Contents
☑️ Overview
The advancement of wireless communication technologies like Wi-Fi, Bluetooth, and Zigbee has enabled seamless communication between IoT and embedded devices. While early IoT and embedded systems were limited to simple networked functions like smart thermostats and lighting systems, today they're increasingly prevalent across various industrial control systems - from smart security cameras and greenhouse systems to surveillance systems and drones.
These systems have become integral to modern IT environments by providing remote access and management capabilities. However, due to their relatively recent emergence and often insufficient security considerations during initial design phases, IoT and embedded systems have become attractive targets for hackers. This makes it crucial for everyday users to understand potential attack vectors and develop appropriate security strategies.
In this article, we'll explore the evolving attack techniques targeting IoT and embedded systems.
☑️ The Rapid Spread and Security Vulnerabilities of IoT and Embedded Systems
As mentioned, IoT and embedded systems are rapidly advancing across various sectors, from home appliances to industrial automation. However, these systems often prioritize functionality over security due to their design constraints - low power consumption, miniaturization, and closed architecture. This oversight makes them vulnerable targets for attackers.
☑️ Early IoT and Embedded System Attack Techniques
IP Camera
IP cameras offer convenient real-time video monitoring over the internet. However, like other early IoT devices, they can be vulnerable to remote hacking when security measures are inadequate.
In 2017, thousands of IP cameras were hacked, resulting in unauthorized online distribution of private footage. These breaches typically occur due to unchanged default passwords or exposed internet ports, allowing attackers to access camera feeds without authorization.
Even in 2024, we continue to see privacy breaches exploiting IP camera vulnerabilities. Given that attackers can view and record victims' private moments through these cameras, exceptional security precautions are essential.
Botnet
One of the most notable early IoT attacks involved large-scale DDoS (Denial of Service) attacks like the Mirai Botnet. A botnet is a network of "bot" devices that attackers can control remotely.
The Mirai Botnet is malware that converts IoT devices into remotely controlled "bot" or "zombie" devices. In 2016, Mirai infected vulnerable IoT devices to create a massive botnet, which was then used to launch DDoS attacks that paralyzed websites and servers. These botnets continue to evolve, with increasingly sophisticated attack methods emerging recently.
The operational mechanism of a botnet can be illustrated in the diagram below.
Ransomware
Ransomware is no longer limited to computer systems. It's malicious code that restricts system access and encrypts data, demanding a ransom for restoration.
In recent years, ransomware attacks targeting IoT and embedded systems have increased, with critical infrastructure like medical equipment and factory automation systems becoming prime targets.
☑️ Evolving Attack Techniques on IoT and Embedded Systems
NAS (Network Attached Storage)
A Network Attached Storage (NAS) device serves as a file server connected to a network, enabling data sharing across multiple PCs and mobile devices. Primarily deployed in home and business networks, it functions as a centralized storage solution for photos, documents, and other files. In essence, it operates as an accessible hard drive that can be reached from any location on the network.
In 2022, NAS devices faced significant security challenges with the emergence of CVE-2022-27593 and DeadBolt Ransomware. This ransomware specifically targeted the Photo Station package, a popular photo management application.
The attack sequence typically proceeded as follows:
Attackers created administrator-level accounts through Pre-Auth Command Injection
Gained system access via SSH
Executed ransomware operations (file encryption and ransom note distribution)
Analysis of security advisories reveals the vulnerabilities exploited by attackers. Key recommendations include disabling UPnP (Universal Plug and Play) ports and updating Photo Station to security-patched versions.
While UPnP facilitates automatic communication between internal network devices, its lack of security protocols presents significant risks. Evidence suggests attackers leveraged these vulnerabilities to gain unauthorized NAS access.
Let's examine the key changes between the vulnerable version of Photo Station and its security-patched release.
Photo Station Security Changes
A critical security update removed the $_GET['g'] parameter from the cachefile functionality.
This parameter, originally processing user input from a specific combine.php file, influenced cache file naming conventions.
Additionally, PHP's fopen() function can open not only files but also URLs. The code shows files being opened in 'wb' (write binary) mode, and due to fopen()'s characteristics, attackers could explore the cachedir and write cache files to arbitrary locations. This vulnerability in Photo Station's combine.php was exploited by manipulating the prefix of cachefile names.
Cryptojacking
Cryptojacking is an attack that infects victims' available resources (PCs, IoT devices, etc.) for cryptocurrency mining purposes. Modern cryptojacking operations typically run during periods when users are least likely to notice, making detection particularly challenging.
Cryptojacking and IoT Devices
While individual IoT devices have limited resources that make them unsuitable for cryptocurrency mining, they can be exploited for cryptojacking malware attacks when infected in large numbers as part of a botnet. As cryptocurrency markets expand, attacks aimed at cryptocurrency mining are becoming increasingly prevalent in the malware landscape, with cryptojacking malware targeting IoT devices also on the rise.
Unlike other attack methods that actively steal user information, cryptojacking may appear less aggressive. However, it results in device performance degradation and increased power consumption, allowing attackers to cause continuous damage while users remain unaware of the system compromise.
☑️ Why Users Often Fail to Detect Security Breaches
Why do regular users frequently remain unaware when their IoT or Embedded systems are compromised?
Limited Accessibility
The device shell, being a low-level system, is often difficult to access or control directly. This limitation makes it challenging for users to monitor internal system activities, resulting in frequent failure to detect security breaches.
Stealthy Nature of Attacks
Attackers exploit these characteristics to conduct increasingly covert operations on IoT devices. Since these attacks progress without triggering any user alerts, detection becomes particularly challenging.
Firmware Update Challenges
Many existing devices require direct access for firmware updates, leading to infrequent security checks. Users often neglect regular firmware verification due to this manual update requirement.
IoT devices typically have resource constraints that prevent the implementation of advanced security features like firewalls and intrusion detection systems. These limitations, combined with other characteristics, make it difficult for average users to identify potential security breaches.
☑️ Conclusion
The primary reasons why regular users remain unaware of attacks on their IoT and Embedded systems include limited system access knowledge and the covert nature of attacks. Additionally, the absence of advanced security features like firewalls contributes to this vulnerability.
While IoT and Embedded devices offer convenience across various sectors, security vulnerabilities will continue to pose risks until adequately addressed.
As demonstrated in this analysis, attacks targeting IoT and Embedded systems continue to evolve, with increasingly sophisticated techniques emerging. Security researchers can gain valuable insights from vulnerability case studies, understanding past issues to prevent and respond to similar attacks.
Notably, we examined bypass methods utilizing PHP fopen() characteristics in Pre-Auth Command Injection scenarios, learning strategies applicable to similar future cases.
<Reference Sources>
