OWASP IoT Attack Surface Areas - Revision history

Jmanico: per daniel M request

2015-12-16T21:06:06Z

per daniel M request

2015-08-11T23:43:58Z

2015-08-07T20:49:15Z

2015-08-07T20:01:34Z

2015-08-07T19:53:36Z

2015-08-07T19:52:23Z

2015-08-07T19:44:38Z

2015-08-07T19:39:59Z

2015-08-07T19:36:26Z

2015-08-07T19:34:30Z

← Older revision		Revision as of 23:43, 11 August 2015
Line 7:		Line 7:

	==OWASP IoT Attack Surface Areas (DRAFT)==		==OWASP IoT Attack Surface Areas (DRAFT)==
		+
		+	'''NOTE''': This project is part of [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Main The OWASP IoT Project], which is located [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Main here].

	Oxford defines the Internet of Things as: “A proposed development of the Internet in which everyday objects have network connectivity, allowing them to send and receive data.”		Oxford defines the Internet of Things as: “A proposed development of the Internet in which everyday objects have network connectivity, allowing them to send and receive data.”

← Older revision		Revision as of 20:49, 7 August 2015
Line 85:		Line 85:

	= OWASP IoT Attack Surface Areas =		= OWASP IoT Attack Surface Areas =
−
−	~~<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg\|link=]]</div>~~
−

	The OWASP IoT Attack Surface Areas (DRAFT) are as follows:		The OWASP IoT Attack Surface Areas (DRAFT) are as follows:

← Older revision		Revision as of 20:01, 7 August 2015
Line 229:		Line 229:


−	~~{{:Projects/OWASP_IoT_Attack_Surface_Areas}}~~	+

@@ Line 198: / Line 198: @@
 * Deprovisioning
 * Pushing updates
 |-
 |}

@@ Line 163: / Line 163: @@
 * Account lockout
 * Known credentials
 |-
 |}

@@ Line 141: / Line 141: @@
 |-
 | '''Administrative Interface'''
+|
 * SQL injection

@@ Line 131: / Line 131: @@
 * Sensitive URL disclosure
 * Encryption keys
 |-
 |}

@@ Line 94: / Line 94: @@
 ! Attack Surface
 ! Vulnerability
 |-
 | '''Ecosystem Access Control'''
@@ Line 102: / Line 101: @@
 * Decommissioning system
 * Lost access procedures
 |-
 | '''Device Memory'''
@@ Line 111: / Line 108: @@
 * Third-party credentials
 * Encryption keys
 |-
 | '''Device Physical Interfaces'''
@@ Line 121: / Line 116: @@
 * Privilege escalation
 * Reset to insecure state
 |-
 | '''Device Web Interface'''
@@ Line 132: / Line 125: @@
 * Account lockout
 * Known credentials
 |-
 |}