2

I have my final year dissertation coming up and I'm thinking of doing a project where I evaluate attacks on an IoT network using Contiki/Cooja simulator. The project as it stands is too simple and has been done a few times. I'm thinking of adding nodes which move around the network, cooja supports mobility so that isn't an issue.

Is there attacks that will be affected by the mobility of the nodes? Should I expect different outcomes than if I performed the attacks on a stationary network? If so what kind of attacks would this be and how would the mobility affect the outcome?

Thanks

1
  • This might have been better asked on our information security sister site (good question, though. +1)
    – Mawg
    Commented Oct 7, 2019 at 7:52

2 Answers 2

2

For a "mobile" node in any security scenario you have to assume that at some point the attacker will have physical access to the device.

Once an attacker has physical access, all bets are off.

2
  • All? Maybe in some sense you're right, but I'd hope that it is still possible to design something which is tamperproof till at least next year... Commented Oct 8, 2019 at 8:54
  • It all depends on your threat model, (e.g. if you are up against a motivated nation state then even a hardware secure element won't stand up to a electron microscope inspection, but it might take a while)
    – hardillb
    Commented Oct 8, 2019 at 8:57
0

Another attack angle is routers. A mobile node will use different routers or access points to access internet and if one of them is compromised, your node is also compromised.

2
  • Isn't one of the fundamental security assumptions that the channel is public? Obviously it is nice to reduce the attack surface, but what happened to TLS? Commented Oct 8, 2019 at 10:46
  • Yeah, I guess you are right that this scenario is already considered, the attack surface is a good interpretation of the answer. Commented Oct 8, 2019 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.