The Internet of Things (IoT) has transformed various domains in our lives by enabling seamless communication and data exchange between interconnected devices, necessitating robust networking infrastructure. This paper presents a comprehensive analysis of code injection attacks in IoT, focusing on the wireless domain. Code injection attacks exploit security weaknesses in applications or software and can have severe consequences, such as data breaches, financial losses, and denial of service. This paper discusses vulnerabilities in IoT systems and examines how wireless frames in state-of-the-art wireless technologies, which serve IoT applications, are exposed to such attacks. To demonstrate the severity of these threats, we introduce a comprehensive framework illustrating code injection attacks in the wireless domain. Several code injection attacks are performed on Wireless Fidelity (Wi-Fi) devices operating on an embedded system commonly used in IoT applications. Our proof of concept reveals that the victims’ devices become further exposed to a full range of cyber-attacks following a successful severe code injection attack. We also demonstrate three scenarios where malicious codes had been detected inside the firmware of wireless devices used in IoT applications by performing reverse engineering techniques. Criticality analysis is conducted for the implemented and demonstrated attacks using Intrusion Modes and Criticality Analysis (IMECA). By understanding the vulnerabilities and potential consequences of code injection attacks on IoT networks and devices, researchers and practitioners can develop more secure IoT systems and better protect against these emerging threats.

Log poisoning is a cyber-attack where adversaries manipulate systems’ log files to conceal their activities or execute malicious codes. This paper presents a thorough examination of log poisoning attacks, with a focus on demonstrating methodologies applied to prevalent Internet of Things (IoT) platforms, such as the Raspberry Pi. We introduce a novel technique that circumvents the Linux-based devices system’s protective mechanisms which truncate malicious injected code in sensitive log files. Furthermore, a novel persistence technique that allows the attacker to maintain a persistent connection with the Linux-based target device was introduced. Moreover, we propose an evasive technique that enables adversaries to effectively conceal their log poisoning attacks by executing them through encrypted tunnels using a virtual private network (VPN). Through Intrusion Modes and Criticality Analysis (IMECA), we analyze the severity and potential impact of these attacks and propose mitigation strategies to avoid the occurrence of such attacks in order to maintain the confidentiality, integrity, and reliability of IoT ecosystems. As a further step to counteract the threat, we designed a Python script that detects and mitigates log poisoning attacks, specifically against malicious codes that are injected into logs without requiring the log file to be set as executable.

Traditional centralized crowdfunding platforms enable individuals and organizations to raise capital online but often struggle with trust, transparency, and accountability due to centralized control and opaque governance. These issues lead to user skepticism and reduced engagement. This paper introduces IHSAN, a decentralized crowdfunding platform leveraging blockchain technology to ensure decentralized control, immutable transactions, and transparent records. By integrating decentralized database technology dubbed "BigchainDB", IHSAN enhances scalability and data query efficiency while maintaining security. Eliminating centralized control empowers donors and beneficiaries with greater accountability and trust in fund allocation and project execution. Our results demonstrate that IHSAN reduces platform fees to as low as 1%, significantly lower than the approximately 8% and 2.9% charged by traditional platforms. It also achieves faster transaction times of around 2 minutes, compared to up to 14 days or 2–5 days for conventional platforms. Additionally, IHSAN overcomes geographic limitations by offering unrestricted global access, improving donor confidence and increasing project success rates.

The rapid spread of IoT devices has introduced a complex landscape of security threats, compromising device functionality and user privacy. Among these threats, log poisoning attacks have recently garnered attention among cybersecurity practitioners for their severity and effectiveness. Log poisoning involves the manipulation of automatically generated logs in IoT devices, significantly compromising the attacked device and making it susceptible to malicious code execution, which may lead to further destructive cyberattacks. This paper is the first to comprehensively address log poisoning attacks on IoT systems and devices. We introduce various methodologies to perform such attacks, focusing particularly on practical implementations involving misconfigured log files on Raspberry Pi 4, which is commonly used in IoT applications. We also introduced a technique that advanced adversaries can employ to cover their tracks effectively. Through Intrusion Modes and Criticality Analysis (IMECA), we analyze the severity and potential impact of these attacks and propose mitigation strategies to avoid the occurrence of such attacks. We emphasize the importance of adopting mitigation strategies to maintain the confidentiality, integrity, and reliability of IoT ecosystems. As a further step to counteract the threat, we design a novel technique to detect and mitigate log poisoning attacks.