# Attacks on IoT: Side-Channel Power Acquisition Framework for Intrusion Detection
## 4 Attacks
### Brute Force
#### 4.2.1 SSH Brute-Force  
As briefly described, brute-force attacks seek to overwhelm the security mechanisms in place on a target. In the case of the testbed featured in this work, the weak security mechanism is a default username-password combination for the target device. Recent research has revealed that 15% of IoT device owners do not change default passwords. As a result, five passwords can give an attacker access to 10% of all IoT devices worldwide [42]. The port-scan reconnaissance attack revealed that the SSH service [41] was running on the target. SSH is a service which allows users to access remote computer systems securely. Equipped with this knowledge, the attacker will move to crack the SSH password. This form of brute force is akin to trial and error, where the attacker attempts many passwords, from a password list, against a known username. If the username is unknown, the attack can use two lists simultaneously, one with many possible usernames and the other with many possible passwords. Lists such as these can be readily found on the internet and come pre-installed on some security-focused Linux distributions such as, for instance, Kali. Once the password-cracking tool guesses the correct password, the attacker will have remote access to the device over SSH. If the user account compromised has admin or \"sudo\" permissions, this can have disastrous consequences. With such permissions, the attacker will have unhindered access to all files, access other users' files, change system settings and possibly gain entry to other devices on the same network that use the same username-password combination. Even on a standard user account, an attacker can exploit outdated and vulnerable programs on the device in a \"privilege-escalation\" attack to gain admin permissions. The parallelised network login cracker Hydra [51] was used to perform the SSH brute-force attack. The settings of the tool Hydra were varied to investigate the effect on the SSH brute-force side-channel power signature. Figure 4 shows the variation in the side-channel signature over various settings of \"t\" for both boards. In this case, the \"t\" setting controls the number of connections in parallel per target. A higher value of \"t\" and, thus, more connections in parallel, should result in a more significant signature for the attack. Other settings for the tool remained at their default. For these attacks, a chunk from the \"wordlist\" [52] \"Rockyou\" [53] was used. In cases where it was intended for Hydra not to find the correct password, the password to the testbed was not included in the wordlist. The correct password was included in the wordlist for experiments where the valid password was to be found. From studying Figure 4, it can be seen that the current signature, as expected, increases in amplitude and duration with higher settings of \"t\". Across \"t\" settings, the amplitude of the attack is greater or equal to that of the Bluetooth signature. With more than one connect in parallel, the brute-force signature completely dwarfs the normal behaviour for both devices, making the attack very obvious in the side-channel power data. It would be unlikely for an attacker to use one \"T1\", however, as this would take a considerable amount of time to complete. Notably, the signatures share many key features between the two boards, such as the shape of the attack signature and the duration of the attack. This makes an SSH brute-force attack easily recognisable, regardless of against which device it is being performed. The more powerful Raspberry Pi can sustain higher settings of \"t\" for longer than the DragonBoard (See \"t16\" and \"t32\" in Figure 4). This is likely because the Dragonboard is more optimised for much lower power applications, whereas the Raspberry Pi has fewer limitations on its performance.