The Internet of Things (IoT) is a pervasive phenomenon in our everyday life, binding and enabling communication between heterogeneous physical devices and the internet. The applications of this technology range from industrial control to medical devices, hence interconnecting a huge number of devices collecting sensitive information. Although this provides a highly dynamic network with extensive capabilities, its widespread adoption and sensitive nature of the collected data open a large number of challenges from a cybersecurity perspective. In this paper, we offer a fresh perspective on the IoT security landscape by providing a full list of reported vulnerabilites. By organizing protocols and vulnerabilities according to the TCP/IP stack, we guide both novice and expert users and developers in gaining a clear overview of the state-of-the-art IoT and its security issues. Furthermore, by discussing open problems and future directions, we think our paper will be helpful to the research community in designing the next generation of secure IoT.@en

Routing Protocol for Low-Power and Lossy Networks (RPL) is a standard routing protocol for the Low Power and Lossy Networks (LLNs). It is a part of the IPv6 over Low-Power Wireless Personal Area Network (6LoWPAN) protocol stack. Features such as energy-efficient mechanisms and availability of the secure modes of operations make RPL suitable for the constrained Internet of Things (IoT) devices. Hence, the majority of IoT applications rely on RPL for data communication. However, routing security in RPL-based IoT networks is a significant concern, motivating us to study and analyze routing attacks and suggested countermeasures against them. To this end, we provide a comprehensive survey on the state-of-the-art security threats and their corresponding countermeasures in RPL-based IoT networks. Based on our study, we propose a novel classification scheme that uses a mapping between RPL attacks and their countermeasure techniques to the RPL control messages used to develop these techniques. Furthermore, we provide an in-depth statistical analysis that includes analysis of routing attacks through the RPL control messages, distribution of various mitigation techniques as per the method used, RPL control messages involved in the mitigation techniques, and details of the tools used by multiple researchers. In the end, we highlight some open challenges and future research opportunities on this topic. We believe that this survey will be beneficial to researchers and practitioners working in the area of RPL security. @en