IoT DDoS Attack

IoT Attack Simulation: A Practical Demonstration

Summary

This article presents a practical demonstration of an IoT-based attack, simulating a Distributed Denial of Service (DDoS) attack. The objective of this simulation is to understand the vulnerabilities in IoT devices and analyze their potential exploitation. Inspired by Mirai, the plan is to identify a vulnerable device by its IP address, infect it, and then use it to launch an attack on another device.

Attack Methodology

The attack simulation involves the following steps:

1. Perform a network scan to identify active devices within the network (inspired by the Carna botnet scanning method).
2. Execute a brute-force attack to gain unauthorized access to the identified IoT device.
3. Upload and execute a payload onto the compromised device to prepare for the attack.
4. Use the compromised IoT device to launch a UDP Flood attack targeting a specific server.
5. This attack should last for 30seconds and than stop by its self.

Experiment Setup

The experiment setup includes: Hardware: Raspberry Pi 2 as the attacking device This device was used as it simulated an IoT device and reflected the computational limitations of such devices.

Target server configured to monitor incoming traffic An Ubuntu Server 24.04.01 was deployed with 2 cores of an AMD Ryzen 5700u to simulate a desktop machine.

Software: Python scripts for scanning the network and executing brute-force attacks. A compiled C program to launch the UDP Flood attack. Network monitoring tools like Wireshark to observe the impact of the attack.

Description of the Process

1. **Scanning the Network:**

  Using Python, a network scan was conducted to detect active devices in the local subnet. Each device's IP address and open ports were recorded for further analysis.

  The following code snippet defines the `find_raspberry_pi` function, which scans the private network `192.168.1.0/24` and identifies the Raspberry Pi 2 by its MAC address prefix:

   def find_raspberry_pi():
       print("Scanning network...\n")
       nm = nmap.PortScanner()
       raspberry_mac_prefix = "B8:27:EB".lower()
       network_range = '192.168.1.0/24'

       # Conducting the scan
       nm.scan(hosts=network_range, arguments='-p 22,80,8080 -sS')
       raspberry_ip = None

       for host in nm.all_hosts():
           print(f"Scanning host {host}...")
           if 'addresses' in nm[host] and 'mac' in nm[host]['addresses']:
               mac_address = nm[host]['addresses']['mac'].lower()
               print(f"Host {host} has MAC address {mac_address}")
               if mac_address.startswith(raspberry_mac_prefix):
                   print(f"\nRaspberry Pi found: {host} with MAC address {mac_address}\n")
                   raspberry_ip = host

       print("\nScan complete.")
       input("\n[Press Enter to proceed with brute-force...]\n")
       return raspberry_ip

2. **Brute-Force Attack:**

  A script attempted to gain access to the Raspberry Pi via SSH using a dictionary attack. Upon successful authentication, the payload was uploaded to the device.

3. **Executing the Attack:**

  The payload was executed directly on the Raspberry Pi, targeting a designated server. The UDP Flood attack sent a high volume of packets over a duration of 30 seconds.

4. **Monitoring the Network:**

  This experiment was conducted under two conditions:
  1. Without resource limitations on the target device (Ubuntu server). 
  2. With network throttling applied to the target device to sumilate a stronger attack.

Findings

Under Condition 1 the attack occurred, but the server processed the traffic without significant disruption. It could handle the incoming packets and was able to be connected the whole time.

Unsuccessful attack

Under Condition 2, the attack significantly disrupted the server, causing packet loss and disconnections for logged-in users. Some packets were able to come througth. But none of the pings that were sent to the target.

Successful attack

Conclusion

This scenario is, of course, not at a level to execute actual attacks or pose any real-world threats. However, what it has impressively demonstrated is the capability to simulate an effective and practical IoT-based attack with minimal resources. Using less than 100 lines of code, the experiment replicated techniques employed by well-known botnets, such as Mirai and Carna, to highlight the simplicity and accessibility of such methods.

What makes this demonstration particularly striking is the low barrier to entry—leveraging common tools like Python and nmap alongside a Raspberry Pi, a device readily available and inexpensive. This underscores the reality that even basic hardware and software setups can exploit common IoT vulnerabilities, such as weak authentication mechanisms and open network ports.

While the attack itself was conducted under controlled and ethical conditions, it illustrates how quickly a targeted device could be identified, compromised, and weaponized to disrupt other systems. The experiment serves as a sobering reminder of the real-world risks posed by insecure IoT devices and the need for robust security measures to mitigate such threats.