Impacts of Cyberattacks on Iot Devices Table of Contents

PALO ALTO NETWORKS | IoT Impacts of Cyberattacks on IoT Devices Table of Contents Introduction 3 Modern IoT Attacks 3 The IoT Attack Lifecycle 4 Cyberattack Scenarios on IoT Devices & Impacts 5 Network Scanning Impacts to Network Services 5 Experiment Environment and Test Methods CPU, Memory, and Bandwidth Usage Service Response Time Results Conclusions Impacts C-IoT Device Battery Exhaustion 7 Background and Attack Vectors Unlocking the Potential of C-IoT Connectivity Experiment Environment and Test Methods Test Results Conclusions Impact Summary 8 Impacts of Cyberattacks on IoT Devices | White Paper 2 Introduction attacks. Take Xbash for example, which has botnet, ransom- ware, cryptomining, and self-propagation capabilities. Da- The early days of the internet age were about connecting peo- ta-destructive by nature, Xbash spreads by attacking weak ple, whereas today the focus is on connecting “things.” In the passwords and unpatched vulnerabilities in Linux and Mic- broadest sense, the internet of things (IoT) is a vast matrix rosoft Windows® servers. Another example, a new variant of of numerous nonstandard devices and endpoints connected the Muhstik botnet, self-installs and infects Linux servers wirelessly over the internet. IoT device connections are en- and IoT devices with its wormlike self-propagating capabil- abled by advanced wireless cellular technologies, including ity to wreak havoc with cryptomining and DDoS attacks. To 3G, 4G, 5G, and low-power wide-area (LPWA) cellular tech- understand the reasons behind these attacks and their impact nologies, such as NB-IoT and LTE-M. on IoT devices, let’s move on to discuss IoT device attack sur- Connected IoT devices are capable of generating and trans- faces. mitting real-time data from the nearest to the farthest edg- The attack surfaces of IoT devices are broadly categorized es of the network. The data is then monitored, managed, and into three main groups: hardware interfaces, communica- analyzed to achieve desired business outcomes. According to tion channels, and applications/services. The first group, the a recent forecast by IDC, there will be 41.6 billion connected physical hardware interface of the device, is the most obvious IoT devices, or “things,” generating 79.4 zettabytes (ZB) of attack surface. Attackers get access to the shell or outermost data in 2025.1 layer of the operating system kernel of the device, modify the By leveraging analytics derived from large volumes of IoT de- firmware, and go as far as to embed a backdoor through the vice-generated data, organizations gain insights germane to hardware interface to bypass normal authentication mecha- the performance of their business systems, operational pro- nisms. cesses, and customer experiences. IoT-generated data has the IoT devices connect and communicate through two types of unique potential of opening up market opportunities for one- channels: either short-range channels that include BLE, Zig- of-a-kind products and services not previously thought pos- bee/Z-Wave, and Wi-Fi or the long-range cellular network sible. Due to its compelling value proposition as a major driver channel. These communication channels represent the sec- of business transformation, IoT adoption is growing rapidly ond attack surface. Few IoT devices use secure and superi- across numerous industry verticals worldwide. Key findings or encrypted communications during initial configuration, from a recent report by Microsoft suggest that almost 88% thereby making it simple for attackers to make the IoT de- of business decision makers feel the adoption of IoT-based vice vulnerable to IP spoofing where a hacker illicitly imper- technologies is becoming critical for business success.2 How- sonates another IoT device in the network to spread malware ever, despite the business transformation benefits IoT has and launch a man-in-the-middle attack, replay attack, or a to offer, organizations are confronted with barriers when it denial-of-service (DoS) attack. comes to adoption—97% of respondents to Microsoft’s IoT Applications/services are essential to IoT devices and repre- Signals survey cited security concerns as a major challenge sent the third attack surface. The administrative interface, the when implementing IoT.3 web API, the cloud server, system functionality components, and services delivered from the applications are all suscep- Modern IoT Attacks tible to attacks. Most modern IoT attacks are unleashed by compromising this attack surface because of its scalability, All IoT devices are vulnerable to being weaponized with bot- accessibility, and proximity to the edge of the internet. Even nets for the purpose of carrying out distributed denial-of-ser- if the services are deployed on an enterprise’s intranet, at- vice (DDoS) attacks. In 2016, the Mirai botnet targeted more tackers can still infiltrate it through a vulnerable edge router. than 600,000 IoT devices, such as routers and cameras, to For example, the Xbash botnet has the ability to infiltrate the launch a massive DDoS attack that reached 620 Gbits at its enterprise intranet to scan and attack multiple services, such peak. Since that infamous incident, new malware families as the Telnet application protocol and File Transfer Protocol have come into existence to launch other types of aggravated (FTP). Impacts of Cyberattacks on IoT Devices | White Paper 3 1 2 3 4 Initial Access Execution Persistence Evasion The IoT Attack Lifecycle 8 7 6 5 Impact Lateral Command Information Movement & Control Collection Figure 1: Stages of the IoT attack lifecycle The IoT Attack Lifecycle 4. Evasion The use of evasion techniques ensures the attack is not dis- Now that we’ve reviewed the three main types of IoT attack covered or detected. By being evasive, the attack can clear the surfaces, let’s discuss how the IoT attack lifecycle works. The system logs and the BASH command history, hide the payload lifecycle comprises eight stages. file in the system folder with a masquerading filename, and 1. Initial Access even delete the original payload file. Advanced malware, such as the Xbash family for its ability to install host-based securi- As the name suggests, this is the first stage in the IoT attack ty monitoring tools. Lastly, to avoid detection, the attack also lifecycle. At this stage, the attack leverages the network scan- adopts anti-VM and anti-debugging techniques to detect the ning method to first locate IP addresses of vulnerable devices presence of automatic malware analysis systems, such as de- using fast port-scanning tools, such as ZMap or Masscan, to buggers and virtual machines. Examples of these include the scan the internet. Tsunami variant and the Torii botnet. 2. Execution 5. Collection of Information At this stage, the attack executes payloads or commands in At this stage, device information and sensitive files, such as the vulnerable device. In order to do this, it either gets access the private key and the cryptocurrency wallet, are collected. to the shell of the device’s operating system directly or injects Take the VPNFilter malware as an example. As an advanced the device with commands. To get direct access, brute force is persistent threat (APT) infect- ing a number of IoT network used to attack weak or default passwords for services such as routers and storage devices, VPNFilter steals sensitive data Telnet or SSH. To add to this, shell commands are then inject- from the network traffic in compromised routers. ed by exploiting the remote code execution (RCE) vulnerability or command injection vulnerability. When shell commands 6. Command and Control are executed, a general pattern follows in that a malicious ex- Next, the malicious payload also receives commands from the ecutable file (such as the ELF binary or the shell script) gets command-and-control (C2) server. For different C2 com- downloaded, the executable permission to the payload file mands, the payload continues to launch different attack ac- gets assigned, and the payload gets executed. tivities like TCP flooding, UDP flooding, and infiltration of 3. Persistence additional devices. For C2 channels, HTTP, IRC, P2P, and other such protocols are used. In the third stage, the executed malware payload shows persistence on the device. The malware can show persistence by killing the watchdog process to avoid the system rebooting; insert itself in scheduled cron jobs, system booting initial jobs, and system daemons; and even create new accounts. The shell is, at times, left open as a redundant access channel in order to establish redundant access in the future. Impacts of Cyberattacks on IoT Devices | White Paper 4 7. Lateral Movement Cyberattack Scenarios on The lateral movement in IoT attacks is mainly to continue in- fecting a large number of new devices in the local network. For IoT Devices and Impacts example, an edge router first gets infected and then continues to infect all IoT devices that are connected to it. Network Scanning Impact on Network Services One of the most important attack stages in an IoT attack life- 8. Impact cycle is the initial access “network scanning” stage when an Malicious activities launched in the IoT device have multiple attacker starts probing available open ports with scanner IPs impacts on the device: encryption of data for a ransom, total in compromised IoT devices. It is possible to launch the attack wipe out of disk and data, and abuse for cryptomining. The remotely by exploiting a remote code execution vulnerability, BrickBot family of malware, for example, can “brick” an IoT typically on internet-facing service port 37215. device by corrupting its storage capability or by completely It is evident that the network scanning in compromised IoT reconfiguring its kernel parameters. devices costs network bandwidth resources. So, an experiment was designed to explore the impacts of network scan- While attack surfaces, threat vectors, and vulnerabilities ning on application or network services in compromised IoT in IoT devices are being widely researched, we haven’t seen devices.

Load more