Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai

Abstract

With the rise of IoT botnets, the remediation of infected devices has become a critical task. As over 87% of these devices reside in broadband networks, this task will fall primarily to consumers and the Internet Service Providers. We present the first empirical study of IoT malware cleanup in the wild-more specifically, of removing Mirai infections in the network of a medium-sized ISP. To measure remediation rates, we combine data from an observational study and a randomized controlled trial involving 220 consumers who suffered a Mirai infection together with data from honeypots and darknets. We find that quarantining and notifying infected customers via a walled garden, a best practice from ISP botnet mitigation for conventional malware, remediates 92% of the infections within 14 days. Email-only notifications have no observable impact compared to a control group where no notifications were sent. We also measure surprisingly high natural remediation rates of 58-74% for this control group and for two reference networks where users were also not notified. Even more surprising, reinfection rates are low. Only 5% of the customers who remediated suffered another infection in the five months after our first study. This stands in contrast to our lab tests, which observed reinfection of real IoT devices within minutes-a discrepancy for which we explore various different possible explanations, but find no satisfactory answer. We gather data on customer experiences and actions via 76 phone interviews and the communications logs of the ISP. Remediation succeeds even though many users are operating from the wrong mental model-e.g., they run antivirus software on their PC to solve the infection of an IoT device. While quarantining infected devices is clearly highly effective, future work will have to resolve several remaining mysteries. Furthermore, it will be hard to scale up the walled garden solution because of the weak incentives of the ISPs.

Poseidon: Mitigating Volumetric DDoS Attacks with Programmable Switches

“…As a result, it is important to increase the difficulty to obtain botnets and to reduce the costs to deploy defense countermeasures. Unfortunately, with the massive usage of vulnerable IoT devices and the emergence of various powerful botnets (e.g., Mirai [3], [13]), this balance is shifted towards attackers quickly and the Internet is stricken by storms of larger and larger DDoS attacks more and more frequently [63], [76], [83]. Although we can scale up the scrubbing capacity by adding more servers or proprietary middleboxes, doing so raises the capital cost and operational complexity, which is not symmetric to the rapid growth of attack traffic nowadays.…”

A Practical Approach for Taking Down Avalanche Botnets Under Real-World Constraints

“…Optionally, domains are also transferred to the "Registrar of Last Resort". Through sinkholing, law enforcement can then track how many and which infected hosts attempt to contact the domains [1] and aid in mitigation through notifications to network operators and infected users [22]. Domain seizures require a legal procedure such as a court order, while organizations could also request a takedown through a 'takedown notice' [42].…”

“…By using the mean, we do not attach any statistical meaning to the absence of data and do not skew the distribution. (19)(20)(21)(22)(30)(31)(32)(33)(34)(35)(36) are set to zero and binary feature values (23)(24)(25)(26)(27)(28)(29) to false as no data means that DNS records for the domain were never queried, suggesting unpopularity. Table IX presents the performance metrics of the machine learning algorithms that we evaluate in Section V-B, for a base ensemble model trained and tested on the initial 2017 iteration.…”

Data-driven Curation, Learning and Analysis for Inferring Evolving IoT Botnets in the Wild

“…Moreover, by means of applying filters to network telescope data in order to discern Mirai-relevant traffic, Antonakakis et al [5] were able to gather IoT-related information pertaining to roughly 1.2 million Mirai-infected IP addresses during 7 months, in addition to examining their associated detection-avoidance techniques. Cetin et al [12] conducted empirical studies on IoT malware cleanup efforts and remediation rates in a medium-sized Internet Service Provider (ISP) leveraging darknet and honeypot sources.…”