# Understanding and Classifying Permanent Denial-of-Service Attacks
## 3 Case Studies of PDoS Attacks
### PaperW8  
PaperW8 [8] is a malware designed to cause PDoS in IoT via remote access. It gains access to an IoT device through an exposed telnet port with weak authentication or utilizing an existing exploit, such as command injection. Once PaperW8 has gained access, its next aim is to upload its dependencies using tftp, commonly present in IoT devices. PaperW8 can kill any service that communicate with the user to prevent the device from being used. It will also kill any vulnerable services that were used to exploit the device, such that neither the user nor other attackers will be able to use the same vulnerability to regain access. Finally, PaperW8 will execute the uploaded binaries, taking full control of the device.  
Finally, PaperW8 reads the bootloader partition into a buffer, encrypts it using AES-256-CBC, and then writes it back to the same partition, which will map the bootloader such that it will fail to boot if the device is restarted. This approach is similar to desktop-based ransomware that modify the MBR, such as Seftad and Petya. Affected devices include the following: HG532 Router (CVE-2017-17215 [16]), R6250 Router (CVE-2016-6277), MVPower DVR (using a backdoor shell), WiPG-1000 (CVE-2019-3929), 932L Camera (CVE-2019-10999), 5020L Camera (CVE-2019-10999).  
The impact on the device is instant, as it does not require the encryption of the entire disk, and permanent, as it cannot be repaired without a full factory recovery or device replacement.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt}} \hline \hline
**Malware** & **Year** & **Damage Mechanism** & **Impact Effect** & **Target Device** & **Target Software** & **Recovery Action** & **DoS Effect Duration** \\ \hline Commodore PET’s “Killer & 1970s & Hardware damage & Instant & PC & Firmware replacement & Device replacement & Temporary \\ Poke” & & & & & & & \\ \hline CIH/Chernobyl Virus [17] & 1998 & Bootloader corruption & Fast & PC & OS & Device replacement & Permanent \\ \hline TDL4 (TDSS/ Alureon) [3] & 2007 & Data-flow manipulation & Instant & PC, ICS & Firmware, OS & Factory reset & Temporary \\ \hline BlackEnergy [18, 19] & 2007 & Data encryption/deletion & Fast & ICS & Control logic & Factory reset & Temporary \\ \hline Stuxnet [20] & 2010 & Data-flow manipulation & Slow & ICS & Control logic & Physical restart & Temporary \\ \hline Olmasco [3] & 2011 & Data-flow manipulation & Slow & PC, ICS & Firmware, OS & Factory reset & Temporary \\ \hline Gapz [3] & 2012 & Bootloader corruption & Fast & PC & Firmware & Factory reset & permanent \\ \hline DarkSeoul [21] & 2012 & Data encryption/deletion & Instant & ICS & OS, Data replacement & Device replacement & Temporary \\ \hline StoneDrill [1] & 2012 & Data encryption/deletion & Instant & ICS & OS, Data replacement & Device replacement & Permanent \\ \hline Rovnix [3] & 2014 & Data-flow manipulation & Slow & PC & Firmware & Factory reset & Temporary \\ \hline Mamba [6] & 2016 & Data encryption/deletion & Instant & PC, ICS & OS, Data & Factory reset & Permanent \\ \hline Petya/NotPetya [15] & 2016 & Data encryption/deletion & Fast & PC & Firmware & Factory reset & Permanent \\ \hline KillDisk [18, 19] & 2016 & Data encryption/deletion & Instant & ICS & OS, Data replacement & Device replacement & Temporary \\ \hline Remaiten [7] & 2016 & Data encryption/deletion & Instant & IoT & Firmware & Factory reset & Permanent \\ \hline Amnesia [9] & 2017 & Data encryption/deletion & Instant & IoT & Firmware & Device replacement & Temporary \\ \hline \hline \end{tabular}
\end{table}
Table 1: Classification PDoS malware according to new framework.