radware-IoT物联网攻击手册（英文版）-2018.12-47页-4mb

IoT Attack Handbook Summary

Core Content

The IoT Attack Handbook is a comprehensive guide to understanding the various attack vectors used by the Mirai botnet and its modern variants. It explores how these botnets exploit vulnerabilities in poorly secured IoT devices to launch large-scale DDoS attacks. The handbook provides a detailed analysis of each attack vector, including their characteristics, threat ranking, and how they are executed in a lab environment.

Main Points

• Mirai Botnet Overview:
  Mirai is an IoT botnet that was first released in 2016 and has been responsible for some of the most damaging DDoS attacks. It uses a variety of attack vectors to overwhelm targets, and its source code was made public, allowing others to create and modify botnets based on it.

• Attack Vectors:
  Mirai includes 10 attack vectors, with two partially written ones (Proxy and CFNull). These vectors are categorized into four groups: TCP, UDP, GRE, and APP. Each attack vector is analyzed for its behavior, packet size, bandwidth profile, and how it is executed.

• Threat Ranking:
  Each attack vector is ranked on a scale from 10 (most threatening) to 1 (least threatening), based on attack velocity, default behavior, and other factors. The ranking helps readers understand the potential impact of each attack.

• Lab Environment:
  The analysis uses Raspberry Pi 3 devices running Raspbian (Stretch) as test subjects. These devices are not inherently vulnerable to Mirai, but they are used to simulate the behavior of IoT devices in a controlled environment.

Key Information

Mirai Attack Vectors

Attack Details

• DNS Attack:
  Mirai's DNS attack sends a flood of random subdomain queries to a target's DNS server, bypassing the source IP. This attack is high in PPS and can overwhelm the authoritative DNS server, making it difficult to defend against without specific tools.

• VSE Attack:
  The VSE attack is tailored for Valve Source Engine game servers, typically targeting UDP port 27015. It mimics real game queries, making it challenging to distinguish from legitimate traffic. It is high in PPS and can quickly overwhelm a server.

• STOMP Attack:
  The STOMP attack uses a three-way TCP handshake followed by an ACK flood. It is designed to be an in-session attack and can be used to bypass some DDoS mitigation techniques. However, it may be detected by out-of-state (OOS) protections.

• GREETH Attack:
  This attack includes Layer 2 Ethernet frames and is based on Transparent Ethernet Bridging over GRE-encapsulated packets. It is high in both PPS and BPS, with a slightly smaller PPS than GREIP due to larger packet size.

• GREIP Attack:
  The GREIP attack is similar to GREETH but without the Layer 2 payload. It is a high BPS attack and can be used to generate a large volume of traffic.

• UDP and UDPPLAIN Attacks:
  These attacks are basic UDP floods and are optimized for higher PPS. They are effective due to their simplicity and high volume.

• SYN and ACK Attacks:
  These are traditional TCP flood attacks that exploit weaknesses in the TCP handshake process. They are less effective in terms of PPS but can still be damaging.

• HTTP Attack:
  The HTTP attack floods a target with HTTP requests, often targeting web servers. It is a basic attack but can still be used to overwhelm a target.

Defense Considerations

• Monitoring PPS:
  High PPS attacks like DNS and VSE can exhaust link throughput before BPS, so it is important to monitor PPS rates.

• Firewall Configuration:
  For GRE-based attacks, specific firewall rules are needed to account for the GRE protocol, as it is not TCP or UDP.

• Mitigation Techniques:
  The handbook emphasizes the importance of understanding each attack vector and implementing appropriate mitigation strategies, such as rate limiting, traffic filtering, and using specialized tools to detect and block specific attack patterns.

Conclusion

The IoT Attack Handbook serves as a valuable resource for understanding the evolution and impact of IoT-based DDoS attacks, particularly those originating from the Mirai botnet and its variants. It highlights the vulnerabilities in IoT devices and the potential for these attacks to cause significant disruption. By analyzing each attack vector in detail, the handbook aims to equip readers with the knowledge needed to defend against these threats effectively.