Ingeniería en Sistemas, Electrónica e Industrial

URI permanente para esta comunidadhttp://repositorio.uta.edu.ec/handle/123456789/1

Examinar

Filtros

2023 - 20265

Ajustes

Fecha de inicio: 2020Tema: search.filters.subject.VULNERABILIDAD

Resultados de la búsqueda

Mostrando 1 - 5 de 5
  • Miniatura
    Item type:Ítem,
    Seguridad y vulnerabilidades de dispositivos IOT LORAWAN frente a interferencias y ataques de radiofrecuencia con FLIPPER ZERO
    (Universidad Técnica de Ambato. Facultad de Ingeniería en Sistemas Electrónica e Industrial. Carrera de Telecomunicaciones, 2026-01)
    Gómez Soxo, Odalys Valeria
    ;
    Robalino Peña, Edgar Freddy
    ;
    Universidad Técnica de Ambato. Facultad de Ingeniería en Sistemas Electrónica e Industrial. Carrera de Telecomunicaciones
    This thesis conducts a comprehensive analysis of security in an IoT environment using LoRa and LoRaWAN technology, applied to a real system consisting of IoT nodes, a LoRaWAN gateway, and a backend infrastructure developed with ChirpStack. The analysis seeks to detect vulnerabilities related to cryptographic management, access control, wireless communication, and interface exposure, taking into account the threats inherent in LPWAN networks and the guidelines established by OWASP IoT Top 10. The methodology used consists of four stages: designing and implementing a controlled test environment, which includes setting up a LoRaWAN server on a Linux virtual machine, integrating nodes, and configuring an operational gateway; conducting communication tests, validating RF parameters, and functionally analyzing the IoT system; employing methods to evaluate security using techniques such as sniffing, replay, interference, and passive analysis with Flipper Zero and SDR equipment; classifying the risk and devising measures to mitigate it based on telecommunications standards and engineering best practices. The findings show that there are serious vulnerabilities in unencrypted LoRa links, that LoRaWAN metadata is exposed, that there are fingerprinting risks, weaknesses in key management, and susceptibility to RF attacks such as replay and jamming. Based on these findings, a technical mitigation guide is developed with the aim of strengthening the confidentiality, integrity, and availability of the IoT system. To this end, suggestions are made regarding encryption, authentication, physical control, firmware hardening, and spectrum monitoring. This study helps to understand and strengthen security in Internet of Things solutions based on LPWAN technologies.
  • Miniatura
    Item type:Ítem,
    Honeynet para análisis, evaluación y tratamiento de riesgos cibernéticos en un sistema iot
    (Universidad Técnica de Ambato. Facultad de Ingeniería en Sistemas, Electrónica e Industrial. Carrera de Telecomunicaciones, 2024-08)
    Acosta Proaño, Yulisa Francisca
    ;
    Sánchez Zumba, Andrea Patricia
    The security of home IoT systems is critical for protecting sensitive data and ensuring the integrity, availability, and confidentiality of information and devices. Nessus was utilized to analyze the vulnerabilities of the most common smart devices on the market. Based on these findings, a Honeynet was designed to expose these vulnerabilities and illustrate potential attacks on home IoT devices. Penetration tests were conducted to assess the security of devices within the home IoT system, as well as tests through the Honeynet, which included WiFi network hacking and control of IoT devices from the LAN. The honeypots deployed in the project are ConPot and CitrixHoneypot, which logged exploits of vulnerabilities CVE-2013-2566 and CVE-2015-2808. Additionally, a custom honeypot in Python was created to capture TCP SYN Flooding DoS attacks on port 6668/TCP utilizing the IRC service. The results of these tests were crucial in developing a risk treatment plan, based on a baseline model for data security, privacy of individuals, and IoT devices in home environments. A GAP analysis was conducted to determine the current state of the system. The risk treatment plan proposes specific controls and policies to mitigate identified risks and enhance the security of the IoT system, ensuring continuous and robust protection for IoT devices in smart homes.
  • Miniatura
    Item type:Ítem,
    Aplicación del proceso threat hunting para la detección de vulnerabilidades y contramedidas en la infraestructura de red del Cuerpo de Bomberos de Ambato.
    (Universidad Técnica de Ambato. Facultad de Ingeniería en Sistemas, Electrónica e Industrial. Carrera de Tecnologías de la Información, 2023-09)
    Avilés Vasco, Bryan Jardiel
    ;
    Sánchez Zumba, Andrea Patricia
    The security of the network infrastructure of Ambato Fire Department takes on a vital role, as it houses sensitive and strategic data for the functioning of its operations. Given the constant increase in cyberattacks and the ongoing evolution of tactics employed by malicious actors, it is essential to have an effective strategy that enables the identification and mitigation of threats in real time. In this context, this work proposes the development of a comprehensive manual to implement the Threat Hunting process in the network of Ambato Fire Department. Utilizing a variety of specialized cybersecurity tools such as Wireshark, Nessus, and Advanced IP Scanner. Additionally, a manual analysis of log files was conducted, delving into the understanding of their handling and their relevance in the realm of cybersecurity. As a complement, a Python code was developed to enhance the analysis, with the purpose of identifying and addressing vulnerabilities that could jeopardize the solidity of the network infrastructure. This approach not only allowed for the detection of security weaknesses but also paved the way for the planning of various countermeasures aimed at strengthening the identified susceptible points in the network. Finally, the process was documented to ensure the traceability and replicability of the undertaken actions.
  • Miniatura
    Item type:Ítem,
    Evaluación de riesgos para un sistema de gestión de seguridad de la información en base a la Norma ISO/IEC 27001 aplicado a un proveedor de servicios de internet
    (Universidad Técnica de Ambato. Facultad de Ingeniería en Sistemas, Electrónica e Industrial. Carrera de Telecomunicaciones, 2023-09)
    Hidalgo Martinez, William David
    ;
    Sánchez Zumba, Andrea Patricia
    Cybercrime is a constant threat to individuals and organizations worldwide, as it utilizes exposed techniques to steal confidential information, damage systems, and cause significant financial and reputational harm. The importance of cybersecurity is evident in the wake of the COVID-19 pandemic, as cybercriminals seek new ways to exploit vulnerabilities in systems and networks. One of the primary concerns is protecting sensitive data of companies and users. In today's digital age, it is crucial to safeguard against cyber threats and attacks, secure information, and ensure the integrity of systems and critical infrastructure. In the case of an ISP, Risk Assessment is important due to the critical nature of the data they handle. Risks may include unauthorized access to user information, data loss, online fraud, and damage to the organization's reputation. This assessment is comprehensive, considering factors such as confidentiality, integrity, and availability of information, as well as risks associated with processes and technology used based on the ISO/IEC 27001 standard. Since an ISP manages large amounts of customer and user data, it provides a framework for the establishment, implementation, maintenance, and continuous improvement against threats, vulnerability assessment, and the likelihood of occurrence for each risk, along with mitigation measures. Through Open Source technology, information assets are identified, and the evaluation of threats and vulnerabilities to which they are exposed is conducted. Additionally, the potential impact of a threat on the company is determined. With this information, appropriate information security measures are implemented to mitigate the identified risks.
  • Miniatura
    Item type:Ítem,
    Riesgo de incendio en las instalaciones del grupo Mil”
    (Universidad Técnica de Ambato. Facultad de Ingeniería en Sistemas, Electrónica e Industrial. Carrera de Ingeniería Industrial en Procesos de Automatización, 2023-09)
    Rosero Casa, Jessica Daniela
    ;
    Morales Perrazo, Luis Alberto
    The risk of fire in organizations can present itself with intrinsic potentials that cause economic and mainly human losses, due to the lack of means, protocols and resources destined to the prevention or control of these risks. In this sense, the preparation of a contingency plan to reduce the risk of fire in the companies of Mil group was of vital importance. This study was carried out in the companies Milpolimeros, Milboots and Milplast. For the development of this research, the Diamante methodology was used to determine the level of vulnerability of these organizations. On the other hand, for the evaluation of the risk of fire, the Meseri method was used in the companies of the Mil group. The research was descriptive through field research on the facilities of the Mil group. The vulnerability with respect to the human factor of the three companies of the Mil group according to the diamond method is high in the event of a fire; while with the Meseri method, the fire risk assessment for the Mil group companies showed that there are unacceptable risks in the Milpolimeros logistics area with an index of 4.6, in the Milboots warehouse area with an index of 4.5 and in the Milplast warehouse area with an index of 4.4. Finally, it is concluded from the investigation that the companies of Mil group have a high probability of suffering fire outbreaks and causing material, economic and, above all, human losses.