A Secure Contained Testbed for Analyzing IoT Botnets Many security issues have come to the fore with the increasingly widespread adoption of InternetofThings (IoT) devices. The Mirai attack on Dyn DNS service, in which vulnerable IoT devices such as IP cameras, DVRs and routers were infected and used to propagate largescale DDoS attacks, is one of the more prominent recent examples. IoT botnets, consisting of hundredsofthousands of bots, are currently present xe2x80x9cinthewildxe2x80x9d at least and are only expected to grow in the future, with the potential to cause significant network downtimes and financial losses to network companies. We propose, therefore, to build testbeds for evaluating IoT botnets and design suitable mitigation techniques against them. A DETERlabbased IoT botnet testbed is presented in this work. The testbed is built in a secure contained environment and includes ancillary services such as DHCP, DNS as well as botnet infrastructure including CnC and scanListenloading servers. Developing an IoT botnet testbed presented us with some unique challenges which are different from those encountered in nonIoT botnet testbeds and we highlight them in this paper. Further, we point out the important features of our testbed and illustrate some of its capabilities through experimental results.

Identifying and Characterizing Bashlite and Mirai C&C Servers IoT devices are often a vector for assembling massive botnets, as a consequence of being broadly available, having limited security protections, and significant challenges in deploying software upgrades. Such botnets are usually controlled by centralized CommandandControl (Cu0026C) servers, which need to be identified and taken down to mitigate threats. In this paper we propose a framework to infer Cu0026C server IP addresses using four heuristics. Our heuristics employ static and dynamic analysis to automatically extract information from malware binaries. We use active measurements to validate inferences, and demonstrate the efficacy of our framework by identifying and characterizing Cu0026C servers for 62% of 1050 malware binaries collected using 47 honeypots.