We presented a talk at the Packet Hacking Village in Defcon titled "Beyond Sandboxes. How to Execute IoT Malware and Analyze its evolution. We showed how we designed and deployed an IoT malware execution laboratory to run malware for months and how we analyzed it to find novel attacks.
IoT Honeypot Traffic Analysis Series. Analysis of Edimax IC-7113W, part 4
In this IoT Honeypot Analysis Series, we focus on the traffic analysis of the Edimax IC-7113W camera. In this episode, we will continue with the analysis of the encrypted packets mentioned in the previous episode. Our goals for this blog post are:
to obtain the AES key from the Edimax server
to understand what happens with the communication after we obtain the AES key
to get a plaintext of the encrypted payload sent from the camera to the server
IoT Honeypot Traffic Analysis Series. Analysis of Edimax IC-7113W, part 3
This is a follow-up blogpost from the IoT Honeypot Analysis Series we have started earlier (here and here). In this episode we go more into understanding packets sent from and to the Edimax IC-7113W camera by using reverse engineering techniques and some hacking.
Aposemat IoT Malware Analysis, an X-Bash infection
This blog post describes the analysis of a malware sample that was executed in a RapsberryPi from our IoT laboratory. The SHA256 of the sample that we executed in our laboratory is: d8040a64b88b4a738d333015ddd93a27187abb7584412df56633a7e7d12127f4.
IoT Malware Analysis Series. An IoT malware dropper with custom C&C channel exploiting HNAP
On February 28th, 2019 we infected one of our devices with the malware sample that most AV detect as Mirai. However, it was a bash script downloader that obtains and exacute an ARM ELF binary to attack others using the HNAP vulnerability in order to infect new bots.
Analysis of an IRC based Botnet
This blogpost aims to give an insight of an IRCBased botnet describing the network behavior and showing the analysis of the C&C. By analyzing this botnet network traffic it was possible to identify the botmasters using an IRC channel and observe not only the conversation between them but also the orders they give to the bot.
IoT Honeypot Traffic Analysis Series. Continuation Analysis of Honeypot Camera Traffic Edimax IC-7113W
An analysis of the attacks received by our Edimax IoT camera and deeper analysis of its normal behavior.
