Persistence in Linux-Based Iot Malware

Persistence in Linux-Based IoT Malware Calvin Brierley, Jamie Pont, Budi Arief, David J. Barnes, and Julio Hernandez-Castro School of Computing, University of Kent, Canterbury, England fC.R.Brierley, J.Pont, B.Arief, D.J.Barnes, [email protected] Abstract. The Internet of Things (IoT) is a rapidly growing collection of \smart" devices capable of communicating over the Internet. Being connected to the Internet brings new features and convenience, but it also poses new security threats, such as IoT malware. IoT malware has shown similar growth, making IoT devices highly vulnerable to remote compromise. However, most IoT malware variants do not exhibit the ability to gain persistence, as they typically lose control over the com- promised device when the device is restarted. This paper investigates how persistence for various IoT devices can be implemented by attackers, such that they retain control even after the device has been rebooted. Having persistence would make it harder to remove IoT malware. We in- vestigated methods that could be used by an attacker to gain persistence on a variety of IoT devices, and compiled the requirements and potential issues faced by these methods, in order to understand how best to combat this future threat. We successfully used these methods to gain persistence on four vulnerable IoT devices with differing designs, features and archi- tectures. We also identified ways to counter them. This work highlights the enormous risk that persistence poses to potentially billions of IoT devices, and we hope our results and study will encourage manufacturers and developers to consider implementing our proposed countermeasures or create new techniques to combat this nascent threat. Keywords: IoT · security · malware · persistence · attack · proof of concept 1 Introduction A standard piece of advice typically given to affected users for removing malware from an Internet of Things (IoT) device is to restart it, as most forms of IoT malware lack the ability to maintain persistence [3, 4]. This is because, in general, IoT malware is stored and executed from within temporary filesystems that reside in Random-Access Memory (RAM) [32]. As this type of memory is volatile, the stored programs and data are lost when the device loses power, including any changes that the attacker may have made to the filesystem. However, there have been some families of IoT malware that are able to maintain persistence in some form [15, 27]. If persistent IoT malware becomes more prevalent, many IoT devices will not be recoverable at all once they have been infected. Therefore, it is increasingly crucial for IoT developers both to understand their devices' potential vulnerabilities to persistence and to implement preventative measures to prohibit attackers from exploiting them. These two aims serve as the motivation for our work. 2 Authors Suppressed Due to Excessive Length Contributions. The key contributions of this paper are: { We summarise IoT persistence and its role in IoT based malware. { We explain the challenges currently preventing IoT malware from establish- ing persistence. { We outline methods that could be used by IoT malware to gain persistence. { Finally, we explore how this will change the approach of IoT malware and how attackers could achieve and use persistence to perform new and previously infeasible attacks, and what can be done to counter this threat. The rest of the paper is organised as follows. Section 2 provides some background on Linux malware, IoT based malware and persistence. We also highlight previous research and some of the challenges attackers may encounter when attempting to gain persistence on IoT devices. Section 3 describes several methods that could be used by attackers to gain persistence on various types of IoT device, along with their requirements and limitations. Section 4 shows the results of attempting to gain persistence on four vulnerable IoT devices using these methods. Section 5 discusses some potential countermeasures that could be implemented to prevent an attacker from gaining persistence on an IoT device. Section 6 covers our conclusions and defines some recommended further work. 2 Background Various families of malware have increasingly attacked IoT devices. Popular bot- nets such as Bashlite and Mirai have infected hundreds of thousands of devices and have been responsible for one of the largest DDoS attacks in history [33, 11]. Fortunately, this type of IoT malware is relatively simple to remove. By restarting the device, the malware will be unloaded from volatile memory, removing the infection from the device when it reboots [3, 4]. However, some malware (such as Mirai) often exhibits worm-like behaviour [5] and after hijacking a device, it will scan the Internet for more victims to infect. While users would sometimes restart their devices (either deliberately or coincidentally) and clear the infection, it would not remove the underlying issue. The devices could easily be reinfected, possibly within minutes [3]. In effect, this behaviour has led to competitions between botnet authors, each seeking to maximise their share of the limited number of vulnerable IoT devices. Some malware even exhibited security features to remove competing malware. Mirai, for instance, would search for strings present in competing malware, kill any associated running processes and close any potentially vulnerable services running on specific ports to prevent any further attacks by competitors [5]. However, as these changes were not persistent they were removed when the device was reset. 2.1 Persistent IoT Malware IoT malware capable of making persistent changes that secure its presence would be able to maintain control over the device through reboots, both removing the Persistence in Linux-Based IoT Malware 3 requirement to reinfect the equipment and helping towards keeping competitors at bay. The ability to secure persistence would also allow significant changes to the device to persist after rebooting, allowing for more creative types of malware and attacks, such as ransomware [10] or long term spyware. This would also provide a means for the malware operator to install additional malicious features, such as modules that can attack other devices on the infected device's network. Currently, restarting an infected device will remove the majority of IoT malware, but with persistence, the user would have to modify the flash memory of the device to remove the infection. This is something not usually readily avail- able nor practical to an average user. If the malware can also prevent updates or factory resets, specialist equipment or access to a debug/programming inter- face may be required to clear the infection. This is considered too complicated for most IoT users to perform and may lead to IoT devices being discarded, or worse, knowingly left in an infected state. 2.2 Challenges With Gaining Persistence There are two key challenges currently faced by IoT attackers when attempting to gain persistence on IoT devices: { Read-Only. IoT devices often have data that is set to read-only for various reasons, such as to prevent accidental modifications due to programmer error. This feature may also prevent attackers from making the necessary modifications to the stored data or filesystems in order to gain persistence. { Variance. Each device is likely to have different hardware, update mecha- nisms, software, architecture and filesystem types. Fortunately for IoT developers, the variation in IoT devices makes it quite difficult for attackers to create a universal method for gaining persistence. However, if an attacker were to develop a method that affects a large number of devices with similar implementation, it could reduce the required time investment immensely, leading to persistent IoT Malware becoming more common. 2.3 Previous Persistent IoT Malware and Related Work After identifying an increase in the presence of Linux based malware, researchers analysed 10,548 samples over a year to gain a better understanding of the techniques used by malware authors [12]. They highlighted the quick development and deployment of insecure IoT devices as a potential motive for attackers to target Linux for malware development. As part of this analysis, they found that 21.10% (1,644) of the analysed samples implemented persistence methods. Some of these methods can be applied to IoT devices, but the attacker must be able to modify the filesystem. As men- tioned previously, IoT devices often set certain data as read only, which would prevent these methods from working. Some variants of IoT malware have achieved persistence, but these are less common and they rely on the device having a writeable filesystem, which may 4 Authors Suppressed Due to Excessive Length reduce the applicability of this approach. We examine two examples of persistent IoT malware below. Torii is a variant of Mirai that adds several features, most notably the introduction of six techniques to gain persistence [15]. Each technique modifies files on the infected device which are executed as part of the boot process, such as: { .bashrc, which is executed whenever an interactive bash session is started; { initab, which is used to determine which processes should be ran during the Linux boot process at certain runlevels; { crontab, which is used to execute files at a certain time or interval. Modifications to these files would allow the attacker to set particular programs or shell scripts to be run when the device boots. VPNFilter is a complex IoT malware which affects a large number of routers [30]. It is believed to have been developed by \Fancy Bear", a Rus- sian based hacker group [31]. Its modular structure allows many features to be implemented, ranging from man-in-the-middle attacks to SCADA sniffing. Ad- ditionally, VPNFilter seems to include a section of code to erase and rewrite Memory Technology Devices (MTDs)1, which could potentially be used to brick the device by wiping segments of the device's storage [28].

Load more