Beyond Telnet: Prevalence of IoT Protocols in Telescope and Honeypot Measurements
Beyond Telnet: Prevalence of IoT Protocols in Telescope and Honeypot Measurements
复制标题
超越 Telnet：物联网协议在望远镜和蜜罐测量中的流行
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
R. Sadre
中科院分区：
文献类型：
--
作者：
Lionel Metongnon;R. Sadre
随着物联网（IoT）的到来，越来越多的设备使用默认凭证或缺乏适当的安全协议。因此，在过去的几年里，我们看到了来自物联网设备的强大DDoS攻击的增加。在大多数情况下，设备通过telnet协议被僵尸恶意软件感染。这导致了一些关于基于telnet的攻击的蜜罐研究。然而，物联网安装还涉及其他协议，例如机器对机器通信。这些协议通常在默认情况下只提供很少的安全性。在本文中，我们提出了针对这些协议或基于这些协议的攻击的测量研究。为此，我们使用了从一个/15网络望远镜和三个蜜罐中获得的数据，这些蜜罐具有15个IPv4地址。我们发现基于telnet的恶意软件仍然被广泛使用，受感染的设备不仅用于DDoS攻击，还用于加密货币挖掘。我们还看到，尽管频率要低得多，但攻击者正在使用MQTT、CoAP、UPnP和HNAP寻找物联网特定服务，并且他们使用HTTP瞄准路由器和摄像机的漏洞。
With the arrival of the Internet of Things (IoT), more devices appear online with default credentials or lacking proper security protocols. Consequently, we have seen a rise of powerful DDoS attacks originating from IoT devices in the last years. In most cases the devices were infected by bot malware through the telnet protocol. This has lead to several honeypot studies on telnet-based attacks. However, IoT installations also involve other protocols, for example for Machine-to-Machine communication. Those protocols often provide by default only little security. In this paper, we present a measurement study on attacks against or based on those protocols. To this end, we use data obtained from a /15 network telescope and three honey-pots with 15 IPv4 addresses. We find that telnet-based malware is still widely used and that infected devices are employed not only for DDoS attacks but also for crypto-currency mining. We also see, although at a much lesser frequency, that attackers are looking for IoT-specific services using MQTT, CoAP, UPnP, and HNAP, and that they target vulnerabilities of routers and cameras with HTTP.
恶意物联网：关联主动和被动测量以推断和表征互联网规模的未经请求的物联网设备
影响因子：
11.2
作者：
Shaikh, Farooq;Bou-Harb, Elias;Neshenko, Nataliia;Wright, Andrea P.;Ghani, Nasir
通讯作者：
Ghani, Nasir