Source Code Vulnerabilities in IoT Software Systems

Alnaeli, Saleh M.; Sarnowski, Melissa; Aman, Sayedul; Abdelgawad, Ahmed; Yelamarthi, Kumar

doi:10.25046/aj0203188

Cited by 14 publications

(9 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Few researchers have suggested medium and long-range low-power wireless technologies like long range (LoRa) communication, Zigbee, BLE, and WIFI [11][12][13] On the other In V2X, vehicles share their instantaneous information such as their speed, coordinates, and acceleration to other vehicles and necessary infrastructure [7]. A few of the major challenges of V2X communication include time criticality, latency intolerance, security, and privacy [8][9][10]. Building a reliable architecture and choosing the right communication technology is vital for addressing these challenges.…”

Section: Introductionmentioning

confidence: 99%

LoRa Architecture for V2X Communication: An Experimental Evaluation with Vehicles on the Move

Haque

Abdelgawad

Yanambaka

et al. 2020

Sensors

Self Cite

View full text Add to dashboard Cite

The industrial development of the last few decades has prompted an increase in the number of vehicles by multiple folds. With the increased number of vehicles on the road, safety has become one of the primary concerns. Inter vehicular communication, specially Vehicle to Everything (V2X) communication can address these pressing issues including autonomous traffic systems and autonomous driving. The reliability and effectiveness of V2X communication greatly depends on communication architecture and the associated wireless technology. Addressing this challenge, a device-to-device (D2D)-based reliable, robust, and energy-efficient V2X communication architecture is proposed with LoRa wireless technology. The proposed system takes a D2D communication approach to reduce the latency by offering direct vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication, rather than routing the data via the LoRa WAN server. Additionally, the proposed architecture offers modularity and compact design, making it ideal for legacy systems without requiring any additional hardware. Testing and analysis suggest the proposed system can communicate reliably with roadside infrastructures and other vehicles at speeds ranging from 15–50 km per hour (kmph). The data packet consists of 12 bytes of metadata and 28 bytes of payload. At 15 kmph, a vehicle sends one data packet every 25.9 m, and at 50 kmph, it sends the same data packet every 53.34 m with reliable transitions.

show abstract

Section: Introductionmentioning

confidence: 99%

LoRa Architecture for V2X Communication: An Experimental Evaluation with Vehicles on the Move

Haque

Abdelgawad

Yanambaka

et al. 2020

Sensors

Self Cite

View full text Add to dashboard Cite

show abstract

“…Alnaeli et al [ 43 ] extended their previous work [ 42 ] to empirically examine the vulnerabilities of eighteen open-source IoT software systems, all of which were specifically written in C/C++ for IoT architectures. They found that usage of unsafe functions was still common among the selected systems, and developers were not working to improve the problems that were still present in the selected systems.…”

Section: Related Workmentioning

confidence: 99%

“…Both Alnaeli et al [ 42 , 43 ] and McBride et al [ 44 ] presented different results for the total number of unsafe functions, since different static analysis tools were used. Both of the studies used the term unsafe function to describe vulnerable commands and statements in terms of functions written by C/C++ programming language.…”

Section: Related Workmentioning

confidence: 99%

“…Both of the studies used the term unsafe function to describe vulnerable commands and statements in terms of functions written by C/C++ programming language. Nevertheless, Contiki contains some files written using the Python programming language, and these files suffer from security errors; both Alnaeli et al [ 42 , 43 ] and McBride et al [ 44 ] ignored these errors.…”

Section: Related Workmentioning

confidence: 99%

“…The number of unsafe functions increased over the five-year period from 2012 to 2016 for the studied systems, reaching 1859 unsafe functions for Contiki OS, 772 unsafe functions for TinyOS, and 220 unsafe functions for OpenWSN. Alnaeli et al [43] extended their previous work [42] to empirically examine the vulnerabilities of eighteen open-source IoT software systems, all of which were specifically written in C/C++ for IoT architectures. They found that usage of unsafe functions was still common among the selected systems, and developers were not working to improve the problems that were still present in the selected systems.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

The Presence, Trends, and Causes of Security Vulnerabilities in Operating Systems of IoT’s Low-End Devices

Al-Boghdady

Wassif

El-Ramly

2021

Sensors

View full text Add to dashboard Cite

Internet of Things Operating Systems (IoT OSs) run, manage and control IoT devices. Therefore, it is important to secure the source code for IoT OSs, especially if they are deployed on devices used for human care and safety. In this paper, we report the results of our investigations of the security status and the presence of security vulnerabilities in the source code of the most popular open source IoT OSs. Through this research, three Static Analysis Tools (Cppcheck, Flawfinder and RATS) were used to examine the code of sixteen different releases of four different C/C++ IoT OSs, with 48 examinations, regarding the presence of vulnerabilities from the Common Weakness Enumeration (CWE). The examination reveals that IoT OS code still suffers from errors that lead to security vulnerabilities and increase the opportunity of security breaches. The total number of errors in IoT OSs is increasing from version to the next, while error density, i.e., errors per 1K of physical Source Lines of Code (SLOC) is decreasing chronologically for all IoT Oss, with few exceptions. The most prevalent vulnerabilities in IoT OS source code were CWE-561, CWE-398 and CWE-563 according to Cppcheck, (CWE-119!/CWE-120), CWE-120 and CWE-126 according to Flawfinder, and CWE-119, CWE-120 and CWE-134 according to RATS. Additionally, the CodeScene tool was used to investigate the development of the evolutionary properties of IoT OSs and the relationship between them and the presence of IoT OS vulnerabilities. CodeScene reveals strong positive correlation between the total number of security errors within IoT OSs and SLOC, as well as strong negative correlation between the total number of security errors and Code Health. CodeScene also indicates strong positive correlation between security error density (errors per 1K SLOC) and the presence of hotspots (frequency of code changes and code complexity), as well as strong negative correlation between security error density and the Qualitative Team Experience, which is a measure of the experience of the IoT OS developers.

show abstract

Engagements2 as ‘HCI Material’: Propagating Community Agency, Through Embedded Technologies

Phillips

Gant²,

Jordan³

et al. 2022

Human-Computer Interaction. Theoretical Approaches and Design Methods

View full text Add to dashboard Cite

HCI has material attributes. As a sociotechnical assemblage, HCI mediates and/or translates technologies to public(s) and vice versa. It is malleable, 'made' and crafted and as a material media technology changes our relationships to 'things', each other and our surrounding world. Thinking through HCI as material allows us to unite disciplines with technologies, ensuring that how we conceptualise work is tangible and applicable. Working from this understanding of HCI, allows the authors to contextualise Engagements 2 as an emerging 'material' space uniting art, design and other practices often fractured through disciplinary conventions. Traditionally, public engagement encompasses ways organisations engage with external parties. HCI contemporaries, Public Interest Technologies (PITs) empower public stakeholders and municipalities. PITs unravel intractable problems, through design, data, and delivery, thus providing user agency and yields wider societal benefit(s).We question how digital technologies can transition 'public(s)', to sustainable approaches. In time, Engagements 2 will be commonplace as technologies (PITs, augmented reality, IoT sensing and more) are embedded into public environment(s) if engagement can be defined as a 'craft-able', material concern. The article unites contemporaries in the public realm, social design, and public engagement methods to identify the: pitfalls, benefits, and opportunities. There is a need for creating a 'best practice' roadmap to creative, active engagement. These values go well beyond designing for inclusion and seek for more sustainable and integral interactions, impacts and culture creation.

show abstract

Source Code Vulnerabilities in IoT Software Systems

Abstract: An empirical study that examines the usage of known vulnerable statements in software systems developed in C/

Cited by 14 publications

References 8 publications

LoRa Architecture for V2X Communication: An Experimental Evaluation with Vehicles on the Move

LoRa Architecture for V2X Communication: An Experimental Evaluation with Vehicles on the Move

The Presence, Trends, and Causes of Security Vulnerabilities in Operating Systems of IoT’s Low-End Devices

Engagements2 as ‘HCI Material’: Propagating Community Agency, Through Embedded Technologies

Contact Info

Product

Resources

About