Cleaning Up the Internet of Evil Things Presented By Robert Rewcastle

Format of the Talk Background on Mirai malware ISPs role in combating Mirai Case study with real ISP My criticisms of the research

The Internet of Insecure Things More and more IoT devices Users are leaving them in a default state This makes them vulnerable…

Mirai Malware The malware does IP scanning to find IoT devices Types of devices include, routers, DVRs, printers, IP cameras, and NAT The malware logs in using a list of known default credentials Infected devices become part of the botnet Username Password root realtek xmhdipc service supervisor support tech ubnt user

Dealing With Mirai Anti-virus is unavailable to IoT devices IoT devices don’t get many software updates Its possible to take down command and control server ISPs inform customers of the infection so they can remove them

Detecting Mirai Malware Honeypot servers can emulate IoT devices and log IP address of devices attacking the honeypot Darknet routers advertising unallocated IP addresses logs who is sending traffic to those IPs

Informing Customers ISPs may be reluctant to inform customers because of the cost of customer support ISPs can email to inform customers Easy to implement Customer might not see the email ISPs can use walled garden Complicated to set up Cannot be used for business customers that require there internet to always be on

Research Methodology

Results Email notification showed no improvement over control Wall garden had the highest clean-up rate The improved wall garden was better than observational study Control group still had a high clean-up rate Business network had the lowest clean- up rate as well as longer median infection time

User Experiences and Actions Some users reported never seeing an email notification Some users tried anti-virus software on their computers Some users were happy the ISP provided this service Some users were upset about the walled garden

Lab Experiment Researchers tried 7 vulnerable devices in a lab setting They found resetting the devices was enough to remove the infection However the devices were quickly reinfected which did not match the results with customers

Research Conclusions Walled gardens play an effective roll in the fight against Mirai Customers were able in removing infections due to the malware being non persistent after reset. The researchers are concerned this may change in the future as hackers make more advanced malware The researchers cannot explain the low reinfection rate found in the real world compared to their lab tests showing reinfection rates on the timescale of hours

Criticisms The researchers didn’t ask why these devices are exposed to the internet? Why isn’t NAT protecting users? The researchers did not question whether users used anti-virus because they were told to in the walled garden notification

Thanks Any Questions