1. IoT devices as an attack vector
Igal Zeifman, Dima Bekerman,Ben Herzberg (Imperva)
Chuck McAuley(IXIA)
Mirai, Kami and other new malware
ALAS Research Group
December 2nd 2016

2. Motivation
Source:

3. Motivation: DDoS Attacks in Q3 2016
67 Countries targeted.
62.6% of the targets are in China
18.7% from the US
8.7% from South Korea
China accounts for 72.6% of the attacks.
Linux Botnets account for 78.8% of the attacks
Large Scale Attacks (Krebs/Akamai, OVH, Dyn)
Krebs, sept 20 – 620 GBPS
OVH, sept 22 – 799 GBPS
DYN, OCT TBPS ( Largest Attack ever)

4. Main Culprit: Mirai Botnet
Written in C/ Go
cross-compiles across 18 different architectures without problem
Two families of botnets:
Default Credentials
SOAP vulnerability
Signature detected in many attacks
DDoS on Krebs, OVH, Dyn (Strain 1)
DDoS against Liberia, Deutsche Telecom Routers (Strain 2)

5. Geographic Location

6. Propoagation and Attack Patterns
Propagation patterns
Wide Range IP Scans
Dictionary Attacks Against a list of default passwords
Usually executes its payload from /tmp
Attack patterns:
HTTP, GRE, SYN, ACK, STOMP, DNS, UDP Floods
Uses spoofed user-agents
Can circumvent classic security solutions
Can bypass DDoS protection tools
Simple (or Streaming) Text Oriented Message Protocol

7. Attack Patterns (Cont’d)
Don’t mess with list
IPs to avoid scanning.( DoD, USPS, GE, HP)
Kills extra services
Kills competing malware

8. Command and Control Control Server written in Go
Using Go optimizations for performance.
Listens on port 23 and Port 101
Port 23 : Control + Telnet Admin Console
Port 101:Management API

9. Command and Control: Initial Conx

10. Command and Control: Heartbeat
Bot -> Server then Server to bot Every 60 seconds

11. Command and Control: Attack Inst.

12. Command and Control: Attack Inst.

13. Command and Control: Attack Inst.

14. Kami and r0_bot Share some similar patterns with Mirai
Nest themselves into hidden folders.
Propagate through IP Scanning / Default Credentials
Attack patterns unknown (dormant malware)

15. Solutions In case of Read/Write Linux subsytems
Change the passwords from default
Reboot your device.
In case of Read-Only Linux Subsystems
Depends on the manufacturer’s patch
Community patched firmware (if possible).
Disable Telnet
Better IoT device design
(Standardization?)
Better DDoS mitigation tools
Academic Research?