IoT Cybersecurity
Now and Future
Katsunari Yoshioka
Yokohama National University
A part of this research was conducted in "MITIGATE" project among "Research and Development for Expansion of Radio Wave Resources(JPJ000254)", supported by the Ministry ofInternal Affairs and Communications (MIC), Japan. A part of this research was conducted in "WarpDrive" project, supported by National Institute of Information and Communications
Technology, Japan. A part of this research was supported by National Institute of Information and Communications Technology, Japan (05201).
1

Botnet & DDoS
Targeted Facilities
Insecure Cameras
2Mirai pandemic in 2016
1600000
1400000#IP /MONTH

1200000

Miraimalware
Pandemic

1000000
8000006000004000002000000# of accessors# of attackers

1.3MIPs/monthMirai pandemic in 2016
• Attacks from
Over 200
countries/regions• Especially Asian and SouthAmerican countries had
many infected devices

Categories of compromised devices observed by honeypot• Surveillance camera•– IP camera– DVR• Network devices– Router, Gateway– Modem, bridges– WIFI routers– Network mobile storage– Security appliances• Telephone– VoIP Gateways– IP Phone– GSM Routers– Analog phone adapters• Infrastructures– Parking management system– LED display controller

Devices are inferred by telnet/web banners•••

Control system– Solid state recorder– Sensors– Building control system (bacnet)
Home/individuals– Web cam, Video recorders– Home automation GW– Solar Energy Control System– Energy demand monitoring system
Broadcasting– Media broadcasting– Digital voice recorder– Video codec– Set-top-box,Etc– Heat pump
– Fire alert system– Medical device(MRI)– Fingerprint scanner

Variants, variants, variants…
• Early IoT attacks targeted Telnet service• Recently, we found 68 different vulnerabilities were exploited by IoT malware

68(old and new)vulnerabilities are
exploited by IoTmalware

Arwa Abdulkarim Al Alsadi, Kaichi Sameshima, Jakob Bleier, Katsunari Yoshioka, Martina
Lindorfer, Michel van Eeten, Carlos H. Ganan, "No Spring Chicken: Quantifying theLifespan of Exploits in IoT Malware Using Static and Dynamic Analysis," The 17th
6 ACM
ASIA Conference on Computer and Communications Security (ACM ASIACCS 2022), 2022.

IoT Ransom Attack!
We developed bare-metal NAS(Network Attached Storage)honeypot toobserve ransom attacks.

①vulnerability
exploits, weakcredentials

NAS②encrypt files
and leave ransom
note in every
folderYour files
havebeenlockedDarkweb
How to pay
Bitcoin:…

③Visit darkweb
for ransom
payment

7

Ransom notes

Leaves ransom note in every folder so that it
can be easily found by the victims

Encrypt all files

8

Payment instruction sites on darkweb

We continuously collect ransom instructions andbitcoin addresses for ransom payments

Instructions
on how to use
cryptocurrency to
pay ransom

Live chat support in case ofhelp is needed for payment
and decryption

Exposed Network Cameras!
http://insecam.org/10

Honeypot of exposed cameras

From NHK news, 2018/1/26

11

Observation results of honey camera# visitors/day

Number of visitors that access the honey camera
Sharp increase inthe number ofhosts

Camera A
Camera B

12

The honeycam was on Insecam…
• Many accesses via insecam were observed
GET /xxxxxxx/xxxxx?resolution=640&amp;quality=1&amp;
Language=0&amp;COUNTER HTTP/1.1
Referer: http://www.insecam.org/en/bycountry/JP/?page=4• We confirmed that honey camera was indeed registered to insecam
Peeps jumped to morethan 20,000 times per
day after the inclusion
in Insecam pageThe honeycamera!

13

Observing the misuses of credentials
1. Peeping

2. Access URL
3. Enter ID / Password

14

Access to the URL with bait credentials
Host that sent
the request

583

Access host using
domain of URL422

Login challenge
host

Host that entered
ID/password displayed oncamera A

235

217

• Observed access to the bait URL from 422 IP addresses
Humans are watching images of cameras• 217 IP address entered ID / password displayed on camera A
Some peepers go “beyond peeping” (login challenge)
Kazuki Tamiya, Aamir H. Bokhari, Yuta Ezawa, Sou Nakayama, Ying Tie, Rui Tanabe, Akira Fujita,
Katsunari Yoshioka, Tsutomu Matsumoto, "Dangers of IP Camera . An Observational Study on
Peeping," Journal of Information Processing, 202015

Camera operated by attackers

16Critical Systems!
Remote management devices are used for infrastructures such as water
facilities, power plants, and factories.
We focus on detecting exposed WebUIs of remote management devices.
Remote management
deviceWebUI
Mobile network
InternetAnalog/Digital IO
Modbus, etc.
PLCSensors
Actuators

Typical security flaw:
Access control is not adequately enforced,
and the WebUI is exposed to the Internet.
Takayuki Sasaki, Akira Fujita, Carlos Hernandez Ganan, Michel van Eeten, Katsunari
Yoshioka, Tsutomu Matsumoto, "Exposed Infrastructures: Discovery, Attacks andRemediation of Insecure ICS Remote Management Devices," Proc. 43rd IEEE
Symposium on Security and Privacy (IEEE S&P), 2022.

Example Case:

Waterworks Monitoring System

Example Case:

River Gate

Example Case：

Railway Signaling

20

Case:

Power Substation

Are these insecure facilitiesactually targeted?

22

Honey Facilities!
Fictitious facility name
(Japanese and English)

Manufacturer
nameImage of Data logger
Model number of Data logger

23

Critical infra system does attract attackers!

Remote monitoring
WebUI with Facility
name and Device image
Remote monitoring
WebUI with Device
image but no facility
nameRemote monitoring
WebUI with no device
image and no facility
name#visitors
per IP perDay
0.112

Average # Averagecommands duration ofvisit [s]
6.01
400

0.025

2.08

134

0.049

3.04

178

SimpleLogin Pagereporting
0.015
N/A
NHK news on
2023/3/4
IP cameras forrivermonitoring system being compromised

5.4

Post on hacking forum attracts
attackers (and security experts)
Date# visitors

Event

2018/08/31

Launch of honeypot

2019/12/08

New thread on the honeypot facility in hacking forum

2019/12/09# Attacks jump up (login challenges increased)
Notification from security vendor

2019/12/10

Notification from anonymous expert

2019/12/17

Notification from JPCERT/CC# Attacks jump up after a
new thread on a honeypot
facility started

25

Cybercrime as a service

26

IoT Botnet (DDoS, etc)
IoT botnet
code sale(DDoS bot)IoT Botnet
Selling
Finding IoT
Bot partner

AndroidBot
IoT botnet
code sale(Moobot)

Aurora bot
will add IoT
infection

IoT Proxy (selling hacked devices as proxies)

Residential
Proxy(proxies.black)••

Proxies.black• Popular among intruders• Forum says IoT devices• I did experiment
Shopsocks5.com• So many free proxies areshared in the hacker forums• We can check it too

Free andPaid Proxies

IoT Access (Selling hacked devices/system for moreintrusions)

Selling IoT
AccessFree IoTLogins

Summary• Insecurity of IoT devices has been already exploited for years. Thetrends likely continue as attackers are aware of this fundamental
insecurity coming from diversity and complex supply chains in theIoT industries.

• Cyber attacks on IoT devices are (and will be) a part of cyber crimebusiness.

• In warfare, cyber attacks are conducted as weapons (e.g., sweeperin Ukraine). We observe massive continuous reconnaissance overthe network, which would increase their impact.

30

Katsunari Yoshioka, Ph.D
Yokohama National University

Thank you!

yoshioka@ynu.ac.jp

http://yoshioka.ynu.ac.jp/For more, please visit:
IoTPOT: Honeypot for Revealing IoT Cyber Threats
https://sec.ynu.codes/iot
References:Takayuki Sasaki, Akira Fujita, Carlos Hernandez Ganan, Michel van Eeten, Katsunari Yoshioka, Tsutomu Matsumoto, "Exposed Infrastructures: Discovery, Attacks and Remediation of Insecure ICS Remote
Management Devices," 43rd IEEE Symposium on Security and Privacy, 2022.
Arwa Abdulkarim Al Alsadi, Kaichi Sameshima, Jakob Bleier, Katsunari Yoshioka, Martina Lindorfer, Michel van Eeten, Carlos H. Ganan, "No Spring Chicken: Quantifying the Lifespan of Exploits in IoT Malware Using
Static and Dynamic Analysis," The 17th ACM ASIA Conference on Computer and Communications Security (ACM ASIACCS 2022), 2022.
Seiya Kato, Rui Tanabe, Katsunari Yoshioka, Tsutomu Matsumoto, "Adaptive Observation of Emerging Cyber Attacks targeting Various IoT Devices," IFIP/IEEE International Symposium on Integrated NetworkManagement (IM), 2021.
Rui Tanabe, Tatsuya Tamai, Akira Fujita, Ryoichi Isawa, Katsunari Yoshioka, Tsutomu Matsumoto, Carlos Ganan and Michel Van Eeten, "Disposable Botnets: Examining the Anatomy of IoT Botnet Infrastructure,"Proc. International Conference on Availability, Reliability, and Security (ARES2020), 2020.
Kazuki Tamiya, Aamir H. Bokhari, Yuta Ezawa, Sou Nakayama, Ying Tie, Rui Tanabe, Akira Fujita, Katsunari Yoshioka, Tsutomu Matsumoto, "Dangers of IP Camera . An
Observational Study on Peeping," Journal of Information Processing, 2020
O. Cetin, C. Ganan, L. Altena, D. Inoue, T. Kasama, K. Tamiya, Y. Tie, K. Yoshioka, M. van Eeten, "Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai," TheNetwork and Distributed System Security Symposium (NDSS 2019), 2019.
Yin Minn Pa Pa, Suzuki Shogo, Katsunari Yoshioka, Tsutomu Matsumoto, Takahiro Kasama, Christian Rossow "IoTPOT: A Novel Honeypot for Revealing Current IoT Threats," Journal of Information Processing, Vol.
57, No. 4, 2016.
Yin Minn Pa Pa, Shogo Suzuki, Katsunari Yoshioka, and Tsutomu Matsumoto, Takahiro Kasama, Christian Rossow, "IoTPOT: Analysing the Rise of IoT Compromises," 9th USENIX Workshop on Offensive Technologies(USENIX WOOT 2015), 2015.

31