IoT Malware

Internet of Things (IoT) Malware: Theoretical Foundations and Types

Overview

The Internet of Things (IoT) refers to the network of interconnected devices capable of collecting, exchanging, and analyzing data. Coined by Kevin Ashton in 1999, the concept has grown significantly over the years. By 2008, the number of connected devices surpassed the world population, reaching over 8 billion. IoT devices are employed in various sectors, including smart homes, healthcare, transportation, agriculture, and more. However, the convenience offered by these devices often overshadows their security risks.

Types of Connected Devices in IoT

Applications

1. Smart Homes and Cities: Enhance life quality through energy efficiency and convenience but pose security risks due to processing sensitive data.
2. Wearables for Health Monitoring: Collect personal health data, necessitating stringent protection measures.
3. Transport and Logistics: Use RFID toll sensors and tracking for supply chain efficiency.
4. Automotive Industry: Sensors and autonomous driving technologies introduce new data security and privacy challenges.
5. Medical and Healthcare: Require robust security to protect sensitive patient data.
6. Aviation and Telecommunications: Demand reliable and secure IoT solutions to prevent catastrophic failures.
7. Agriculture and Livestock Management: Benefit from IoT for efficiency but need protection against environmental factors and cyber threats.

Wireless Protocols

1. Cellular (GSM, GPRS, 3G, 4G, LTE, 5G): Ideal for applications requiring mobility and remote connectivity.
2. Wi-Fi (IEEE 802.11): Suitable for building-based IoT applications, like smart home devices.
3. Zigbee: A low-energy protocol, perfect for energy-efficient applications like smart home sensors.
4. Z-Wave: Similar to Zigbee but operates on slightly different frequencies, commonly used in home automation.
5. Bluetooth (including Low Energy): Best for short-range, low-energy applications like wearables and health monitors.
6. 6LoWPAN: Facilitates IPv6 packet transmission over low-energy wireless networks, useful for devices with limited computing resources.

Communication Protocols

1. MQTT (Message Queuing Telemetry Transport): Lightweight, efficient for devices with limited resources or low-bandwidth networks.
2. XMPP (Extensible Messaging and Presence Protocol): Initially developed for instant messaging, adaptable for various IoT applications.
3. DDS (Data Distribution Service for Real-Time Systems): Focused on real-time data exchange, used in critical systems like aviation or healthcare.
4. AMQP (Advanced Message Queuing Protocol): Ensures reliable, secure messaging, suitable for enterprise-level and complex IoT systems.

Security Concerns in IoT

Priorities

1. Availability: Crucial for time-sensitive functions in medical or industrial applications.
2. Integrity: Vital to avoid malfunctions and misinterpretations in critical decision-making scenarios.
3. Confidentiality: Important but often considered less critical than availability and integrity.

Challenges

1. Vulnerability Management: Many IoT devices lack the capability for regular updates, leaving known security gaps unpatched.
2. Limited Resources: Small form factors and low power consumption restrict computing capabilities, complicating the implementation of complex security measures like advanced encryption.
3. User Interface Limitations: Lack of comprehensive user interfaces leads to a lower awareness of security settings and risks.
4. Protocol Limitations: Some IoT protocols do not inherently support encryption or authentication, making devices vulnerable to attacks like Man-in-the-Middle.

IoT Malware: In-Depth Analysis and Types

Evolution and Threat Landscape

Over time, malware has evolved significantly in complexity and destructive potential, posing a threat to a wide range of devices. This section delves into various malware types defined by their functions and behaviors, including worms, Trojans, viruses, spyware, ransomware, rootkits, and backdoors. Notably, IoT malware often combines elements from different malware categories. However, it's important to note that malware categorization is not always clear-cut. A common characteristic of this malware is its reliance on botnets for distribution, command execution, control, and monitoring of infected systems.

Classification of IoT Malware

Worms

Self-propagating malware that spreads autonomously within IoT devices. Examples include Mirai, Darlloz, Brickerbot, and Gitpaste-12. Notably, Hajime, a WhiteHat malware, can counteract other malware, offering a unique perspective on IoT malware functionality.

Trojans

Trojans disguise themselves as harmless but contain hidden malicious functions. Unlike viruses, they cannot replicate themselves. An example is ProxyM, known for DDoS attacks and email spamming.

Viruses

Viruses attack IoT devices by self-replicating. The Silex virus, for instance, causes permanent DoS attacks, demonstrating the severe impact of IoT viruses.

Spyware

Spyware in IoT allows for the covert surveillance of data through infected devices. SpyCon is an instance of spyware that monitors user activities through smart home devices and mobile phones.

Ransomware

This malware type takes devices hostage and demands a ransom for their release.

Backdoor

Backdoors in IoT devices are hidden access mechanisms, often introduced by manufacturers, posing significant security risks. Examples include Tsunami and Bashlite.

IoT Malware Spread Mechanisms

Command-and-Control (C&C)

A centralized structure that commands bots via communication protocols like Internet Relay Chat or Hypertext Transfer Protocol. Its simplicity makes it common, but its central server is also a vulnerability. Examples include Mirai, Aidra, and Okane.

Peer-to-Peer (P2P)

A decentralized architecture where each bot acts as both server and client, making network disruption challenging. An example of P2P-based IoT malware is the Hajime worm.

Characteristics and Functionality of IoT Malware

Malware targets unauthorized access or compromise of IoT devices. Common methods include malvertising, phishing emails, infected USB drives, and fake software installations.

Attack Methods

• DDoS Attacks: Overload resources to make them inaccessible. Examples: Mirai, Kaiji.
• Coin Mining: Malware like Fritzfrog and Satori use compromised IoT devices for cryptocurrency mining.
• Spamming: ProxyM uses infected devices for spamming.
• Data Exfiltration: Malware like Mozi executes unauthorized data transfers.
• PDoS Attacks: Permanently damage hardware, e.g., Brickerbot.
• DNS Spoofing: Change DNS entries to redirect traffic to harmful sites.
• Command Injection: Exploit vulnerable web interfaces or applications to execute commands on IoT devices.
• Payload Execution: Malware remains dormant until activated.
• Ransomware: Encrypts device files and demands ransom.
• Industrial Espionage: Targets industrial operations, often focusing on SCADA systems.
• Website Hacking: Unauthorized access to websites for data theft or malware placement.
• Click Fraud: Manipulates online marketing by generating fake clicks.
• Other Attack Types: Includes less common types like White-Hat attacks and unauthorized data downloading or removal.

Attack Vectors

IoT malware targets various vulnerabilities, including network, human, and software surfaces. In IoT, distinctions are made between network and device level, service level, firmware level, and device level.

• Network and Network Devices: Vulnerabilities in IoT networks and firewalls.
• Services: Vulnerabilities in Software as a Service and Server as a Service offerings.
• Firmware: Central to device communication and often a target of PDoS attacks.
• Devices: Specific device components can be targeted, including ports, storage media, RAM, and hardware.

Device Access Mechanisms

IoT devices can be accessed via intranet or internet, offering various mechanisms for malware to exploit.

• Brute-Force Attacks: Continuous input of login credentials to gain access.
• CVE Exploits: Utilization of public security vulnerabilities.
• Targeted Access Mechanisms: Specific targeting of devices based on geography, industry, etc.

IoT Malware Characteristics

• Virtual Environment Detection: Determines if running in a virtual environment to avoid detection.
• Surviving Reboots: Copies itself to startup directories.
• Stealth: Hides presence to avoid detection.
• Transforming Device Functions: Converts devices into networks, honeypots, or proxy servers.
• Reboot Prevention: Avoids device restart to prevent malware removal.
• Port Closure: Closes unused ports to reduce vulnerabilities.
• Creating New Variants: Developers release source codes for creating new variants.
• Service Provision: Some malware offers DDoS-for-hire or ransomware services.
• Packet Size: Malicious network traffic can exhibit unusual packet sizes.
• Architecture Detection: Sends payloads matching the device's architecture.
• Periodic Command Execution: Similar to CRON jobs, executes specific commands at intervals.
• Binary File Removal: Removes binary files to remain in RAM and avoid detection.
• Name Theft and Assignment: Steals or assigns random names to processes for concealment.
• UPX Header Manipulation: Uses fake UPX headers to hinder analysis.

Prominent Examples of Successful IoT Malware

• Mirai: Self-replicating worm that exploits vulnerabilities like CVE-2020-7209.
• IoTReaper: Botnet focusing on exploiting firmware vulnerabilities in devices like cameras and routers.
• Hajime: Mirai variant exploiting vulnerabilities like CVE-2018-14847 for unauthorized file access.
• Echobot: Mirai variant using a wide range of exploits for infecting various devices.
• Darlloz/Zollard: Exploits specific PHP vulnerabilities and targets other IoT malware.
• Gitpaste-12: Targets GitHub and Pastebin, named after 12 known vulnerability exploits.