IoT botnetsScaleoftheproblem&lessonslearned

Examples

• In2016,IoT botnetscausedseveralDDoSattacksexceeding100Gbps:• Russianbankingsystem:InNov2016,overtwodays,fiveofRussia’smajorbankssufferedamassiveDDoSattackfromabotnetwithmorethan24,000bots.

• Dyn (USDNSprovider):OnOct21,2016upto100,000compromisedDVRs,videocameras,andotherembeddedsystemsattackedDyn.

• BlogofBrianKrebs:OnSep20,2016thewebblogofacybersecurityjournalistwashitwithaDoS,withpeaktrafficataround620Gbps.

• TheUScandidates’campaignwebsites:DuringtheUSelectioncampaign,bothcandidatesweretargetedwith30-secondattacks.

• OVH(Frenchcloudcomputingcompany):OnSep20,thehostingproviderOVHwastargetedwithadistributed1.2Tbps attack.152,000infectedIoT deviceswereusedtolaunchthelargestDDoSattackcampaigneverrecorded.

• RioOlympicGames:DuringAugust2016,multipleDDoScampaignsagainsttheservershostingdataaboutthe2016OlympicGameswerecarriedoutforseveralmonths,peakingat540Gbps.

June7,2017 marnau@cispa.saarland@privacy__ninja 2

ProblemsofIoT devices

• Hardcodedpasswords/defaultbackdooraccounts• Weakauthentication• Unsecuredports• Oldandlowqualitysoftware• Patchability/Frequencyofpatches• ScalabilityofattacksduetoeasydiscoverabilityandhomogeneityofIoT devices• Nofinancialincentivetomakeproductsmoresecure; cheapandcompetitivemarket

June7,2017 marnau@cispa.saarland@privacy__ninja 3

Malwarebehavior

• Mostcommon:Mirai &Bashlite• Scan-and-spreadWorms• Eachbotisremotelycontrollablewhenandwhennottoscan,asopposedtocontinuousscansofpastworms(->difficulttomeasuresizeofbotnet)• Targetsdefaultoreasy-to-guesscredentials

June7,2017 marnau@cispa.saarland@privacy__ninja 4

CauseofVulnerability

• Defaultlogins/weakcredentials• VastmajorityofIoT malwaredoesnotactuallyexploitasoftwarevulnerability,butabusesweakdefaultlogincredentialstocompromise• VastmajorityofbotsspreadviaTelnetonport23

• Homogeneity• Thiseaseofabuseallowsdozensofless-experiencedadversariestojumponthebandwagon

• Lifespan• Low-profitproductswithlifespanofseveralyears,noeasywaytopatchvulnerabilities

June7,2017 marnau@cispa.saarland@privacy__ninja 5

Scale

• We’vejustseenthetipoftheiceberg• Between1.2and2Millioninfecteddevices• Botnetupstreambandwidthbetween1and3Tbps• MostlysimpleDDoSattacks• Atleast760differentdevicesaffectedbyIoTmalwareMirai &Bashlite

June7,2017 marnau@cispa.saarland@privacy__ninja 6

Originofbots700k

600k

500k

400k

300k

200k

100k

June7,2017 marnau@cispa.saarland@privacy__ninja 8

Originofbots

VNM IN

DIRNBRACHNRUSTHAPAKMEXTURGBRCRIIDNKORARGUSALBYCOLTWN ITA

700k

600k

500k

400k

300k

200k

100k

800k

VNM12.89%

IND12.29%

IRN11.18%

BRA10.74%

CHN5.59%

RUS4.14%

THA2.79%

PAK2.67%

MEX2.65%

TUR2.53%

GBR2.25%

CRI2.22%

IDN2.13%

KOR1.81%

ARG1.78%

USA1.62%

LBY1.47%

COL1.30%

TWN1.26%

ITA1.01%

June7,2017 marnau@cispa.saarland@privacy__ninja 9

Outlook

• IoT malwarestillinitsinfancy• Malwarewillbecomemoresophisticatedassecuritymeasuresgetbetter• Moretypesofattacks• ransomware,bitcoinmining,spam,clickfraud,andsocialmediabots• NotlimitedbyIoT OS

• IPv6• MayimprovesecuritybymakingitmoredifficultforattackerstoscanandfindvulnerableIoT devices,evenforsearchservicessuchasShodan

June7,2017 marnau@cispa.saarland@privacy__ninja 11

Securitylessons

• Iot securityrepeatingthesameevolutionasPersonalComputersecurity• Botnetskeepgrowingatafastpace• Devicesmusthaveandenforcesecurecredentials,nodefaultlogin• Regularsecurityupdatesbymanufacturerimportant,butincentivetoinstallisnecessary(e.g.autoupdates)• Manymoresophisticatedsecuritymeasures(e.g.coderandomization)arenotsuitedforIoT

June7,2017 marnau@cispa.saarland@privacy__ninja 12

Regulatorychallenge

• Customerprotectionoptions• Vendorliabilitytowardscustomerstoprovidesecurityupdatesfortwoyears(notice&patch);nounpatchable systems• Shiftofliabilityifcustomerschoosetonotupdatetheirsystems(similartoproductrecall)• Collectiveactionclauses

• Domesticfixtoaninternationalproblem• OnlyrelevantfordevicessoldintheEU• LittleimpactforprotectionfrombotnetattacksintheEU

ØInitialise &supportsectorspecificsecuritystandardsandcertificationØInternationalagreementsnecessary

June7,2017 marnau@cispa.saarland@privacy__ninja 13

─┐CISPA|CenterforIT-Security,PrivacyandAccountability│20/06/2017└─