, a secure LoRa-based tracking system for the BIRA bicycle was proposed. The system consists of BIRA bicycles equipped with low-cost Global Positioning (GPS) trackers. Lastly, an experimental setup was developed with a focus on hacking the Radio Frequency (RF) physical layer with Software Defined Radio (SDR) techniques, performing GPS Spoofing, Replay Attacks, Denial-of-Service (DoS) and Jamming, in an environment that relies on LoRaWAN networks. Results have shown that LPWANs contains security vulnerabilities that can lead to irreversible harm. Also, the conception and implementation of up-to-date defenses are relevant to protect systems, networks, and data. It was possible to verify that depending on the type of activation method used between the devices and the LoRaWAN server, the communications and the devices can be compromised.