Identifying infected energy systems in the wild

Abstract

The 2016 Mirai outbreak established an entirely new mindset in the history of large-scale Internet attacks. A plethora of Mirai-like variants have emerged in the last two years that are capable to infiltrate any type of device. In this paper we provide a 7-month retrospective analysis of Internet-connected energy systems that are infected by Mirai-like malware variants. By utilizing network measurements from several Internet vantage points, we demonstrate that a number of energy systems on a global scale were infected during the period of our observation. While past works have studied vulnerabilities and patching practises of ICS and energy systems, little information has been available on actual exploits of such vulnerabilities. Hence, we provide evidence that energy systems relying on ICS networks are often compromised by vulnerabilities in non-ICS devices (routers, servers and IoT devices) which provide foothold for lateral network attacks. Our work offers a first look in compromised energy systems by malware infections, and offers insights on the lack of proper security practices for systems that are increasingly dependent on internet services and more recently the IoT. In addition, we indicate that such systems were infected for relatively large periods, thus potentially remaining undetected by their corresponding organizational units.

Profiling IoT Botnet Activity in the Wild

“…6, each scanner may scans a maximum of 15 ports with a minimum of 2 in every scanning session. Hence, in contrast with discussions (e.g., [6], [8]) on the full randomness of scanning strategies, we identify that even new Mirai variants have a carefully crafted and strategic scanning procedure.…”

“…The seminal study in [5] was the first to profile the original 2016 Mirai botnet outbreak and contributed towards the Internet-wide, AS-level analysis as well as the impact of shared source code which led to the proliferation of Mirai variants. Moreover, the work in [3] and [6] assessed the impact of Mirai-like variants on industrial control systems (ICS) and how Mirai-like variants exploit DNS records respectively. Nonetheless, all aforementioned studies didn't capture the modern scanning characteristics of new variants and in parallel did not provide a recent overview of the Mirai-like structural properties (i.e., centralised or P2P) as conducted in this work.…”

“…Based on the publicly released Mirai source code, any botnets underpinned by Mirai-like malware would aggressively and randomly scan on TCP ports 23 and 2323 [6]. Both ports are dedicated for the Telnet protocol, enabling remote connection to a given IoT device.…”

“…Since the 2016 Mirai outbreak where more than 550K IP-enabled DVRs were instrumented for a series of DDoS attacks and disrupted services almost across half of the global Internet [5], new Mirai-variants have emerged [6]. Efforts to analyse the dynamic properties of new Mirai-like variants are challenging and require a systematic and macroscopic view of the Internet in order to [1]- [3], [6]: (i) adequately inform corresponding governmental or industrial bodies and organisations in charge of infrastructure defense and (ii) equip next generation automated cyber threat intelligence (CTI), IDS and anomaly detection mechanisms with enriched information regarding evolving scanning, establishment and propagation strategies of new botnet variants.…”

Exposed Infrastructures: Discovery, Attacks and Remediation of Insecure ICS Remote Management Devices

“…The situation of cyberattacks against ICS has been investigated by monitoring devices, botnets, and globally deployed honeypots [2]. Marnerides et al reported that ICS networks were compromised due to non-ICS devices such as routers, servers, and IoT devices that were used as footholds for lateral movement [37].…”