IoT Malware - Revision history

AVujisic at 00:45, 15 December 2024

2024-12-15T00:45:48Z

← Older revision		Revision as of 00:45, 15 December 2024
Line 149:		Line 149:

	* '''Linux.Darlloz''': Linux.Darlloz is a worm that focuses on old Linux-Systems like routers and Set-Top-Boxes, especially those with Intel architecture. The worm exploits the PHP vulnerability CVE-2012-1823 to execute remote code and it spreads by using default Telnet credentials. Symantec researchers claims that there are malicious binaries for multiple architectures. Linux.Darlloz installed cpuminer to mine cryptocurrency like Dogecoin or Bitcoins.<ref name="linux.darlloz2024">"Linux.Darlloz worm attacks embedded systems" - available under: https://boingboing.net/2013/11/28/linux-darlloz-worm-attacks-emb.html - Retrieved 2024-12-15.</ref> <ref name="hackernews_linux.darlloz2024">"Linux Worm targets Internet-enabled Home appliances to Mine Cryptocurrencies" - available under: https://thehackernews.com/2014/03/linux-worm-targets-internet-enabled.html - Retrieved 2024-12-15.</ref>		* '''Linux.Darlloz''': Linux.Darlloz is a worm that focuses on old Linux-Systems like routers and Set-Top-Boxes, especially those with Intel architecture. The worm exploits the PHP vulnerability CVE-2012-1823 to execute remote code and it spreads by using default Telnet credentials. Symantec researchers claims that there are malicious binaries for multiple architectures. Linux.Darlloz installed cpuminer to mine cryptocurrency like Dogecoin or Bitcoins.<ref name="linux.darlloz2024">"Linux.Darlloz worm attacks embedded systems" - available under: https://boingboing.net/2013/11/28/linux-darlloz-worm-attacks-emb.html - Retrieved 2024-12-15.</ref> <ref name="hackernews_linux.darlloz2024">"Linux Worm targets Internet-enabled Home appliances to Mine Cryptocurrencies" - available under: https://thehackernews.com/2014/03/linux-worm-targets-internet-enabled.html - Retrieved 2024-12-15.</ref>

			* '''Remaiten''': Remaiten is a Linux-based malware targeting routers and potentially other IoT devices, notable for its ability to spread efficiently and kill competing malware. It brute-forces Telnet credentials, determines the target's architecture by executing commands that reveal system details, such as parsing environment variables, and deploys the appropriate payload based on the identified architecture. Remaiten uses IRC for command-and-control communication, reports infection statuses, and even includes functionality to eliminate rival bots. Its modular design supports various platforms, making it a significant threat to embedded devices running outdated or insecure software.<ref name="remaiten2024">"Meet Remaiten - a Linux bot on steroids targeting routers and potentially other IoT devices" - available under: https://www.welivesecurity.com/2016/03/30/meet-remaiten-a-linux-bot-on-steroids-targeting-routers-and-potentially-other-iot-devices/ - Retrieved 2024-12-15.</ref>


	[[Category:Basic]]		[[Category:Basic]]

AVujisic at 00:33, 15 December 2024

2024-12-15T00:33:42Z

← Older revision		Revision as of 00:33, 15 December 2024
Line 147:		Line 147:

	* '''Linux.Wifatch''': Linux.Wifatch is an atypical Malware which protects routers from botnets and other threats. It spreads via Telnet with default passwords and forces the user to update and change the credentials. With possible altruistic motives, it is also said to be directed against state surveillance such as that of the NSA. Despite its protective nature, it remains a security risk as users lose control of their devices. Experts recommend removal and better protective measures such as firmware updates and secure passwords.<ref name="linux.wifatch2024">"Defending You From Other Malware" - available under: https://securityintelligence.com/news/linux-wifatch-the-router-virus-that-may-be-secretly-defending-you-from-other-malware/ - Retrieved 2024-12-15.</ref>		* '''Linux.Wifatch''': Linux.Wifatch is an atypical Malware which protects routers from botnets and other threats. It spreads via Telnet with default passwords and forces the user to update and change the credentials. With possible altruistic motives, it is also said to be directed against state surveillance such as that of the NSA. Despite its protective nature, it remains a security risk as users lose control of their devices. Experts recommend removal and better protective measures such as firmware updates and secure passwords.<ref name="linux.wifatch2024">"Defending You From Other Malware" - available under: https://securityintelligence.com/news/linux-wifatch-the-router-virus-that-may-be-secretly-defending-you-from-other-malware/ - Retrieved 2024-12-15.</ref>

			* '''Linux.Darlloz''': Linux.Darlloz is a worm that focuses on old Linux-Systems like routers and Set-Top-Boxes, especially those with Intel architecture. The worm exploits the PHP vulnerability CVE-2012-1823 to execute remote code and it spreads by using default Telnet credentials. Symantec researchers claims that there are malicious binaries for multiple architectures. Linux.Darlloz installed cpuminer to mine cryptocurrency like Dogecoin or Bitcoins.<ref name="linux.darlloz2024">"Linux.Darlloz worm attacks embedded systems" - available under: https://boingboing.net/2013/11/28/linux-darlloz-worm-attacks-emb.html - Retrieved 2024-12-15.</ref> <ref name="hackernews_linux.darlloz2024">"Linux Worm targets Internet-enabled Home appliances to Mine Cryptocurrencies" - available under: https://thehackernews.com/2014/03/linux-worm-targets-internet-enabled.html - Retrieved 2024-12-15.</ref>


	[[Category:Basic]]		[[Category:Basic]]

AVujisic at 00:15, 15 December 2024

2024-12-15T00:15:45Z

← Older revision		Revision as of 00:15, 15 December 2024
Line 145:		Line 145:

	* '''Gitpaste-12''': Detected by Juniper Threat Labs in October 2020, Gitpaste-12 is a sophisticated botnet that uses GitHub and Pastebin for hosting its components. Named for its use of 12 known vulnerabilities, Gitpaste-12 is designed to attack Linux servers and IoT devices, leveraging exploits in popular open-source components like Apache Struts and mongoDB. The malware sets up cron jobs for persistence and employs various methods, including a Monero cryptocurrency miner, brute-force attacks, and reverse shells. Gitpaste-12’s ability to use trusted sites for hosting and its varied attack vectors make it a significant threat. The malware's development indicates ongoing efforts to evolve its capabilities, highlighting the importance of vigilance in software supply chain security.<ref name="NHSDigital2024b">"Cyber Alerts 2020 CC-3663" - available under: https://digital.nhs.uk/cyber-alerts/2020/cc-3663 - Retrieved 2024-01-05.</ref> <ref name="BleepingComputer2024">"Gitpaste-12 Worm Botnet Returns with 30+ Vulnerability Exploits" - available under: https://www.bleepingcomputer.com/news/security/gitpaste-12-worm-botnet-returns-with-30-plus-vulnerability-exploits/ - Retrieved 2024-01-05.</ref>		* '''Gitpaste-12''': Detected by Juniper Threat Labs in October 2020, Gitpaste-12 is a sophisticated botnet that uses GitHub and Pastebin for hosting its components. Named for its use of 12 known vulnerabilities, Gitpaste-12 is designed to attack Linux servers and IoT devices, leveraging exploits in popular open-source components like Apache Struts and mongoDB. The malware sets up cron jobs for persistence and employs various methods, including a Monero cryptocurrency miner, brute-force attacks, and reverse shells. Gitpaste-12’s ability to use trusted sites for hosting and its varied attack vectors make it a significant threat. The malware's development indicates ongoing efforts to evolve its capabilities, highlighting the importance of vigilance in software supply chain security.<ref name="NHSDigital2024b">"Cyber Alerts 2020 CC-3663" - available under: https://digital.nhs.uk/cyber-alerts/2020/cc-3663 - Retrieved 2024-01-05.</ref> <ref name="BleepingComputer2024">"Gitpaste-12 Worm Botnet Returns with 30+ Vulnerability Exploits" - available under: https://www.bleepingcomputer.com/news/security/gitpaste-12-worm-botnet-returns-with-30-plus-vulnerability-exploits/ - Retrieved 2024-01-05.</ref>

			* '''Linux.Wifatch''': Linux.Wifatch is an atypical Malware which protects routers from botnets and other threats. It spreads via Telnet with default passwords and forces the user to update and change the credentials. With possible altruistic motives, it is also said to be directed against state surveillance such as that of the NSA. Despite its protective nature, it remains a security risk as users lose control of their devices. Experts recommend removal and better protective measures such as firmware updates and secure passwords.<ref name="linux.wifatch2024">"Defending You From Other Malware" - available under: https://securityintelligence.com/news/linux-wifatch-the-router-virus-that-may-be-secretly-defending-you-from-other-malware/ - Retrieved 2024-12-15.</ref>


	[[Category:Basic]]		[[Category:Basic]]

NKirnbauer: fixed link

2024-11-04T22:21:01Z

fixed link

← Older revision		Revision as of 22:21, 4 November 2024
Line 34:		Line 34:

	==== Priorities ====		==== Priorities ====
	# '''Availability''': Crucial for time-sensitive functions in medical or industrial applications.<ref name=”RE4”>"Number of Connected IoT Devices" - available under: https://~~iotanalytics~~.com/number-connected-iot-devices - Retrieved 2023-12-23.</ref>		# '''Availability''': Crucial for time-sensitive functions in medical or industrial applications.<ref name=”RE4”>"Number of Connected IoT Devices" - available under: https://iot-analytics.com/number-connected-iot-devices - Retrieved 2023-12-23.</ref>
	# '''Integrity''': Vital to avoid malfunctions and misinterpretations in critical decision-making scenarios.		# '''Integrity''': Vital to avoid malfunctions and misinterpretations in critical decision-making scenarios.
	# '''Confidentiality''': Important but often considered less critical than availability and integrity.<ref name=”RE5”>"IoT Security: Threats and Solutions Report 2020" - available under: https://iot-analytics.com/iot-security-threats-and-solutions-report-2020/ - Retrieved 2023-12-23.</ref>		# '''Confidentiality''': Important but often considered less critical than availability and integrity.<ref name=”RE5”>"IoT Security: Threats and Solutions Report 2020" - available under: https://iot-analytics.com/iot-security-threats-and-solutions-report-2020/ - Retrieved 2023-12-23.</ref>

NKirnbauer: expired link changed with link from wayback machine

2024-08-28T16:47:50Z

expired link changed with link from wayback machine

← Older revision		Revision as of 16:47, 28 August 2024
Line 89:		Line 89:

	==== Attack Methods ====		==== Attack Methods ====
	* '''DDoS Attacks''': Overload resources to make them inaccessible. Examples: Mirai, Kaiji. <ref name="CENSIS2024">"Cyber security common attack methods" - available under: https://censis.org.uk/what-we-do/sensing-imaging-iot/internet-of-things-iot/cyber-security-common-attack-methods/ - Retrieved 2024-01-05.</ref>		* '''DDoS Attacks''': Overload resources to make them inaccessible. Examples: Mirai, Kaiji. <ref name="CENSIS2024">"Cyber security common attack methods" - available under: http://web.archive.org/web/20231129081357/https://censis.org.uk/what-we-do/sensing-imaging-iot/internet-of-things-iot/cyber-security-common-attack-methods/ - Retrieved 2024-01-05.</ref>
	* '''Coin Mining''': Malware like Fritzfrog and Satori use compromised IoT devices for cryptocurrency mining.		* '''Coin Mining''': Malware like Fritzfrog and Satori use compromised IoT devices for cryptocurrency mining.
	* '''Spamming''': ProxyM uses infected devices for spamming.		* '''Spamming''': ProxyM uses infected devices for spamming.

CFedrizzi at 10:34, 5 January 2024

2024-01-05T10:34:46Z

← Older revision		Revision as of 10:34, 5 January 2024
Line 60:		Line 60:
	==== Worms ====		==== Worms ====
	Self-propagating malware that spreads autonomously within IoT devices. Examples include Mirai, Darlloz, Brickerbot, and Gitpaste-12. Notably, Hajime, a WhiteHat malware, can counteract other malware, offering a unique perspective on IoT malware functionality. <ref name=”RE6”>"A survey of IoT malware and detection methods based on static features" - available under: https://www.sciencedirect.com/science/article/pii/S2405959520300503 - Retrieved 2023-12-23.</ref>		Self-propagating malware that spreads autonomously within IoT devices. Examples include Mirai, Darlloz, Brickerbot, and Gitpaste-12. Notably, Hajime, a WhiteHat malware, can counteract other malware, offering a unique perspective on IoT malware functionality. <ref name=”RE6”>"A survey of IoT malware and detection methods based on static features" - available under: https://www.sciencedirect.com/science/article/pii/S2405959520300503 - Retrieved 2023-12-23.</ref>


	==== Trojans ====		==== Trojans ====
Line 81:		Line 80:
	==== Command-and-Control (C&C) ====		==== Command-and-Control (C&C) ====
	A centralized structure that commands bots via communication protocols like Internet Relay Chat or Hypertext Transfer Protocol. Its simplicity makes it common, but its central server is also a vulnerability. Examples include Mirai, Aidra, and Okane. <ref name="Victor2023">Victor, P., Lashkari, A.H., Lu, R. et al. "IoT malware: An attribute-based taxonomy, detection mechanisms and challenges." Peer-to-Peer Netw. Appl. 16, 1380–1431 (2023). Available at: https://doi.org/10.1007/s12083-023-01478-w - Retrieved 2024-01-05.</ref>		A centralized structure that commands bots via communication protocols like Internet Relay Chat or Hypertext Transfer Protocol. Its simplicity makes it common, but its central server is also a vulnerability. Examples include Mirai, Aidra, and Okane. <ref name="Victor2023">Victor, P., Lashkari, A.H., Lu, R. et al. "IoT malware: An attribute-based taxonomy, detection mechanisms and challenges." Peer-to-Peer Netw. Appl. 16, 1380–1431 (2023). Available at: https://doi.org/10.1007/s12083-023-01478-w - Retrieved 2024-01-05.</ref>


	==== Peer-to-Peer (P2P) ====		==== Peer-to-Peer (P2P) ====

CFedrizzi at 10:34, 5 January 2024

2024-01-05T10:34:09Z

Show changes

CFedrizzi at 10:18, 5 January 2024

2024-01-05T10:18:48Z

← Older revision		Revision as of 10:18, 5 January 2024
Line 34:		Line 34:

	==== Priorities ====		==== Priorities ====
	# '''Availability''': Crucial for time-sensitive functions in medical or industrial applications.<ref name="~~IoT Analytics">{{Cite web\|title=~~Number of Connected IoT Devices~~\|url=~~https://iotanalytics.com/number-connected-iot-devices~~/\|access~~-~~date=~~2023-11-~~05}}~~</ref>		# '''Availability''': Crucial for time-sensitive functions in medical or industrial applications.<ref name=”RE4”>"Number of Connected IoT Devices" - available under: https://iotanalytics.com/number-connected-iot-devices - Retrieved 2023-12-23.</ref>
	# '''Integrity''': Vital to avoid malfunctions and misinterpretations in critical decision-making scenarios.		# '''Integrity''': Vital to avoid malfunctions and misinterpretations in critical decision-making scenarios.
	# '''Confidentiality''': Important but often considered less critical than availability and integrity. <ref>~~{{Cite web \|url=~~https://iot-analytics.com/iot-security-threats-and-solutions-report-2020/ ~~\|title=IoT Security: Threats and Solutions Report 2020 \|publisher=IoT Analytics \|access~~-~~date=~~2023-12-~~30}}~~</ref>		# '''Confidentiality''': Important but often considered less critical than availability and integrity.<ref name=”RE5”>"IoT Security: Threats and Solutions Report 2020" - available under: https://iot-analytics.com/iot-security-threats-and-solutions-report-2020/ - Retrieved 2023-12-23.</ref>


	==== Challenges ====		==== Challenges ====
	# '''Vulnerability Management''': Many IoT devices lack the capability for regular updates, leaving known security gaps unpatched.<ref name="~~F. Chantzis~~">~~{{Cite book\|author=F.~~ Chantzis~~\|title=~~Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things~~\|year=2021\|publisher=~~No Starch Press~~\|isbn=9781718500914\|url=https://books.google~~.~~at/books?id=GbYEEAAAQBAJ}}~~</ref>		# '''Vulnerability Management''': Many IoT devices lack the capability for regular updates, leaving known security gaps unpatched.<ref name="RE1">Fotios Chantzis, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>
	# '''Limited Resources''': Small form factors and low power consumption restrict computing capabilities, complicating the implementation of complex security measures like advanced encryption.		# '''Limited Resources''': Small form factors and low power consumption restrict computing capabilities, complicating the implementation of complex security measures like advanced encryption.
	# '''User Interface Limitations''': Lack of comprehensive user interfaces leads to a lower awareness of security settings and risks.		# '''User Interface Limitations''': Lack of comprehensive user interfaces leads to a lower awareness of security settings and risks.

CFedrizzi at 10:13, 5 January 2024

2024-01-05T10:13:21Z

CFedrizzi at 10:10, 5 January 2024

2024-01-05T10:10:38Z

← Older revision		Revision as of 10:10, 5 January 2024
Line 22:		Line 22:
	# '''Z-Wave''': Similar to Zigbee but operates on slightly different frequencies, commonly used in home automation.		# '''Z-Wave''': Similar to Zigbee but operates on slightly different frequencies, commonly used in home automation.
	# '''Bluetooth (including Low Energy)''': Best for short-range, low-energy applications like wearables and health monitors.		# '''Bluetooth (including Low Energy)''': Best for short-range, low-energy applications like wearables and health monitors.
	# '''6LoWPAN''': Facilitates IPv6 packet transmission over low-energy wireless networks, useful for devices with limited computing resources. <ref>{{Cite web \|url=https://iot-analytics.com/top-10-iot-segments-2020/ \|title=Top 10 IoT Segments in 2020 – Based on 1,600 Real IoT Projects \|publisher=IoT Analytics \|access-date=2023-12-30}}</ref>		# '''6LoWPAN''': Facilitates IPv6 packet transmission over low-energy wireless networks, useful for devices with limited computing resources. <ref>{{Cite web \|url=https://iot-analytics.com/top-10-iot-segments-2020/ \|title=Top 10 IoT Segments in 2020 – Based on 1,600 Real IoT Projects \|publisher=IoT Analytics \|access-date=2023-12-30}}</ref><ref name=”RE9”>"Top 10 IoT Segments in 2020 – Based on 1,600 Real IoT Projects" - available under: https://iot-analytics.com/top-10-iot-segments-2020/ - Retrieved 2023-12-17.</ref>

← Older revision		Revision as of 10:13, 5 January 2024
Line 2:		Line 2:

	=== Overview ===		=== Overview ===
	The Internet of Things (IoT) refers to the network of interconnected devices capable of collecting, exchanging, and analyzing data. Coined by Kevin Ashton in 1999, the concept has grown significantly over the years. By 2008, the number of connected devices surpassed the world population, reaching over 8 billion. IoT devices are employed in various sectors, including smart homes, healthcare, transportation, agriculture, and more. However, the convenience offered by these devices often overshadows their security risks. <ref>Fotios Chantzis, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>		The Internet of Things (IoT) refers to the network of interconnected devices capable of collecting, exchanging, and analyzing data. Coined by Kevin Ashton in 1999, the concept has grown significantly over the years. By 2008, the number of connected devices surpassed the world population, reaching over 8 billion. IoT devices are employed in various sectors, including smart homes, healthcare, transportation, agriculture, and more. However, the convenience offered by these devices often overshadows their security risks. <ref name="RE1">Fotios Chantzis, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>

	=== Types of Connected Devices in IoT ===		=== Types of Connected Devices in IoT ===
Line 13:		Line 13:
	# '''Medical and Healthcare''': Require robust security to protect sensitive patient data.		# '''Medical and Healthcare''': Require robust security to protect sensitive patient data.
	# '''Aviation and Telecommunications''': Demand reliable and secure IoT solutions to prevent catastrophic failures.		# '''Aviation and Telecommunications''': Demand reliable and secure IoT solutions to prevent catastrophic failures.
	# '''Agriculture and Livestock Management''': Benefit from IoT for efficiency but need protection against environmental factors and cyber threats. <ref>~~{{Cite web \|url=~~https://www.iotforall.com/5-key-iot-applications-in-smart-cities/ ~~\|title=5 Key IoT Applications in Smart Cities \|publisher=IoT For All \|access~~-~~date=~~2023-12-~~30}}~~</ref>		# '''Agriculture and Livestock Management''': Benefit from IoT for efficiency but need protection against environmental factors and cyber threats. <ref name=”RE2”>"5 Key IoT Applications in Smart Cities" - available under: https://www.iotforall.com/5-key-iot-applications-in-smart-cities/ - Retrieved 2023-12-17.</ref>


	==== Wireless Protocols ====		==== Wireless Protocols ====
	# '''Cellular (GSM, GPRS, 3G, 4G, LTE, 5G)''': Ideal for applications requiring mobility and remote connectivity.<ref>Fotios Chantzis, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>		# '''Cellular (GSM, GPRS, 3G, 4G, LTE, 5G)''': Ideal for applications requiring mobility and remote connectivity.<ref name="RE1">Fotios Chantzis, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>
	# '''Wi-Fi (IEEE 802.11)''': Suitable for building-based IoT applications, like smart home devices.		# '''Wi-Fi (IEEE 802.11)''': Suitable for building-based IoT applications, like smart home devices.
	# '''Zigbee''': A low-energy protocol, perfect for energy-efficient applications like smart home sensors.		# '''Zigbee''': A low-energy protocol, perfect for energy-efficient applications like smart home sensors.
	# '''Z-Wave''': Similar to Zigbee but operates on slightly different frequencies, commonly used in home automation.		# '''Z-Wave''': Similar to Zigbee but operates on slightly different frequencies, commonly used in home automation.
	# '''Bluetooth (including Low Energy)''': Best for short-range, low-energy applications like wearables and health monitors.		# '''Bluetooth (including Low Energy)''': Best for short-range, low-energy applications like wearables and health monitors.
	# '''6LoWPAN''': Facilitates IPv6 packet transmission over low-energy wireless networks, useful for devices with limited computing resources. <ref>{{Cite web \|url=https://iot-analytics.com/top-10-iot-segments-2020/ \|title=Top 10 IoT Segments in 2020 – Based on 1,600 Real IoT Projects \|publisher=IoT Analytics \|access-date=2023-12-30}}</ref><ref name=~~”RE9”~~>"Top 10 IoT Segments in 2020 – Based on 1,600 Real IoT Projects" - available under: https://iot-analytics.com/top-10-iot-segments-2020/ - Retrieved 2023-12-17.</ref>		# '''6LoWPAN''': Facilitates IPv6 packet transmission over low-energy wireless networks, useful for devices with limited computing resources. <ref name=”RE3”>"Top 10 IoT Segments in 2020 – Based on 1,600 Real IoT Projects" - available under: https://iot-analytics.com/top-10-iot-segments-2020/ - Retrieved 2023-12-17.</ref>