Fileless Attacks on Linux-based IoT Devices
Fileless attacks on Linux-based IoT devices using HoneyCloud. Exploring the background, architecture, findings, implications, and conclusions of these attacks. Delve into the use of hardware and software IoT honeypots to combat such threats.
Uploaded on Feb 17, 2025 | 0 Views
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Understanding Fileless Attacks on Linux-based IoT Devices with HoneyCloud Fan Dang, Zhenhua Li, Yunhao Liu, Ennan Zhai Qi Alfred Chen, Tianyin Xu, Yan Chen, Jingyu Yang 1
Outline Introduction Background Architecture Findings and implications Conclusion 2
Introduction Most IoT devices use Linux OS (e.g., OpenWrt and Raspbian) Hardware IoT honeypots Software IoT honeypots Honey cloud 4
Fileless attacks A.k.a zero-footprint attacks, macro, or non-malware attacks Using legitimate programs to infect a computer E.g. UIWIX 6
Honeypot 7
High Fidelity Maintainer Customizing QEMU configurations Masking sensitive system information Forge /proc/cpuinfo in OpenWrt VM instances rearrangement among public clouds Fragmentizing regions, zones, and in-zone IP ranges Periodically change the IP address of each software honeypot 14
Inference Terminal {ab c} {acb} 21
Hardware Software Quantity 4 108 Suspicious connections 14.5million 249million SSH/Telnet connections 85.8% 78.3% SMB connections 3.2% 8.9% HTTP(S) connections 2.5% 3.2% Malwarebased attacks Fileless attacks 0.75 million 0.08 million 14.6 million 1.40 million Resize X 37 25
Malware-based Attacks 426 different types of malware (hardware) 598 different types of malware (software) 73.3% and 80.2% of them are Mirai 92.1% of malwarebased attacks target multiple architectures of IoT devices 598 426 Hardware Software 26
Fileless Attack Taxonomy 8 different types of fileless attacks 27
Occupying end systems (1.8%) Altering the password of an IoT device (via passwd) passwd : a command in Linux which is used to change the user account passwords 28
Damaging system data (54.4%) Removing or altering certain configuration files or programs (via rm and dd) e.g. Remove the watchdog daemon Watchdog : An electronic or software timer that is used to detect and recover from computer malfunctions 29
Preventing system monitoring/auditing services (8.5%) Killing the watchdog processes or stopping certain services (via kill and systemctl) e.g. By stopping the firewall service, attackers can better exploit known vulnerabilities to launch attacks 30
Retrieving system information (7.4%) Retrieving the hardware information and the system information (via lscpu) Such information may be useful for launching further attacks for specific purposes, e.g., downloading and executing platform-specific malware binaries. 31
Stealing valuable data (23.5%) Reading passwords and/or certain configuration files (via cat) 32
Launching network attacks (0.3%) By sending malformed HTTP requests to exploit the vulnerabilities of targeted web servers to launch DoS attacks (via wget and curl) 33
Issuing other shell commands for unclear reasons (3.8%) Issuing other shell commands for unclear reasons . Speculating that the attacker may be collecting and analyzing other system users at the same device 34
Conducting attacks where no shell command is involved (0.3%) SSH Tunneling Attack 35
Conclusion 37
