  Internet of Things (IoT) devices are becoming ubiquitous in our lives, with
applications spanning from the consumer domain to commercial and industrial
systems. The steep growth and vast adoption of IoT devices reinforce the
importance of sound and robust cybersecurity practices during the device
development life-cycles. IoT-related vulnerabilities, if successfully exploited
can affect, not only the device itself, but also the application field in which
the IoT device operates. Evidently, identifying and addressing every single
vulnerability is an arduous, if not impossible, task. Attack taxonomies can
assist in classifying attacks and their corresponding vulnerabilities. Security
countermeasures and best practices can then be leveraged to mitigate threats
and vulnerabilities before they emerge into catastrophic attacks and ensure
overall secure IoT operation. Therefore, in this paper, we provide an attack
taxonomy which takes into consideration the different layers of IoT stack,
i.e., device, infrastructure, communication, and service, and each layer's
designated characteristics which can be exploited by adversaries. Furthermore,
using nine real-world cybersecurity incidents, that had targeted IoT devices
deployed in the consumer, commercial, and industrial sectors, we describe the
IoT-related vulnerabilities, exploitation procedures, attacks, impacts, and
potential mitigation mechanisms and protection strategies. These (and many
other) incidents highlight the underlying security concerns of IoT systems and
demonstrate the potential attack impacts of such connected ecosystems, while
the proposed taxonomy provides a systematic procedure to categorize attacks
based on the affected layer and corresponding impact.
