The Hunt for IoT: Multi-Purpose Attack Thingbots Threaten Internet Stability and Human Life

Executive Summary

In this fifth volume of F5 Labs’ The Hunt for IoT report series, we examine the data on global attacks against Internet of Things (IoT) devices from January through June 2018. In early 2017, Gartner—one of the most conservative analyst firms when it comes to IoT projections—expected IoT devices to surpass 8.4 billion in 2017 and grow to over 20.4 billion by 2020.¹ That’s a staggering 143% growth rate over three years. The current global population is 7.6 billion and growing at a comparatively miniscule rate of about 1% per year.²

With IoT devices already outnumbering people, and a projected IoT growth rate that far outpaces global population growth, the Internet is running us now, not the other way around. These devices are being used everywhere for everything—controlling virtually every aspect of our lives. Most of us are so bought into the idea of constant and pervasive “connectedness” that we are becoming the “things” of the Internet, which leads us to the following startling conclusions:

Insecure IoT affects everyone. You don’t have to be able to afford a smart home or own a smartphone to be impacted by compromised IoT devices. The moment you step outside, you can be watched. The CIA spoke about this problem recently, saying compromised wearables and IP cameras were enabling their agents’ locations to be tracked.³ F5 Labs published stories about attacks against IoT devices within the vicinity of President Trump during his meetings with Kim Jung-Un in Singapore and with Putin in Finland. These attacks were likely efforts by both adversaries and friendly nations trying to gain access to those meetings through IP cameras, VoIP phones, or video systems within proximity of the targets of interest. Governments can target anyone from a regular Joe all the way up to a President, Chairman, or Prime Minister. With help from Dutch intelligence services, the UK was able to attribute attacks against its own television stations to Russian operatives by hacking into CCTV cameras, watching the accused Russian operatives’ activities and collecting their keystrokes.^4,5

You want privacy? Get off the grid. Governments are deploying IP cameras in major cities for surveillance, allegedly to improve public safety, but many believe they’re there just to spy on civilians. The entire city of Camden, New Jersey has been under surveillance since 2013.⁶ In the UK, widely regarded as one of the most surveilled countries in the world, Londoners can expect to be monitored through CCTV cameras. In 2012, 300 CCTV cameras were deployed,⁷ however, the number is probably much higher now. In China, surveillance is welcomed. Citizens like the convenience of purchasing products based on facial recognition and are proud of having a “good citizen” score.⁸ China also deployed flocks of “doves”—drones in the shape of doves—to spy on its citizens.⁹ In April 2018, the US Cert issued a warning that Russia was compromising Small Office Home Office (SOHO) routers inside US homes and businesses to spy on civilians, collect data, and use it to inform their social media propaganda.

Human life is at stake. So far, our research in the Hunt for IoT report series has focused on WiFi-connected IoT devices, but there are also cellular-connected IoT devices. These are often gateways into critical infrastructure and equipment that supports human life like police cars, fire trucks, and ambulances; critical Industrial Control Systems (ICSs), and other critical systems that need stable, long-range connectivity. These cellular devices have the same weak access control problems traditional IoT devices have (open to the entire Internet and “protected” with vendor default credentials), and many also provide GPS tracking as they are typically used in fleet vehicles. These devices give away GPS coordinates without authentication. At Black Hat 2018, F5 Labs released this research, which included a video of a police car’s route as the officer drove around throughout the day. Simple pattern recognition can identify a police car and where the officer lives in less than six minutes.

Our homes have been weaponized against us. Outside of the routine use of SOHO routers, DVRs, and IP cameras, things like your TV, oven, refrigerator, Amazon Alexa, Siri and Google Assistant¹⁰, Keurig coffee maker (yes, we have attack traffic coming from a Kuerig), and toys¹¹ have been breached and are used to spy, collect data, or launch attacks.

IoT is beating people in the “weakest link” contest. It’s easier to compromise an IoT device exposed to the public Internet and “protected” with (known) vendor default credentials than it is to trick an individual into clicking on a link in a phishing email. Businesses are getting compromised through the unassuming IoT devices they’re using in their networks because the devices are often considered “facilities” devices and are managed by third parties who are not concerned with security, rather than by the organization’s internal corporate IT and security teams. A casino in Europe was breached through the thermostat in its fish tank.¹² US retailer Target was breached through its HVAC system.¹³ A university in the US lost its Internet service after an attack that involved 5,000 devices on its IoT network.¹⁴

Building multi-purpose attack bots from “things” is popular in the attacker community now. Script kiddies are learning to build bots from YouTube videos and launching damaging DDoS attacks. Seventy-four percent of the thingbots we know about were developed in the last two years. Thirteen thingbots have been discovered in 2018 alone, and they are no longer single- or dual-purpose bots. There has been a shift to multi-purpose attack bots for hire that deploy proxy servers. You can launch any attack of your choice or install other bots using multiple attack options.

The need for secure IoT has never been more critical. We publish where the attacks are coming from (source countries, ASNs, industries, and IP addresses), where the attacks are headed (destination country or region), and the top 50 attacked admin credentials—the credentials attackers use first in brute force attacks—in hopes that the owning entities (primarily telecom companies and hosting providers), will do something about the malicious traffic. We also publish this information so that defenders can use it defensively within their own networks and look for indicators of compromise.

As promised in The Hunt for IoT: The Growth and Evolution of Thingbots (volume 4), we have broadened the scope of attack data collected to include services routinely used by IoT devices (beyond telnet). Twenty of the top ports commonly used by IoT devices are profiled in this report. Here are the key findings from attack data collected from January 1 through June 30, 2018:

• IoT devices are now the number one attack target on the Internet, surpassing web and application servers, email servers, and databases (that shouldn’t be accessible on the Internet).
• As expected, telnet attacks are in decline as we think most of the IoT devices listening on port 23 have already been swept up in existing thingbots.
• March saw a large spike in attack traffic that targeted every port we are now tracking related to IoT. Given the industry breakdown of source traffic, 84% of which came from telecom companies, it’s likely this traffic is growth of existing thingbots running off of IoT devices inside telecom networks. 
• SSH brute force is the number one attack type targeting IoT devices, followed by telnet.
• IP addresses in Iran and Iraq that we haven’t previously seen attacking jumped into the Top 50 attacking IP addresses list.
• All (100%) of the top 50 attacking IP addresses were new in this period (five ASNs on the top 50 list have had offending IP addresses previously on the top 50 list; the IP addresses used in their networks for this period are new). In The Hunt for IoT, volume 4, we reported that 74% of the top attacking IP addresses were repeat offenders. (Did those infected systems finally get cleaned up, we wonder?)
• Spain was the top attacked (destination) country, receiving 80% of the period’s attacks. Spain has been the #1 attacked country for the past year and a half. Clearly, Spain has an IoT security problem.
• Brazil was the top attacking (source) country followed by China, Japan, Poland, and the US.

   

Introduction

Twelve billion new IoT devices are expected to be deployed by 2020. That is an astonishing number. What will these devices be doing? Roughly half of the world’s population has Internet access,¹⁵ so there is a lot of room to grow, which means we will continue to see more homes, businesses, and cities lit up with connectivity. We already have Internet-enabled dishwashers, ovens, toasters, fridges, and coffee makers. Verizon recently announced it is opening up 5G residential service that can serve speeds of up to 1 Gbps.¹⁶ That’s more than enough bandwidth to support every appliance in your kitchen; entertainment, lighting, and heating systems; smart TVs, gaming systems, DVRs, streaming TV sticks—and likely several computers. Imagine the attack size of a thingbot made from a 1 Gbps home router!

Drones will have their own air space assigned for package delivery and monitoring services. There will be more cameras watching traffic, people, buildings, and homes. Certain types of stores can become completely automated and cashier-less, like the Standard Market¹⁷ in San Francisco, which uses security cameras to watch what items customers pick up, and then charge them appropriately. The investment firm behind this operation estimates it will add this technology to 100 stores per month by 2020.

Compromising digital displays has been a popular IoT attack since Defcon in 1999 when hackers changed the hotel displays to show pornographic images. There are many cases of this same kind of hacktivism with freeway displays and digital signs on buildings. In 2016, Chinese hackers allegedly changed the digital displays in Vietnam’s two most popular airports to display propaganda about the South China Sea battle.¹⁸ The F5 Labs research project looking into cellular IoT gateways started with an infected airport display at one of the world’s busiest airports. That system had 39 threat actors actively connected who could have changed the airport displays but were instead using the system to launch other attacks. Just last month (September 14–15, 2018), cyber criminals attacked digital displays at the Bristol airport in the UK and installed ransomware. Airport officials chose to not pay the ransom and moved to manual operations for two days, which required handwritten flight schedules. Busier airports would likely not be able to function manually and would pay the ransom to get up and running faster.

Attackers have been busy discovering and infecting as many of those 8.4 billion things as they can. Thirteen thingbots were discovered in the first half of 2018 in comparison to six being discovered in all of 2017, and nine in 2016. We monitor the discovery of thingbots, what types of devices they infect, how they infect the devices, and what attacks they launch to discover patterns. Below is a profile of the 13 thingbots discovered in 2018:

1. VPN Filter¹⁹ collects credentials, install a network sniffer to monitor ICS protocols, and installs tor nodes.
2. Wicked²⁰ targets SOHO routers, CCTV, and DVRs, and installs SORA and OWARI, both of which are rentable bots.²¹ At the time of its discovery, Wicked was the tenth Mirai spinoff bot.
3. Roaming Mantis²² preys on WIFI routers as well as Android and iOS phones, and conducts DNS hijacks and mines cryptocurrency on compromised devices.
4. Omni²³ compromises GPON home routers to use for crypto-jacking or DDoS attacks.
5. UPnProxy²⁴ is sweeping up SOHO routers and installing proxy servers on them that bypass censorship controls; launch spam and phishing campaigns; conduct click fraud, account takeovers, and credit card fraud; launch DDoS attacks; install other bots; and distribute malware.
6. OWARI²⁵ compromises SOHO routers and is available as a multi-purpose attack bot for hire.
7. SORA²⁶ compromises SOHO routers and is available as a multi-purpose attack bot for hire.
8. DoubleDoor²⁷ targets SOHO routers behind Juniper home firewalls, then installs proxy servers from which an attacker can launch any attack of choice.
9. OMG²⁸ compromises SOHO routers, wireless IP cameras, and DVRs and then installs proxy servers from which the attacker can launch any attack of choice.
10. JenX²⁹ compromises SOHO routers and wireless chipsets from which to launch DDoS attacks. JenX is a DDoS-for-Hire services offering 300Gbps attacks for $20.00.
11. Hide’n Seek³⁰ compromises IP cameras. We don’t know what attacks it launches yet.
12. Pure Masuta³¹ compromises home routers. We don’t know what attacks it launches yet.
13. Masuta³² compromises home routers and launches DDoS attacks.

The most commonly infected IoT devices, as determined by their participation in bots, are SOHO routers followed by IP cameras, DVRs, and CCTVs.

The most common attack type is DDoS, however, in 2018 attackers shifted to multi-purpose attack bots that offer DDoS, among many other attack types, including installing proxy servers to launch any attack, crypto-jacking, installing tor nodes, packet sniffers, launching PDoS attacks, DNS hijacks, credential collection, credential stuffing, and fraud trojans.

The most common way attackers discover and eventually infect IoT devices with their malware has been through global Internet scans looking for the telent service being open. HNAP, UPnP, SOAP, and CVEs specific to an IoT device manufacuturer are becoming popular, and well as some TCP ports.

Perhaps the most concerning of all is that IoT infrastructure is just as vulnerable to authentication attacks via weak credentials as the IoT devices themselves. In the latest research that investigates cellular IoT devices, F5 Labs, in conjunction with our data partner Loryka, discovered that cellular IoT gateways are just as vulnerable as traditional wired and wireless IoT devices. In fact, 62% of the devices tested were vulnerable to remote access attacks exploiting weak vendor default credentials. These devices act as out-of-band networks, creating network back doors, and have widespread use across the globe.

Loryka has been in ongoing disclosures with over 350 impacted parties, including US city networks, police departments, public utilities, emergency services, SCADA networks, car manufacturers, industrial manufacturers, and major corporations for the past two years. Most of these disclosures received no response. These devices can be exploited and used within thingbots, most specifically, they have been used in Mirai and Reaper,³³ but they can also be used to spy, collect data with man-in-the-middle (MiTM) attacks, replace your DNS servers; they can be turned off or reprogramed, causing disruption to the services they are supporting; and they can be used in physical attacks consistent with warfare and terrorism.

Top 20 Attacked IoT Ports

Attacks were collected from the following top 20 services and ports commonly used by IoT devices to gain a big-picture view of IoT-targeted attacks around the world.

Table 1: Top 20 ports used by IoT devices

SSH port 22 brute force attacks are the #1 attack type globally, followed by port 80 http web traffic, telnet, SIP port 5060, and then the alternate http port 8080. IoT devices use all of these ports. Many IoT devices have shifted to SSH for remote administration instead of telnet. IoT devices such as SOHO routers, TVs, gaming consoles, and ICSs have been using port 80 for a while now. “Smart” TVs and gaming consoles regularly spin up web servers, which automatically open ports in SOHO routers or firewall using UPnP administration, so check yours! The thingbots Radiation,³⁴ Reaper,³⁵ and Wicked³⁶ all target HTTP ports 80, 81, and 8080.

The chart in Figure 6 compares the top five attacked services: SSH port 22, HTTP port 80, Telnet port 23, SIP port 5060, and the alternate HTTP port 8080. SSH is attacked 2.7 times more often than HTTP. Telnet and SIP are attacked at close to the same rate at HTTP. The fifth most attacked port, 8080, is an alternate HTTP port that is commonly used by SOHO routers, smart sprinklers, and Industrial Control Systems (ICS).

When you combine all the attacks against ports used by IoT devices and attribute a reasonable percentage of the attacks against SSH (20%), HTTP (15%), and SMTP (10%) to IoT attacks (we have no method for determining what percentage of systems using those services are IoT devices, so we made conservative assumptions), that number is greater than 50% of the total attacks. It is reasonable to conclude that “things” are the number one attacked system type on the Internet.Given the growth rate of IoT devices, we expect this to continue to be true and will be monitoring it going forward.

Telnet Attack Trend

Since the first two years of research for our Hunt for IoT report series focused on Telnet attacks, we want to continue showing you the attack trends to give you a picture of the changes in attack sources and destinations over time. (At some point, Telnet attacks will be so small they won’t be worth looking at.)

There was a large spike in attack traffic in March 2018 that drove a 94% decline in total attack volume from Q1 2018 to Q2 1018. We are still seeing more attacks against Telnet than when we started this research series in January 2016 but, as we have stated in the last two reports, we expect telnet attacks to trail off as IoT devices move to SSH for remote authentication.

Telnet Attacks Lead to Telnet Thingbots

The chart in Figure 8 compares the telnet attack data we have been collecting with the discovery of thingbots built from initial telnet attacks. We assume the large spikes in attacks are global Internet scans looking for available devices—“recon scans”—followed by targeted attacks that “build” the thingbot. You can see this “recon and build pattern” occur many times over the past two and a half years. The result is the development of at least 12 thingbots (see Figure 8). Worth noting that two of those thingbots—Hajime and Brickerbot—were bots that permanently destroyed IoT devices with the goal of making less IoT devices available for compromise, and ultimately attacking.

Top 10 Attack Destination Countries

Spain has been the number one attacked country since Q1 2017 and received 80% of the attack traffic launched between January 1 and June 30, 2018. Prior to its year and a half long hold as the #1 attacked country, Spain was in the #2 position during Q3 and Q4 2016. We double-checked that the attacks hitting Spain were also hitting other sensors all over the world, and they were. This tells us that the attacks were global and Spain simply had a higher rate of vulnerable responding assets. Clearly, Spain has an IoT security problem, however, we have not yet dedicated cycles to discovering exactly what systems and networks are impacted. If anyone would like to partner on Spain IoT research, please reach out to us!

Hungary has maintained a spot on the top 3 most attacked countries for the past year and a half. The other countries frequently on the top 3 list are the US, Russia, and Singapore.

Table 2: Top 10 attack destination countries over the past two years

Top 10 Attack Source Countries

Traffic originating in Brazil was responsible for the most attacks from January 1 to June 30, 2018 accounting for 18% of the period’s total attack traffic. Brazil typically has a position on the Top 10 attacking countries list but has not been in the top 5 (let alone in the #1 position) for the last two and a half years that we’ve been tracking the Hunt for IoT. Second to Brazil was China, a country that is consistently in the top 3 attack source countries and frequently holds the #1 position.

Attack traffic from Japan made a sizable jump from 1% of the total attack traffic from Q3 and Q4 2017 to 9% of the total attack traffic in Q1 and Q2 2018. Poland’s and Iran’s participation in Q1 and Q2 2018 was also noteworthy, considering both countries have only been on the top 10 list once in the past two and half years, both of which occurred in Q1 and Q2 2017 and accounted for less than 1% of the attacks launched.

Table 3: Top 10 attack source countries over the past two years

Top 50 Attacking IP Addresses

The following list of top 50 attacking IP addresses is in sequential order descending from the top attacking IP address to the least. All of the IP addresses on this list are new, meaning they have not been on the top 50 attacking list in any of our 4 prior reports going back two and a half years. This is a big change from previous reports where we consistently saw the same IP addresses over and over again in the top 50 list.

In Q3 and Q4 2017, 74% of the IP addresses were top attackers in prior reports, 66% of which had consistently been on the top attacking IP list for the two years prior. This consistency was our proof that “things” don’t get cleaned up, both because the devices typically reside in unmanaged and monitored networks, and they often can’t take firmware updates. It is encouraging that those IP addresses are not top attackers anymore! However, this new list is concerning. Either it means there are new top threat actors, or the threat actors are aware they are being watched and have moved their activities to new systems.

Other notable changes in this time period are the introduction of attacking IP addresses in Iran and Iraq.

Table 4: Top 50 attacking IP addresses

ASNs of the Top 50 Attacking IP Addresses

Forty of the 50 top attacking IP addresses belong to networks we have not seen attacking previously. Five ASNs on the top 50 list have had offending IP addresses previously on the top 50 list, however, not from the same IP addresses used in their networks during this period. Two networks have been consistently used for the past two and a half years: Chinanet and China Unicom.

The ASN that launched the most attacks from these top 50 IP addresses is AS56815, which belongs to Farakam Rayan Kish Co, an Iranian Telecom/ISP provider. Virtually all of the IP addresses on the list are identified in a Shodan search as MikroTik bandwidth test servers, which we believe to be a bandwidth testing app on consumer MicroTik routers. The use of MicroTik routers in the Reaper and VPNFilter thingbots has been widely reported. Attacks against these devices are covered in our top 20 attacked IoT ports, specifically 8291, shown in Figure 5.

Less is publicly available about the Iraq ASN Layth Zuhair Zahid. We believe it is an ISP, but because we cannot confirm that, we have listed its industry as unknown. Again, Shodan search results for that ASN turn up a lot of MicroTik routers, but nothing specific to the IP addresses in question.

Industries of Top 50 Attacking IP Addresses

The majority of attacks come from Telecom and ISP companies that provide Internet service to homes, small offices and building networks in which the majority of IoT devices reside. Once an IoT device is infected, it is used to scan for other IoT devices to infect—a distributed scanning model most thingbots adopt—and is also used to attack. Because of this, we expect to see Telecom/ISPs generate the majority of IoT attack traffic, and this has been consistently true for the past two and half years.

We believe anytime there is a noticeable increase in attack traffic coming from hosting providers, it indicates that attackers are developing new botnets. Attackers rent systems in bulletproof hosting centers to initiate the building of a botnet, and the build efforts are eventually taken over by the infected IoT devices in the Telecom networks. We saw sizeable attack traffic coming from hosting providers in Q3 and Q4 2016 (see Figure 13), and Q1 and Q2 2017 (see Figure 14).

Q3 and Q4 2017 (shown in Figure 15) was not a big period for hosting provider traffic, and neither was the most recent period of Q1 through Q2 2018 (refer to Figure 12). That could mean a few things. One hunch could be that new thingbot development targeting Telnet has slowed down, but it could also mean that new thingbot development is being initiated against other services commonly used by IoT, such as SSH or any of the other ports we listed previously. Given the spike in traffic across all ports (refer to Figure 5), we think the latter hunch is more likely what’s going on.

Global Mirai Infections

Despite Mirai’s infamous reputation as the most powerful thingbot to have launched an attack (as opposed to Reaper, which is more powerful but has not attacked), little has been accomplished to decrease its global footprint. The challenge with dismantling a thingbot is that many infected IoT devices are (1) not capable of taking firmware updates, (2) are owned or operated by people without the technical skills to secure them, or (3) exist within telecom companies that have little incentive to replace them or cut connectivity to infected devices as that would simultaneously terminate their services.

Since the Mirai source code became public, it has been forked at least 10 times in the form of Annie, Satori/Okiru, Persirai, Masuta, Pure Masuta, OMG, SORA, OWARI, Omni, and Wicked. Not only is the threat of the original bot still imminent, but there are at least 10 Mirai stepbrothers and stepsisters to worry about that do more than just launch DDoS attacks. Mirai stepsiblings also deploy proxy servers, mine crypto-currency, install other bots, and are available for rent.

Each dot on the map in Figure 16 represents the latitude and longitude coordinates of a Mirai-infected device. The red dots represent “scanner” nodes that search for other vulnerable IoT devices in which to infect and grow the bot. The yellow dots represent the “malware” hosting systems where the latest updates can be fetched.

The number of Mirai scanner systems across the world decreased slightly from December 2017 to June 2018. There is less concentration of scanner systems in North America, South America, and Asia in June 2018 versus December 2017. Europe is the only region where Mirai scanner infections remained relatively the same from December 2017 to June 2018.

There was a noticeable growth of Mirai malware systems (yellow dots) across the world since our last report covering Mirai growth through December 30, 2017. In December 2017, there were no Mirai malware systems in South America; now there are many. Several new malware systems have popped up across North America and Europe. There were only three Mirai malware systems in southeast Asia in December 2017; now there are at least two dozen. This growth in Mirai malware systems makes sense given the number of Mirai variants in the wild now.

Top 50 Attacked SSH Admin Credentials

We know IoT devices are exploited remotely through weak administrative credentials—typically, vendor defaults. These systems are also susceptible to brute force attacks. Because of this, we started publishing the list of top 50 attacked admin credentials in The Hunt for IoT: The Rise of Thingbots (volume 3) so everyone could ensure these credentials do not exist in their environments. For this report, we are expanding the list to top 100 attacked admin username and password combinations.

Not changing vendor default credentials is a critical mistake when deploying any system. Perhaps just as bad is vendors implementing simple default credentials in the first place. We are making attackers’ jobs too easy. “root:root”, “admin:admin”, “user:user”, “test:test” and “ubuntu:ubutu”—the top 5 most attacked admin credentials—should never be default credentials to begin with. Vendors should expect customers to deploy their products without changing these defaults and start off with something more complex. At a minimum, usernames and passwords should not be identical. Eighty-eight percent of the credentials in the top 50 most attacked list from January 1, 2018 through June 30, 2018 have the same username as the password as compared to 87% in the prior six-month period, and 96% in the six-month period before that.

Figure 18: Top 100 attacked admin credentials

Just for Fun: Keurig Attacks!

To prove that IoT security is abysmal and that attackers will find a way to use any “thing” (and because there is a Hyper Text Coffee Pot Control Protocol RFC2324³⁷—yes, really!), here are some attack logs from a Keurig coffee maker.

{ "_id" : {  "protocol" : "http", "timestamp" : { "$date" : "2018-07-19T20:31:04.000-0700" }, "source_ip" : "185.112.249.24", "session_http" : { "request" : { "body" : "", "header" : [ [ "accept", "*/*" ], [ "user-agent", "Keurig K575 Coffee Maker" ] ], "verb" : "GET", "path" : "/" } }, "source_port" : 56946, "destination_port" : 80, }

{ "_id" : { "protocol" : "http", "timestamp" : { "$date" : "2018-07-23T12:16:41.000-0700" }, "source_ip" : "185.112.249.24", "session_http" : { "request" : { "body" : "", "header" : [ [ "accept", "*/*" ], [ "user-agent", "Keurig K575 Coffee Maker" ] ], "verb" : "GET", "path" : "/" } }, "source_port" : 49180, "destination_port" : 80, }

{ "_id" : { "protocol" : "http", "timestamp" : { "$date" : "2018-07-25T10:04:52.000-0700" }, "source_ip" : "185.112.249.24", "session_http" : { "request" : { "body" : "", "header" : [ [ "accept", "*/*" ], [ "user-agent", "Keurig K575 Coffee Maker" ] ], "verb" : "GET", "path" : "/" } }, "source_port" : 40755, "destination_port" : 80, }

{ "_id" : { "protocol" : "http", "timestamp" : { "$date" : "2018-07-25T10:14:46.000-0700" }, "source_ip" : "185.112.249.24", "session_http" : { "request" : { "body" : "", "header" : [ [ "accept", "*/*" ], [ "user-agent", "Keurig K575 Coffee Maker" ] ], "verb" : "GET", "path" : "/" } }, "source_port" : 40755, "destination_port" : 80, }

{ "_id" : {"protocol" : "http", "timestamp" : { "$date" : "2018-07-28T06:29:53.000-0700" }, "source_ip" : "185.112.249.28", "session_http" : { "request" : { "body" : "", "header" : [ [ "accept", "*/*" ], [ "user-agent", "Keurig K575 Coffee Maker" ] ], "verb" : "GET", "path" : "/" } }, "source_port" : 50225, "destination_port" : 80, }

Conclusion

We have reached a point of no return when it comes to deployed IoT devices, their existing security standards (or lack thereof), and the inability to do anything about their security worldwide. We are stuck with the over 8 billion deployed devices around the world that, for the most part, prioritize access convenience over security. We don’t know what percentage of the 8+ billion IoT devices are vulnerable, but the percentage of vulnerable of cellular gateways—62%—“protecting” critical systems like police cars, firetrucks, and airport operations is a good metric to start with. Theoretically, security increases with the criticality of the system, and you could assume that more attention would have been paid to securing critical cellular gateways than home routers, IP cameras, and TVs. But 62% of the total IoT population is 5 billion devices. The additional 12 billion IoT devices that will be going live by 2020 were likely developed over the past few years with the same absence of security standards:

• Remote administration is open to the entire Internet (IP tables, ACLs, firewall rules not in place).
• Whether it’s SSH or Telnet, the administrator username and password is typically left as vendor default, which all attackers know (see Figure 18).
• Account lockouts after a certain number of failed login attempts is not set, so admin accounts can be brute-forced.
• Rate limiting, which could prevent DDoS attacks, is not in place.

   

Twelve billion new devices can’t go live on IPv4; there just simply isn’t enough IPv4 space left. Implementors will be forced to use NAT (which is a good thing), move to cellular and the further adoption of 5G, and move to IPv6, which will introduce additional complexity and security issues.

Organizations need to brace themselves for impact, because the attacker opportunity with IoT is virtually endless, and building thingbots is now popular. We expect the IoT attacks we are watching to be building new thingbots and growing the size of thingbots already discovered. Organizations need to be prepared for thingbot attacks by having security controls in place that can detect the bot and scale to the rate at which thingbots can attack. Having bot defense at your application perimeter is crucial, as well as having a scalable DDoS solution.

Attackers will eventually figure out what systems they are infecting, and then build purposeful bots. It’s important to keep in mind that, for the most part, attackers looking to build sizeable bots to launch attacks don’t know what types of systems they have taken over, or who owns them. It’s a numbers game—“who” and “what” is irrelevant to them. They are casting the widest net possible, to catch as many systems as possible, to make the most powerful bot possible. Sierra Wireless, the largest manufacturer of cellular IoT devices issued a Mirai alert, warned customers to reset their default admin credentials. One would assume they issued that alert because their devices were getting infected. Imagine attackers (operating any one of the 10 Mirai spinoff bots that we are aware of) purposely and consciously using their access to a police car to launch physically disruptive attacks instead of unknowingly using equipment in police cars to launch DDoS attacks? Attackers are smart, and the good ones love to automate. We expect them to fingerprint device types and customize their reconnaissance missions and scans to build purpose-built attack bots optimized by the types of devices they infect and what attacks those devices are best at. In the future, we expect:

• Crypto-jacking to rise on IoT systems that are good at processing data like SOHO routers, gaming consoles, and others.
• Ransomware attacks to grow against IoT systems controlling a critical function where the owner is more likely to pay the ransom (industrial control systems, airports, hospitals, casinos, ATMs, etc.).
• More targeting of IoT systems that are network back doors like cellular gateways (especially in fleet vehicles), HVAC systems, thermostats, IP cameras, vending machines, coffee makers—all the “things” you never think might have Internet access. Compromised devices are then used to spy and steal data and intellectual property (IP).
• Spyware targeting industrial control systems (could be foreign adversarial or friendly data gathering).
• Targeted warfare attacks against critical industrial control systems by nation-states, including physical attacks and spying.

It’s going to take material loss of revenue for IoT device manufacturers, or significant costs incurred by organizations who implement these devices before any meaningful IoT security is achieved. If and when the world wakes up and starts to demand stringent security for IoT devices, the availability of IoT systems to infect will decrease and make the attacker market more competitive. At that point, the attack-bot-for-hire cybercrime economy will mature where bots are valued based on the IoT device types in the bot and what attacks they are good for, similar to the way the stolen PII market matured when certain card types or IDs in certain countries were worth more than others.

For now, every company needs to prepare themselves for thingbot attacks, every business and government entity with IoT devices deployed should be securing them, and every person should be securing their home. The recommendations on what to do have been the same since we started this report series. Refer to the checklist in the conclusion of The Hunt for IoT: The Growth and Evolution of Thingbots (volume 4) for a comprehensive list.