U-PoT: A Honeypot Framework for UPnP-Based IoT Devices

Abstract

The ubiquitous nature of the IoT devices has brought serious security implications to its users. A lot of consumer IoT devices have little to no security implementation at all, thus risking user's privacy and making them target of mass cyber-attacks. Indeed, recent outbreak of Mirai botnet and its variants have already proved the lack of security on the IoT world. Hence, it is important to understand the security issues and attack vectors in the IoT domain. Though significant research has been done to secure traditional computing systems, little focus was given to the IoT realm. In this work, we reduce this gap by developing a honeypot framework for IoT devices. Specifically, we introduce U-PoT: a novel honeypot framework for capturing attacks on IoT devices that use Universal Plug and Play (UPnP) protocol. A myriad of smart home devices including smart switches, smart bulbs, surveillance cameras, smart hubs, etc. uses the UPnP protocol. Indeed, a simple search on Shodan IoT search engine lists 1,676,591 UPnP devices that are exposed to public network. The popularity and ubiquitous nature of UPnPbased IoT device necessitates a full-fledged IoT honeypot system for UPnP devices. Our novel framework automatically creates a honeypot from UPnP device description documents and is extendable to any device types or vendors that use UPnP for communication. To the best of our knowledge, this is the first work towards a flexible and configurable honeypot framework for UPnP-based IoT devices. We released U-PoT under an open source license for further research on IoT security and created a database of UPnP device descriptions. We also evaluated our framework on two emulated deices. Our experiments show that the emulated devices are able to mimic the behavior of a real IoT device and trick vendor-provided device management applications or popular IoT search engines while having minimal performance ovherhead.

A comprehensive study of Mozi botnet

“…These devices are at risk of being used for attacks. 36,37 DNVRS-Webs is used for IoT devices, including webcams and DVRs, and its vulnerabilities also provide good opportunities for attackers. 38 In summary, we believe that the Mozi samples make full use of the ports and server vulnerabilities described above to attack and infect devices, making the Mozi botnet continue to expand.…”

Reputation Management Using Honeypots for Intrusion Detection in the Internet of Things

“…Similarly, Ref. [26] introduces a honeypot which uses Universal Plug and Play (UPnP) protocol. The honeypot is freely available under open-source license and it emulates real IoT devices.…”

On Using Application-Layer Middlebox Protocols for Peeking Behind NAT Gateways

“…Their results from 120,000 hosts indicated that merely 35 % had an UPnP enabled router. Related to our honeypot implementation, Hakim et al [30] introduced a concept of generating UPnP honeypots based on UPnP description files.…”