Log Poisoning Attacks in Internet of Things (IoT)

Abstract

The rapid spread of IoT devices has introduced a complex landscape of security threats, compromising device functionality and user privacy. Among these threats, log poisoning attacks have recently garnered attention among cybersecurity practitioners for their severity and effectiveness. Log poisoning involves the manipulation of automatically generated logs in IoT devices, significantly compromising the attacked device and making it susceptible to malicious code execution, which may lead to further destructive cyberattacks. This paper is the first to comprehensively address log poisoning attacks on IoT systems and devices. We introduce various methodologies to perform such attacks, focusing particularly on practical implementations involving misconfigured log files on Raspberry Pi 4, which is commonly used in IoT applications. We also introduced a technique that advanced adversaries can employ to cover their tracks effectively. Through Intrusion Modes and Criticality Analysis (IMECA), we analyze the severity and potential impact of these attacks and propose mitigation strategies to avoid the occurrence of such attacks. We emphasize the importance of adopting mitigation strategies to maintain the confidentiality, integrity, and reliability of IoT ecosystems. As a further step to counteract the threat, we design a novel technique to detect and mitigate log poisoning attacks.