Defending IoT Devices from Malware

Abstract

As the number of internet users continues to grow, so do the numbers and types of devices people connect to; hence, a larger attack surface. For example, the Qbot and Mirai botnet malware are capable of infecting devices across different chipset architectures, and both malware were reportedly responsible for a number of high profile DDoS attacks in recent times. These two malware families (and many others) generally affect a broad range of consumer grade appliances, and many of these appliances (also referred to as devices) are insecure or not designed with security in mind. While researchers have focused on areas such as attacking the botnet owner’s payment infrastructure, reversing the botnet and using it as a countermeasure in grey-hat counterattack, etc., there are many more questions that have not been addressed. For example, are users putting too much trust in manufacturers and failing to take adequate measures to protect their own networks? Hence, in this paper we investigate two most popular families of Internet of Things (IoT) malware, Mirai and Qbot, to understand how they spread, what attacks they are capable of, who could be responsible, and what are the motivations of the threat actors. We also propose an efficient solution to scan for Mirai- and Qbot-related vulnerabilities in IoT devices and systems. We then study what companies can do to help protect themselves from attacks. Simple steps such as correctly configuring appliances, carrying out risk assessments and creating an action plan are discussed as proactive measures that could be taken to facilitate threat reduction and incident response.