Large-Scale IoT Devices Firmware Identification Based on Weak Password

Yu, Dan; Zhang, Lilong; Chen, Yongle; Ma, Yao; Chen, Junjie

doi:10.1109/access.2020.2964646

Cited by 16 publications

(9 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another subject receiving considerable attention within the literature is that of devising techniques to enumerate and identify marketed IoT devices or those that get easily compromised, i.e., identifying their type, and manufacturer [10,[35][36][37], firmware [38], in addition to an overall evaluation of device security for more and less popular IoT devices observed in the wild [39,40]. While some identification techniques may rely on the DNS behavior of IoT devices [41], others rely on their data flows [42,43].…”

Section: Related Workmentioning

confidence: 99%

Can ISPs Help Mitigate IoT Malware? A Longitudinal Study of Broadband ISP Security Efforts

Noroozian

Rodriguez

Lastdrager

et al. 2021

2021 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

For technical reasons the number of authors shown on this cover page is limited to a maximum of 10. * TU-Delft (Netherlands), † SIDN Labs (Netherlands), ‡ NICT (Japan)Abstract-For the mitigation of compromised Internet of Things (IoT) devices we rely on Internet Service Providers (ISPs) and their users. Given that devices are in the hands of their subscribers, what can ISPs realistically do? This study examines the effects of ISP countermeasures on infections caused by variants of the notorious Mirai family of IoT malware, still among the dominant families. We collect and analyze more than 4 years of longitudinal darknet data tracking Mirai-like infections in conjunction with threat intelligence data on various other IoT and non-IoT botnets across the globe from January 2016 to May 2020. We measure the effect of two ISP countermeasures on Mirai variant infection numbers: (i) reducing the attack surface (i.e., closing ports that are used by the malware for propagation) and (ii) ISPs increasing their general network hygiene and malware removal efforts (as observed by proxy of the remediation of infections of other families of IoT and non-IoT malware and reductions in the number of DDoS amplifiers in their networks). We map our infection data to 342 broadband providers that have the bulk of the broadband market share in their respective 83 countries. We find that the number of infections correlates strongly with the number of ISP subscribers (R 2 =0.55). Yet, infection numbers can still vary by three orders of magnitude even for ISPs with comparable subscriber numbers. We observe that many ISPs, together with their subscribers, have reduced their attack surface for IoT compromise by blocking traffic to commonly-exploited infection vectors such as Telnet and FTP. We statistically estimate the impact of these reductions on infection levels and, counter-intuitively, find no significant impact. In contrast, we do find a significant impact for improving general network hygiene and best malware mitigation practices. ISPs that were more successful in reducing DDoS amplifiers and non-Mirai malware infections in their networks also end up with significantly lower Mirai infection rates. In other words, rather than investing in IoT-specific countermeasures like reducing the attack surface, our findings suggest that ISPs might be better off investing in general security efforts to improve network hygiene and clean up abuse.

show abstract

Section: Related Workmentioning

confidence: 99%

Can ISPs Help Mitigate IoT Malware? A Longitudinal Study of Broadband ISP Security Efforts

Noroozian

Rodriguez

Lastdrager

et al. 2021

2021 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

show abstract

“…Footprinting. Dan Yu et al proposed a firmware identification method by analyzing web pages content [17]. e features of the login page of a device is extracted to identify the device type and brand and then use classification and page segmentation to identify the model and firmware version.…”

Section: Firmware Classification By Webmentioning

confidence: 99%

Compressed Firmware Classification Based on Extra Trees and Doc2Vec

Qiu

Geng

Sun

2021

Scientific Programming

View full text Add to dashboard Cite

Firmware formats vary from vendor to vendor, making it difficult to track which vendor or device the firmware belongs to, or to identify the firmware used in an embedded device. Current firmware analysis tools mainly distinguish firmware by static signatures in the firmware binary code. However, the extraction of a signature often requires careful analysis by professionals to obtain it and requires a significant investment of time and effort. In this paper, we use Doc2Vec to extract and process the character information in firmware, combine the file size, file entropy, and the arithmetic mean of bytes as firmware features, and implement the firmware classifier by combining the Extra Trees model. The evaluation is performed on 1,190 firmware files from 5 router vendors. The accuracy of the classifier is 97.18%, which is higher than that of current approaches. The results show that the proposed approach is feasible and effective.

show abstract

“…d) Difficult identification:So as to be linked with the IoT, the objects are identification [31]. The accessibility to these "armies" of objects, the administration of these ISSN 2250-3153 This publication is licensed under Creative Commons Attribution CC BY.…”

Section: Rq 3: What Are the Security Issues Of Iot That Arementioning

confidence: 99%

A Systematic Literature Review: Blockchain Based Solutions for IoT’s

Hassan¹,

Chen²,

Afrasayab³

et al. 2020

IJSRP

View full text Add to dashboard Cite

In the modern era, Internet of things brought revolution in the everyday life activities by automation in everyday functions, modifying the approach of people to collaborate with one another or with the devices. Actually, the main feature of IoTs is direct device to device interrelationship. Their benefits range from little domestic devices to heavy industrial systems. Despite of numerous advantages of IoTs, their execution contains different issues mostly due to the severe substance of the functions by implement and because of their narrow computing abilities. Blockchain is the forthcoming annoying technology field that has achieved the attention of IoT sectors to tackle the problems by becoming encountered by themselves. In the article, the relevant issues in IoT field are pointed by us and then examined by the method how these issues can be resolved with the help of Blockchain features. Furthermore, we have also identified issues that appear while allocation of blockchain (BC) in Internet of things (IoTs).

show abstract

Large-Scale IoT Devices Firmware Identification Based on Weak Password

Cited by 16 publications

References 21 publications

Can ISPs Help Mitigate IoT Malware? A Longitudinal Study of Broadband ISP Security Efforts

Can ISPs Help Mitigate IoT Malware? A Longitudinal Study of Broadband ISP Security Efforts

Compressed Firmware Classification Based on Extra Trees and Doc2Vec

A Systematic Literature Review: Blockchain Based Solutions for IoT’s

Contact Info

Product

Resources

About