The Circle Of Life: A Large-Scale Study of The IoT Malware Lifecycle Omar Alrawi?, Charles Lever?, Kevin Valakuzhy?, Ryan Court}, Kevin Snow}, Fabian Monrose†, Manos Antonakakis? ? Georgia Institute of Technology {alrawi, chazlever, kevinv, manos}@gatech.edu } Zero Point Dynamics {rccourt, kevin}@zeropointdynamics.com † University of North Carolina at Chapel Hill [email protected] Abstract RQ2, we qualitatively evaluate how traditional anti-malware Our current defenses against IoT malware may not be ade- techniques work and judge their efficacy based on empirical quate to remediate an IoT malware attack similar to the Mirai observations from the IoT malware ecosystem. botnet. This work seeks to investigate this matter by systemat- Answering RQ1 allows the security community to under- ically and empirically studying the lifecycle of IoT malware stand the evolutionary trend of IoT malware and respond and comparing it with traditional malware that target desktop accordingly. For example, how do malware adapt to infect and mobile platforms. We present a large-scale measurement and persist on IoT devices? Are there trends that can allow of more than 166K Linux-based IoT malware samples col- us to better predict the impact of IoT malware on future IoT lected over a year. We compare our results with prior works technologies? Compared to desktop and mobile malware, are by systematizing desktop and mobile malware studies into a IoT malware capabilities bound by the device’s resources? novel framework and answering key questions about defense How does the IoT malware ecosystem impact different stake- readiness. Based on our findings, we deduce that the required holders? Furthermore, RQ2 allows the security community to technology to defend against IoT malware is available, but gauge if there are sufficient defensive techniques to counter a we conclude that there are insufficient efforts in place to deal fast-evolving IoT threat. with a large-scale IoT malware infection breakout. To date, there have been several efforts to investigate IoT malware [1]–[8]. However, these efforts either focus on in- depth analysis of a single malware family or rely on small 1 Introduction malware corpora collected over short periods. Nonetheless, these efforts provide a fascinating glimpse into the IoT threat The Mirai botnet set a record for the largest distributed denial landscape and demonstrate the need for additional research. of service (DDoS) attack and drew the attention of many se- Moreover, current threat frameworks are either too complex curity professionals [1]. In the aftermath of the attack, many with a focus on traditional malware, such as the MITRE new developments have shaped the IoT malware ecosystem. ATT&CK [9] framework, or study only the infection stage Therefore, studying the threat lifecycle for IoT malware is of IoT malware [10], [11]. Our work seeks to address these vital for securing IoT devices. For example, the Mirai botnet gaps with a comprehensive evaluation of the IoT malware infected devices by using default usernames and passwords, lifecycle. We guide our study by a principled framework that but current IoT malware variants target unpatched vulnera- characterizes various stages of an IoT malware’s lifecycle, bilities. We seek to study how the emerging IoT malware and we compare our findings with traditional malware. ecosystem has evolved since Mirai and whether current de- Our work makes four contributions. First, we propose a fenses for traditional malware can protect against it. novel analysis framework that captures the threat lifecycle of To investigate this matter, we need to systematically un- IoT malware, which considers the infection vectors, payload derstand how IoT malware infect systems, deploy payloads, properties, persistence methods, capabilities, and C&C infras- persist on systems, abuse resources, and operate their infras- tructure. Second, we use our framework to systematize 25 tructure. We guide our analysis by answering two research papers that study traditional malware. Third, we characterize questions (RQ), namely RQ1: How is IoT malware differ- IoT malware by examining more than 166K samples spanning ent than traditional malware? and RQ2: Are current anti- 6 different system architectures collected over a year. Fourth, malware techniques effective against IoT malware? To answer we make available the largest and most comprehensive IoT RQ1, we compare the IoT malware lifecycle with traditional malware corpus to date and include their analysis artifacts, malware and highlight the similarities and differences. For which can be found at https://badthings.info. Our results show that IoT malware differs from traditional hensive studies examine individual components of the IoT malware in a few key areas including infection vectors and malware lifecycle. For example, several works [3], [5], [10], C&C communication. We find signature-based detection lacks [37] examine IoT malware infection tactics and the payload support and coverage for many IoT malware variants and that properties. Other works [6], [38] look at how to detect IoT at least 15% of new variants utilize packing to evade detection. malware by studying its binary static structural features. De Additionally, IoT malware uses various persistent methods Donno et al. [11] organize IoT malware attack capabilities to overcome read-only file systems found in IoT devices by into a taxonomy while Choi et al. [4] study the role that C&C reusing vendor-specific tools. We find a large array of capa- infrastructure plays in the lifecycle of IoT malware. bilities that have been incorporated into IoT malware such as Additional efforts [39], [40] investigate scanners on the in- proxy services, device bricking, and information theft. We ob- ternet to identify if they are infected by IoT malware. Finally, serve that the current IoT malware ecosystem has not reached Çetin et al. [41] present a unique perspective on IoT malware its full potential but may become a severe threat due to the infection cleanup by combining multiple data sources and a sheer number of IoT devices coming online. We conclude user study to measure remediation efforts. Our work differs with a set of recommendations for different stakeholders in- in two aspects, first we propose a five-component framework cluding device owners, device vendors, and ISP operators. that captures the entire lifecycle of IoT malware, which we use to compare with desktop and mobile malware. Second, 2 Background and Related Work we conduct the largest and most comprehensive empirical measurement for more than 166K Linux-based IoT malware Malware targeting embedded Linux-based systems was first samples collected over an entire year. reported in 2008 with the discovery of the Hydra IRC bot [12]. Since then, several other bots have entered the scene with var- 3 Framework and Methodology ious capabilities. Such bots include psyb0t [13], Chuck Nor- ris [14], Carna [15], Tsunami [16], Aidra [17], Dofloo [18], Next, we describe the data sources, methodology, and the Gafgyt [19], Elknot [20], XOR.DDoS [21], Wifatch [22], The- framework that we use for the comparative analysis. We define Moon [23], LUABot [24], Remaiten [25], NewAidra [26], each component’s subcategories and present a summary of our and Moose [27]. Each family had different purposes such results in Table1. AppendixA presents an extended analysis as credential theft [27], cryptocurrency mining [28], device of desktop and mobile malware from prior works. destruction [29], internet-wide scanning [15], and cleaning up infected devices [2], [22]. IoT malware development has 3.1 Comparative Framework many considerations due to the heterogeneity of devices. For example, an IP camera and a set top box can have differ- Our framework looks at five components for malware’s lifecy- ent processors, C libraries (uclibc, musel, glibc), and kernel cle. We study the infection vector, the payload properties, the versions/features (Linux 2.6, 3.2, 4.6, etc.). persistence methods, the capabilities, and the C&C infrastruc- The release of Mirai’s source code and recent develop- ture. For each component, we identify techniques discussed ments in embedded system toolchains has made it easier for in the literature for traditional malware (desktop/mobile) and IoT malware development. Antonakakis et al. [1] note that empirically measure it for IoT malware. The following defines Mirai had a wide impact due to the fact that its small code each component: base runs on diverse devices, spreads efficiently, and targets • Infection Vector is how the malware attacks a system. a large number of insecure IoT devices on the internet [30], • Payload is the dropped malware code after exploitation. [31]. The Mirai botnet took down critical DNS infrastruc- • Persistence is how the malware installs on a system. ture [32], disconnected over 900K internet subscribers [33], • Capabilities are the functions in the malware code. and attacked a large cloud service provider [34]. Soon after • C&C Infrastructure is how the malware communicates the release of Mirai’s code, many variants began to surface with the operator. with enhancement to its infection vector, payload obfusca- We study 25 papers from prior works to qualitatively de- tion, and command-and-control (C&C) communication. For rive subcategories under each component, which are in Ap- example, Satori [35], a Mirai variant, gained momentum as it pendixA. For example, we cite the work of Holz et al. [42] exploited a new vulnerability in Huawei routers. These recent to support the use of drive-by downloads in desktop malware developments provide further motivation to understand the and their distribution networks. Moreover, we use the MITRE IoT malware landscape. ATT&CK taxonomy to derive additional subcategories that Prior studies looked at IoT malware from different perspec- are not found in prior work but are documented by security tives. Cozzi et al. [36] investigate Linux-based malware but companies. Table1 summarizes the comparative analysis. only examine 10K samples, of which 35% are for x86 and x86_64 architecture. Other studies examine specific malware families such as Mirai [1] and Hajime [2].