20 Billion IoT Devices In 2023 page 02 * Gemalto The State of - PowerPoint PPT Presentation

20 Billion IoT Devices In 2023 page 02 * Gemalto – The State of IoT Security

guidelines 79 % required breach 48 % exists? improve 62 % security page 03 * Gemalto – The State of IoT Security

Honeypot A honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. page 04 Source: – oswalpalash

Hardware Honeypot Remote Control Power Adapter Hardware Honeypot page 05

Hardware Honeypot page 06

Hardware Honeypot City Device Price Arch New York, USA Raspberry Pi $20 ARM San Jose, USA Netgear R6100 $55 MIPS Beijing, China BeagleBone $45 ARM Shenzhen, China Linksys WRT54GS $40 MIPS All above RCPA $30 - >$30/month Internet access fee page 07

System Architecture page 08

Software Honeypot High Fidelity Customizing QEMU configurations Proper CPU, memory, and peripheral configurations Masking sensitive system information Forge /proc/cpuinfo VM instances rearrangement Change IPs and providers page 09

Software Honeypot Evidence Collection CPU usage Process list Network packets page 010

Findings Deployment Overview page 011

Findings Geo-distribution 108 ~$6/month Jun. 2017 ~ Jun. 2018 page 012

Findings General Attacking Flows page 013

Findings Fileless Attack attacks that do not rely on malware files page 014

Findings Hardware 14.5M suspicious connections 1.6M effective attacks HTTP(S) Others Malware-based Attacks SMB 5.5% 2.5% 6.2% Fileless Attacks 46.9% 5.0% 85. 48.1% 8% Others page SSH / Telnet 015

Findings Software 249M suspicious connections 26.4M effective attacks SMB HTTP(S) Malware-based Attacks 3.2% 8.9% Others 55.3% 9.6% 78. 5.3% 39.4% 3% Fileless Attacks SSH / Telnet page page 016 016

Findings Less Fidelity 1100/day 670/day Public clouds may prevent certain types of attacks In-depth information may be used to infer the honeypots page 017

Findings Hardware page 018

Findings Software page 019

Findings Malware-based Attacks 598 27.3% 25.7% types ARM MIPS malware page 020

Findings Fileless Attacks 01 05 Occupying end systems Stealing data e.g., altering passwords e.g., reading the shadow file 02 06 Damaging system data Launching network attacks e.g., removing / altering e.g., sending malformed configurations HTTP requests 03 07 Preventing monitoring Other commands e.g., killing services e.g., who, lastlog 04 08 Retrieving system info No shell commands e.g., getting hardware e.g., SSH tunneling information attacks page 021

Findings SSH Tunneling Attack page 022

Findings New Security Challenges & Defense Directions 01 56.2%: modify the filesystem 02 99.7%: using shell commands 03 0.3%: no traces page 023

Findings New Security Challenges & Defense Directions page 024

Conclusions & Future Work 01 01 Build and deploy the Support of emerging IoT HoneyCloud system interfaces 02 02 First taxonomy for Robustness to the fileless IoT attacks interference of VM identity 03 In-depth analysis on advanced attacks page 025