IoT DDoS Attack

IoT Attack Simulation: A Practical Demonstration

Summary

This article presents a practical demonstration of an IoT-based attack, simulating a Distributed Denial of Service (DDoS) attack. The objective of this simulation is to understand the vulnerabilities in IoT devices and analyze their potential exploitation. Inspired by Mirai, the plan is to identify a vulnerable device by its IP address, infect it, and then use it to launch an attack on another device.

Attack Methodology

The attack simulation involves the following steps:

1. Perform a network scan to identify active devices within the network (inspired by the Carna botnet scanning method).
2. Execute a brute-force attack to gain unauthorized access to the identified IoT device.
3. Upload and execute a payload onto the compromised device to prepare for the attack.
4. Use the compromised IoT device to launch a UDP Flood attack targeting a specific server.

Experiment Setup

The experiment setup includes:

• • Hardware:**
• Raspberry Pi 2 as the attacking device

This device was used as it simulated an IoT device and reflected the computational limitations of such devices.

• Target server configured to monitor incoming traffic

An Ubuntu Server 24.04.01 was deployed with 2 cores of an AMD Ryzen 5700u to simulate a desktop machine.

• • Software:**
• Python scripts for scanning the network and executing brute-force attacks.
• A compiled C program to launch the UDP Flood attack.
• Network monitoring tools like Wireshark to observe the impact of the attack.

Description of the Process

1. **Scanning the Network:**

  Using Python, a network scan was conducted to detect active devices in the local subnet. Each device's IP address and open ports were recorded for further analysis.

  The following code snippet defines the `find_raspberry_pi` function, which scans the private network `192.168.1.0/24` and identifies the Raspberry Pi 2 by its MAC address prefix:

   def find_raspberry_pi():
       print("Scanning network...\n")
       nm = nmap.PortScanner()
       raspberry_mac_prefix = "B8:27:EB".lower()
       network_range = '192.168.1.0/24'

       # Conducting the scan
       nm.scan(hosts=network_range, arguments='-p 22,80,8080 -sS')
       raspberry_ip = None

       for host in nm.all_hosts():
           print(f"Scanning host {host}...")
           if 'addresses' in nm[host] and 'mac' in nm[host]['addresses']:
               mac_address = nm[host]['addresses']['mac'].lower()
               print(f"Host {host} has MAC address {mac_address}")
               if mac_address.startswith(raspberry_mac_prefix):
                   print(f"\nRaspberry Pi found: {host} with MAC address {mac_address}\n")
                   raspberry_ip = host

       print("\nScan complete.")
       input("\n[Press Enter to proceed with brute-force...]\n")
       return raspberry_ip

2. **Brute-Force Attack:**

  A script attempted to gain access to the Raspberry Pi via SSH using a dictionary attack. Upon successful authentication, the payload was uploaded to the device.

3. **Executing the Attack:**

  The payload was executed directly on the Raspberry Pi, targeting a designated server. The UDP Flood attack sent a high volume of packets over a duration of 30 seconds.

4. **Monitoring the Network:**

  This experiment was conducted under two conditions:
  1. Without resource limitations on the target device (Ubuntu server). The attack occurred, but the server processed the traffic without significant disruption.
  2. With network throttling applied to the target device. In this scenario, the attack significantly disrupted the server, causing packet loss and disconnections for logged-in users.