IoT Security · 2018 edition
OWASP Top 10 for Internet of Things security, covering firmware vulnerabilities, insecure interfaces, and device authentication risks.
Official OWASP list| Rank | Risk | Summary | Details |
|---|---|---|---|
| 01 | Insecure Web Interface | Device web interfaces with default credentials, XSS, SQL injection, or CSRF let attackers take control of the device. | Details |
| 02 | Insufficient Authentication/Authorization | Weak passwords, missing two-factor options, and poor access control across device, cloud, and mobile interfaces allow unauthorized access. | Details |
| 03 | Insecure Network Services | Unnecessary or vulnerable network services such as Telnet, UPnP, or open debug ports expose the device to remote attack and denial of service. | Details |
| 04 | Lack of Transport Encryption | Data, including credentials, is transmitted in cleartext between the device, its cloud service, and mobile apps. | Details |
| 05 | Privacy Concerns | Devices and their services collect more personal data than needed and fail to protect it. | Details |
| 06 | Insecure Cloud Interface | Cloud APIs and portals that manage devices lack strong authentication, encryption, or protection against account enumeration. | Details |
| 07 | Insecure Mobile Interface | Companion mobile apps with weak authentication, insecure storage, or unencrypted communication give attackers a path to the device. | Details |
| 08 | Insufficient Security Configurability | Users cannot change security settings such as password policies, encryption, or logging, leaving devices stuck with weak defaults. | Details |
| 09 | Insecure Software/Firmware | Devices cannot be updated, or updates are unsigned, unencrypted, or delivered insecurely. | Details |
| 10 | Poor Physical Security | Exposed debug ports, removable storage, and easy disassembly let attackers with physical access extract data or modify the device. | Details |
