Understanding Fileless Attacks on Linux-Based Iot Devices with Honeycloud
Total Page：16
File Type：pdf, Size：1020Kb
Understanding Fileless Attacks on Linux-based IoT Devices with HoneyCloud Fan Dang1, Zhenhua Li1∗, Yunhao Liu1;2, Ennan Zhai3 Qi Alfred Chen4, Tianyin Xu5, Yan Chen6, Jingyu Yang7 1Tsinghua University 2Michigan State University 3Alibaba Group 4University of California, Irvine 5University of Illinois Urbana-Champaign 6Northwestern University 7Tencent Anti-Virus Lab ABSTRACT have employed Linux (e.g., OpenWrt and Raspbian) for its preva- With the wide adoption, Linux-based IoT devices have emerged as lence and programmability, and such a trend has been growing one primary target of today’s cyber attacks. Traditional malware- continuously [1]; meanwhile, the number of cyber attacks against based attacks can quickly spread across these devices, but they Linux-based IoT devices is also increasing rapidly [5]. In this paper, are well-understood threats with effective defense techniques such we, therefore, focus on Linux-based IoT devices and the attacks as malware fingerprinting and community-based fingerprint shar- targeting them. The Linux-based IoT attacks generally fall into two ing. Recently, fileless attacks—attacks that do not rely on malware categories: malware-based attacks and fileless attacks. files—have been increasing on Linux-based IoT devices, and posing Threats from malware-based attacks (e.g., Mirai, PNScan, and significant threats to the security and privacy of IoT systems. Little Mayday) have been widely known in IoT networks. For example, has been known in terms of their characteristics and attack vectors, global websites like GitHub and Twitter became inaccessible for which hinders research and development efforts to defend against hours in Oct. 2016, since their DNS provider, Dyn, was under DDoS them. In this paper, we present our endeavor in understanding file- attack by Mirai, which infected over 1.2 million IoT devices [11]. less attacks on Linux-based IoT devices in the wild. Over a span of These incidents raised high awareness of malware-based attacks twelve months, we deploy 4 hardware IoT honeypots and 108 spe- on IoT systems; throughout the past few years, their characteristics cially designed software IoT honeypots, and successfully attract a have been extensively studied and effective defense solutions have wide variety of real-world IoT attacks. We present our measurement been developed. For instance, the hash (e.g., MD5 or SHA-n) of a study on these attacks, with a focus on fileless attacks, including the malware’s binary file can be computed to fingerprint these IoT mal- prevalence, exploits, environments, and impacts. Our study further ware, and such fingerprints are then shared with the community 1 leads to multi-fold insights towards actionable defense strategies such as through VirusTotal . For a malware that has not been fin- that can be adopted by IoT vendors and end users. gerprinted, static and dynamic analysis can be applied to determine their malice [16]. CCS CONCEPTS Fileless attacks (also known as non-malware attacks or zero- footprint attacks) on IoT devices differ from malware-based at- • Security and privacy → Hardware attacks and countermea- tacks in that they do not need to download and execute malware sures; Mobile and wireless security. files to infect the victim IoT devices; instead, they take advantage ACM Reference Format: of existing vulnerabilities on the victim devices. In the past few Fan Dang, Zhenhua Li, Yunhao Liu, Ennan Zhai, Qi Alfred Chen, Tianyin years, increasingly more fileless attacks have been reported4 [ , 37], Xu, Yan Chen, and Jingyu Yang. 2019. Understanding Fileless Attacks on e.g., McAfee Labs reports that fileless attacks surged by 432% over Linux-based IoT Devices with HoneyCloud. In The 17th Annual International 2017 [3]. Traditional servers and PCs defend against fileless attacks Conference on Mobile Systems, Applications, and Services (MobiSys ’19), June 17–21, 2019, Seoul, Republic of Korea. ACM, New York, NY, USA, 12 pages. using sophisticated firewalls and antivirus tools [6]; however, these https://doi.org/10.1145/3307334.3326083 solutions are not suitable for the vast majority of IoT devices due to the limited computing and storage resources. As a result, fileless 1 INTRODUCTION attacks pose significant threats to the IoT ecosystem, given that IoT devices are often deployed in private and sensitive environments, Internet of Things (IoT) has quickly gained popularity across a wide such as private residences and healthcare centers. At the moment, range of areas like industrial sensing and control [36], home au- there is limited visibility into their characteristics and attack vec- etc. tomation [18], . In particular, the majority of today’s IoT devices tors, which hinders research and development efforts to innovate ∗ Corresponding author. new defense to combat fileless attacks. Permission to make digital or hard copies of all or part of this work for personal or 1.1 Study Methodology (§2) classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation To understand Linux-based IoT attacks in the wild, we use honey- on the first page. Copyrights for components of this work owned by others than the pots [31], which are known to be an effective method for captur- author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission ing unknown network attacks. We, therefore, first set up several and/or a fee. Request permissions from [email protected]. common Linux-based IoT devices in different places as hardware MobiSys ’19, June 17–21, 2019, Seoul, Republic of Korea honeypots. Each honeypot is coupled with a Remote Control Power © 2019 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN 978-1-4503-6661-8/19/06...$15.00 https://doi.org/10.1145/3307334.3326083 1https://www.virustotal.com Adapter which can reset the honeypot when it is compromised. • Fileless attacks aggravate the threats to IoT devices by in- These offer us valuable insights into the specialties of IoT attacks. troducing stealthy reconnaissance methods and unique However, we notice that this first endeavor incurs unaffordable types of IoT attacks. On one side, we notice that 39.4% of the infrastructure and maintenance costs when deployed at scale. We, captured fileless attacks are collecting system information or therefore, attempt to explore a cheap and scalable approach to ef- performing de-immunization operations (e.g., shut down the fire- fectively capture and analyze real-world IoT attacks. wall and kill the watchdog) in order to allow more targeted and Intuitively, such an attempt can be empowered by public clouds efficient follow-up attacks. We suspect this is because fileless widely spread across the world. This seems to be a possible host for attacks are harder to fingerprint, and thus are highly suitable our quickly deploying numerous software (virtual) honeypots. Nev- for stealthy attack reconnaissance or preparations. On the other ertheless, this approach is subject to several practical issues. First, side, we find that fileless attacks can also be powerful attack the virtual honeypots should behave similarly to actual IoT devices, vectors on their own while maintaining high stealthiness. Specif- so as not to miss the relatively rare fileless attacks. Second, they ically, we capture a fileless attack in the wild that launched a should expose in-depth information of the interaction processes, targeted DDoS attack. The attack neither modifies the filesystem to facilitate our characterizing the usually hard-to-track fileless nor executes any shell commands, but can manipulate a swarm attacks. Finally, they have to conform with diverse policies imposed of IoT devices and make the attacker(s) invisible to victims. Since by different cloud providers, so that one cloud’s limitations would the only indication of such an attack is anomalous patterns of not essentially influence the coverage of our study results. To this outbound network traffic, it is highly challenging for existing end, we heavily customize the design of software honeypots by host-based defense mechanisms to detect it effectively. leveraging the insights collected from hardware honeypots, such as • IoT attacks in the wild are using various types of infor- kernel information masking, encrypted command disclosure, and mation to determine device authenticity. According to our data-flow symmetry monitoring. We carefully select eight public measurements on hardware honeypots, 9132 attacks executed clouds to disperse 108 abovementioned software honeypots, and the commands like lscpu to acquire sensitive system information. system is called HoneyCloud. These software honeypots employ In addition, with HoneyCloud we find an average of 6.7% fewer OpenWrt, which is one of the most popular Linux distributions for attacks captured by a honeypot hosted on AWS than one hosted IoT devices [1] and also suitable for customization. on other public clouds, probably because AWS has disclosed all Compared to a hardware honeypot as we show in §2.2, a soft- its VM instances’ IP ranges and some malware like Mirai does ware honeypot attracts 37% fewer suspicious connections and 39% not infect (in fact intentionally bypasses) specific IP ranges [11]. fewer attacks on average. On the other hand, the average monthly These insights are then leveraged to improve the design and maintenance fee of a software honeypot (∼6 US dollars) is 12.5× deployment of HoneyCloud in fidelity and effectiveness. less than that of a hardware honeypot (∼75 US dollars). More impor- • We discover new security challenges posed by fileless at- tantly, all the types of attacks captured by our hardware honeypots tacks and propose new defense directions. While leaving have also been captured by HoneyCloud (but not vice versa). This zero footprint on the filesystem, almost all the captured fileless shows the effectiveness of our design in practice. attacks are using shell commands and thus are detectable by au- 1.2 Findings and Implications (§3) diting the shell command history of IoT devices.