NURSE: eNd-UseR IoT malware detection tool for Smart homEs

Abstract

IoT devices keep entering our homes with the promise of delivering more services and enhancing user experience; however, these new devices also carry along an alarming number of vulnerabilities and security issues. In most cases, the users of these devices are completely unaware of the security risks that connecting these devices entail. Current tools do not provide users with essential security information such as whether a device is infected with malware. Traditional techniques to detect malware infections were not meant to be used by the end-user and current malware removal tools and security software cannot handle the heterogeneity of IoT devices. In this paper, we design, develop, and evaluate a tool, called NURSE, to fill this information gap, i.e., enabling end-users to detect IoT-malware infections in their home networks. NURSE follows a modular approach to analyze IoT traffic as captured by means of an ARP spoofing technique which does not require any network modification or specific hardware. Thus, NURSE provides zeroconfiguration IoT traffic analysis within everybody's reach. After testing NURSE in 83 different IoT network scenarios with a wide variety of IoT device types, results show that NURSE identifies malware-infected IoT devices with high-accuracy (86.7%) using device network behaviour and contacted destinations. CCS CONCEPTS• Security and privacy → Intrusion/anomaly detection and malware mitigation; Usability in security and privacy.

Difficult for Thee, But Not for Me: Measuring the Difficulty and User Experience of Remediating Persistent IoT Malware

“…With the proliferation of IoT devices, now attackers are shifting to IoT persistent malware [6,9,59,63] since these devices have several advantages for attackers, like low computational capacity [36], thus they cannot count on protections such as antivirus which Windows systems do. The current state of the art has also learned about Mirai, a non-persistent IoT malware, that can be removed by rebooting the device and changing passwords [3,7,14,27,54], however, in this research we dealt with QSnatch, a malware, that needs convoluted steps from users to be remediated, and does not count on the same mechanisms for removal from Windows malware or Mirai.…”

Difficult for Thee, But Not for Me: Measuring the Difficulty and User Experience of Remediating Persistent IoT Malware

“…With the proliferation of IoT devices, now attackers are shifting to IoT persistent malware [8]- [11] since these devices have several advantages for attackers, like low computational capacity [48], thus they cannot count on protections such as antivirus which Windows systems do. The current state of the art has also learned about Mirai, a non-persistent IoT malware, that can be removed by rebooting the device and changing passwords [1], [6], [7], [24], [49], however, in this research we dealt with QSnatch, a malware, that needs convoluted steps from users to be remediated, and does not count on the same mechanisms for removal from Windows malware or Mirai.…”