2018-IoT物联网攻击手册（英文版）-4mb

IoT Attack Handbook Summary

Core Content

The IoT Attack Handbook is a comprehensive guide that explores the original Mirai botnet and its modern variants. It provides an in-depth analysis of various attack vectors used by Mirai and other IoT-based botnets, focusing on their technical characteristics, threat ranking, and implications for network security. The handbook aims to help readers understand the nature of these attacks and how to defend against them.

Main Points

Mirai Botnet Overview

• Mirai is an IoT botnet designed to exploit vulnerabilities in poorly secured IoT devices to launch large-scale DDoS attacks.
• It was publicly released in 2016 and has been responsible for some of the most damaging DDoS attacks, including those against Brian Krebs' website, OVH, and DNS provider Dyn.
• The botnet's source code was made available, enabling threat actors to create and modify their own botnets, which has led to the emergence of several modern variants like Masuta, Owari, DaddysMirai, and Orion.
• Mirai includes 10 attack vectors, with two more (Proxy and CFNull) being partially written but not completed.

Attack Vectors in Mirai

The handbook dissects several attack vectors used by Mirai, including:

• DNS Attack: Uses UDP to flood DNS servers with queries for random subdomains of a specified domain.

  • Threat Ranking: 10
  • Characteristics: High PPS, small packet size (93 bytes), difficult to defend without specific tools.
  • Control Parameters: Includes options like domain, source and destination ports, and IP addresses.

• VSE Attack (Valve Source Engine): Targets game servers using UDP.

  • Threat Ranking: 9
  • Characteristics: High PPS, small packet size (67 bytes), built to target game platforms.
  • Control Parameters: Similar to DNS, with options for ports and IPs.

• STOMP Attack: A TCP-based attack that uses in-session techniques to evade detection.

  • Threat Ranking: 8
  • Characteristics: High BPS, large packet size (822 bytes), creates an out-of-state condition.
  • Control Parameters: Includes options like destination port, sequence numbers, and flags.

• GREETH Attack: Uses GRE protocol to encapsulate Layer 2 Ethernet frames.

  • Threat Ranking: 7
  • Characteristics: High BPS and PPS, includes Layer 2 Ethernet frames.
  • Control Parameters: Similar to other attacks with options for ports, IPs, and flags.

• GREIP Attack: Another GRE-based attack, similar to GREETH but without the L2 frame.

  • Threat Ranking: 7
  • Characteristics: High BPS, medium PPS, medium packet size (544 bytes).
  • Control Parameters: Includes options for ports and IPs.

Threat Ranking Methodology

• Each attack is ranked on a scale from 10 (most threatening) to 1 (least threatening).
• Rankings are based on attack velocity (BPS/PPS), default behavior, and other factors.
• The analysis uses Raspberry Pi 3 devices as test subjects, which are more flexible and powerful than typical IoT devices in the wild.

Defense Considerations

• DNS Attack: Requires monitoring PPS, as it can exhaust bandwidth before BPS.
• VSE Attack: Similar to DNS, with a high PPS and the need to monitor PPS.
• STOMP Attack: Can evade OOS protections unless the code is modified.
• GREETH Attack: Requires specific firewall policies to block GRE traffic.
• GREIP Attack: Also requires careful handling due to its high BPS and packet size.

Key Information

• Mirai's Impact: Mirai has significantly influenced the security landscape by demonstrating the potential of IoT devices as DDoS tools.
• Modern Variants: The handbook highlights that Mirai has evolved into various modern botnets, which continue to exploit the same vulnerabilities.
• Lab Environment: The analysis is conducted in a lab using Raspberry Pi 3 devices running Raspbian, which are not inherently vulnerable but are used to simulate Mirai behavior.
• Threat Actors: The availability of Mirai's source code has allowed threat actors to create and customize their own botnets, leading to increased DDoS activity.

Conclusion

The IoT Attack Handbook serves as a valuable resource for understanding the evolution and impact of Mirai and its variants. It emphasizes the importance of recognizing and mitigating the various attack vectors used by IoT botnets, especially given their high PPS and BPS characteristics. The handbook also underscores the need for advanced network security measures to detect and respond to these threats effectively.