IoT DDoS Attack - Revision history

JWildauer at 14:42, 16 December 2024

2024-12-16T14:42:37Z

← Older revision		Revision as of 14:42, 16 December 2024
Line 214:		Line 214:
	<references />		<references />

	[[Category:~~Documentations~~]]		[[Category:Documentation]]

JWildauer: JWildauer moved page User:JWildauer/IoT DDoSAttack to IoT DDoS Attack

2024-12-16T14:41:21Z

JWildauer moved page User:JWildauer/IoT DDoSAttack to IoT DDoS Attack

← Older revision	Revision as of 14:41, 16 December 2024
(No difference)

JWildauer at 14:40, 16 December 2024

2024-12-16T14:40:51Z

← Older revision		Revision as of 14:40, 16 December 2024
Line 213:		Line 213:
	== References ==		== References ==
	<references />		<references />

			[[Category:Documentations]]

JWildauer at 14:39, 16 December 2024

2024-12-16T14:39:59Z

← Older revision		Revision as of 14:39, 16 December 2024
Line 24:		Line 24:
	Python scripts for scanning the network and executing brute-force attacks.		Python scripts for scanning the network and executing brute-force attacks.
	A compiled C program to launch the UDP Flood attack.		A compiled C program to launch the UDP Flood attack.
	Network monitoring ~~tools like Wireshark~~ to observe the impact of the attack.		Network monitoring tool tcpdump to observe the impact of the attack.

	[[File:Practical_Demonstration.png\|center\|thumb\|Test Setup]]		[[File:Practical_Demonstration.png\|center\|thumb\|Test Setup]]

JWildauer at 14:39, 16 December 2024

2024-12-16T14:39:04Z

← Older revision		Revision as of 14:39, 16 December 2024
Line 25:		Line 25:
	A compiled C program to launch the UDP Flood attack.		A compiled C program to launch the UDP Flood attack.
	Network monitoring tools like Wireshark to observe the impact of the attack.		Network monitoring tools like Wireshark to observe the impact of the attack.

			[[File:Practical_Demonstration.png\|center\|thumb\|Test Setup]]

	== Description of the Process ==		== Description of the Process ==
Line 194:		Line 196:
	This experiment was conducted under two conditions:		This experiment was conducted under two conditions:
	1. Without resource limitations on the target device (Ubuntu server).		1. Without resource limitations on the target device (Ubuntu server).
	2. With network throttling applied to the target device to ~~sumilate~~ a stronger attack.		2. With network throttling applied to the target device to simulate a stronger attack.

	== Findings ==		== Findings ==

JWildauer at 11:30, 5 December 2024

2024-12-05T11:30:08Z

@@ Line 59: / Line 59: @@
 . **Brute-Force Attack:**
     A script attempted to gain access to the Raspberry Pi via SSH using a dictionary attack. Upon successful authentication, the payload was uploaded to the device.
 . **Executing the Attack:**
     The payload was executed directly on the Raspberry Pi, targeting a designated server. The UDP Flood attack sent a high volume of packets over a duration of 30 seconds.
 . **Monitoring the Network:**

JWildauer at 20:24, 3 December 2024

2024-12-03T20:24:12Z

← Older revision		Revision as of 20:24, 3 December 2024
Line 10:		Line 10:
	# Upload and execute a payload onto the compromised device to prepare for the attack.		# Upload and execute a payload onto the compromised device to prepare for the attack.
	# Use the compromised IoT device to launch a UDP Flood attack targeting a specific server.		# Use the compromised IoT device to launch a UDP Flood attack targeting a specific server.
			# This attack should last for 30seconds and than stop by its self.

	== Experiment Setup ==		== Experiment Setup ==
	The experiment setup includes:		The experiment setup includes:
	Hardware:		Hardware:
	* Raspberry Pi 2 as the attacking device		Raspberry Pi 2 as the attacking device
	This device was used as it simulated an IoT device and reflected the computational limitations of such devices.		This device was used as it simulated an IoT device and reflected the computational limitations of such devices.

	* Target server configured to monitor incoming traffic		Target server configured to monitor incoming traffic
	An Ubuntu Server 24.04.01 was deployed with 2 cores of an AMD Ryzen 5700u to simulate a desktop machine.		An Ubuntu Server 24.04.01 was deployed with 2 cores of an AMD Ryzen 5700u to simulate a desktop machine.

	Software:		Software:
	* Python scripts for scanning the network and executing brute-force attacks.		Python scripts for scanning the network and executing brute-force attacks.
	* A compiled C program to launch the UDP Flood attack.		A compiled C program to launch the UDP Flood attack.
	* Network monitoring tools like Wireshark to observe the impact of the attack.		Network monitoring tools like Wireshark to observe the impact of the attack.

	== Description of the Process ==		== Description of the Process ==
Line 64:		Line 65:
	4. Monitoring the Network:		4. Monitoring the Network:
	This experiment was conducted under two conditions:		This experiment was conducted under two conditions:
	1. Without resource limitations on the target device (Ubuntu server). ~~The~~ attack occurred, but the server processed the traffic without significant disruption.		1. Without resource limitations on the target device (Ubuntu server).
	~~2. With network throttling applied~~ to the ~~target device~~. ~~In this scenario~~, the attack significantly disrupted the server, causing packet loss and disconnections for logged-in users.		2. With network throttling applied to the target device to sumilate a stronger attack.

			== Findings ==
			Under Condition 1 the attack occurred, but the server processed the traffic without significant disruption. It could handle the incoming packets and was able to be connected the whole time.
			[[File:Attack1.png\|thumb\|center\|Unsuccessful attack]]
			Under Condition 2, the attack significantly disrupted the server, causing packet loss and disconnections for logged-in users. Some packets were able to come througth. But none of the pings that were sent to the target.
			[[File:Attack2.png\|thumb\|center\|Successful attack]]

			== Conclusion ==
			This scenario is, of course, not at a level to execute actual attacks or pose any real-world threats. However, what it has impressively demonstrated is the capability to simulate an effective and practical IoT-based attack with minimal resources. Using less than 100 lines of code, the experiment replicated techniques employed by well-known botnets, such as Mirai and Carna, to highlight the simplicity and accessibility of such methods.

			What makes this demonstration particularly striking is the low barrier to entry—leveraging common tools like Python and nmap alongside a Raspberry Pi, a device readily available and inexpensive. This underscores the reality that even basic hardware and software setups can exploit common IoT vulnerabilities, such as weak authentication mechanisms and open network ports.

			While the attack itself was conducted under controlled and ethical conditions, it illustrates how quickly a targeted device could be identified, compromised, and weaponized to disrupt other systems. The experiment serves as a sobering reminder of the real-world risks posed by insecure IoT devices and the need for robust security measures to mitigate such threats.

	== References ==		== References ==
	<references />		<references />

JWildauer: Created page with "= IoT Attack Simulation: A Practical Demonstration = == Summary == This article presents a practical demonstration of an IoT-based attack, simulating a Distributed Denial of Service (DDoS) attack. The objective of this simulation is to understand the vulnerabilities in IoT devices and analyze their potential exploitation. Inspired by Mirai, the plan is to identify a vulnerable device by its IP address, infect it, and then use it to launch an attack on another device. =..."

2024-12-03T19:57:52Z

Created page with "= IoT Attack Simulation: A Practical Demonstration = == Summary == This article presents a practical demonstration of an IoT-based attack, simulating a Distributed Denial of Service (DDoS) attack. The objective of this simulation is to understand the vulnerabilities in IoT devices and analyze their potential exploitation. Inspired by Mirai, the plan is to identify a vulnerable device by its IP address, infect it, and then use it to launch an attack on another device. =..."

New page

= IoT Attack Simulation: A Practical Demonstration =

== Summary ==
This article presents a practical demonstration of an IoT-based attack, simulating a Distributed Denial of Service (DDoS) attack. The objective of this simulation is to understand the vulnerabilities in IoT devices and analyze their potential exploitation. Inspired by Mirai, the plan is to identify a vulnerable device by its IP address, infect it, and then use it to launch an attack on another device.

== Attack Methodology ==
The attack simulation involves the following steps:
# Perform a network scan to identify active devices within the network (inspired by the Carna botnet scanning method<ref>https://census2012.sourceforge.net/paper.html</ref>).
# Execute a brute-force attack to gain unauthorized access to the identified IoT device.
# Upload and execute a payload onto the compromised device to prepare for the attack.
# Use the compromised IoT device to launch a UDP Flood attack targeting a specific server.

== Experiment Setup ==
The experiment setup includes:
**Hardware:**
* Raspberry Pi 2 as the attacking device
This device was used as it simulated an IoT device and reflected the computational limitations of such devices.

* Target server configured to monitor incoming traffic
An Ubuntu Server 24.04.01 was deployed with 2 cores of an AMD Ryzen 5700u to simulate a desktop machine.

**Software:**
* Python scripts for scanning the network and executing brute-force attacks.
* A compiled C program to launch the UDP Flood attack.
* Network monitoring tools like Wireshark to observe the impact of the attack.

== Description of the Process ==
1. **Scanning the Network:**
Using Python, a network scan was conducted to detect active devices in the local subnet. Each device's IP address and open ports were recorded for further analysis.

The following code snippet defines the `find_raspberry_pi` function, which scans the private network `192.168.1.0/24` and identifies the Raspberry Pi 2 by its MAC address prefix:

<syntaxhighlight lang="python">
def find_raspberry_pi():
print("Scanning network...\n")
nm = nmap.PortScanner()
raspberry_mac_prefix = "B8:27:EB".lower()
network_range = '192.168.1.0/24'

# Conducting the scan
nm.scan(hosts=network_range, arguments='-p 22,80,8080 -sS')
raspberry_ip = None

for host in nm.all_hosts():
print(f"Scanning host {host}...")
if 'addresses' in nm[host] and 'mac' in nm[host]['addresses']:
mac_address = nm[host]['addresses']['mac'].lower()
print(f"Host {host} has MAC address {mac_address}")
if mac_address.startswith(raspberry_mac_prefix):
print(f"\nRaspberry Pi found: {host} with MAC address {mac_address}\n")
raspberry_ip = host

print("\nScan complete.")
input("\n[Press Enter to proceed with brute-force...]\n")
return raspberry_ip
</syntaxhighlight>

2. **Brute-Force Attack:**
A script attempted to gain access to the Raspberry Pi via SSH using a dictionary attack. Upon successful authentication, the payload was uploaded to the device.

3. **Executing the Attack:**
The payload was executed directly on the Raspberry Pi, targeting a designated server. The UDP Flood attack sent a high volume of packets over a duration of 30 seconds.

4. **Monitoring the Network:**
This experiment was conducted under two conditions:
1. Without resource limitations on the target device (Ubuntu server). The attack occurred, but the server processed the traffic without significant disruption.
2. With network throttling applied to the target device. In this scenario, the attack significantly disrupted the server, causing packet loss and disconnections for logged-in users.

== References ==
<references />