ST1544: Evaluating And Mitigating Security Vulnerabilities In Arduino-Based Systems

Wan Maryam Nadzirah Murshid Universiti Teknikal Malaysia Melaka

In the burgeoning landscape of the Internet of Things (IoT), Arduino-based systems stand as a cornerstone for a multitude of applications ranging from prototyping to commercial product development. Their widespread adoption can be attributed to their ease of use, cost-effectiveness, and strong community support. However, this popularity belies an underlying vulnerability: a significant deficit in security features. Given the critical roles these systems play in managing essential technologies such as vehicles, industrial equipment, and home security systems, the potential for catastrophic outcomes due to security breaches cannot be overstated. This research delves into the prevalent oversight of secure coding practices within the Arduino ecosystem. Secure coding is the discipline of writing software codes that are fortified against the exploitation of security vulnerabilities and encompasses principles such as least privilege, robust error handling, and stringent input validation. Unfortunately, the simplicity and accessibility of Arduino often lead to a disregard for these security measures, leaving systems susceptible to attacks. Another focal point of this study is the absence of Intrusion Detection Systems (IDS) in Arduino-based environments. An IDS is instrumental in monitoring and alerting any malicious activities or policy infractions within a system or network. In the context of Arduino, this translates to vigilance over the data traffic to and from the system, a critical layer of defense against undetected incursions. Our research proposes a dual approach to fortify IoT security: the integration of specialized IDS and the advocacy of secure coding practices tailored for Arduino-based systems. The commercial implications of this research are substantial, aligning with the escalating demand for secure IoT devices across diverse sectors, including smart homes and industrial automation. Moreover, as regulatory bodies intensify their focus on cybersecurity, our