(Georgia Institute of Technology, 2022-05)
Galloway, Tillson Thomas
The Domain Name System (DNS) has been an essential component of the Internet since 1985, mapping domain names that are easy to remember (e.g. google.com) to IPs that computers use to communicate (e.g. 30.3.5.2). DNS Reputation Systems use machine learning to identify malicious domains using large datasets containing DNS queries. We analyze the robustness of these reputation systems to attack and propose Mimicry Attacks, a novel technique that allows malicious domains to hide by mimicking the behavior of benign network infrastructure. This attack achieves an 85% success rate against active DNS datasets while coming at a low financial cost to the attacker.
(Georgia Institute of Technology, 2020-05)
Joaquin, Nicholas
The rise of insecure Internet of Things (IoT) on the Internet is problematic because they are easily compromised. IoT vendors are trying to push products to market as quickly as possible resulting in a significant amount of security issues. This work explores the attacks vectors used by malware to gain privilege control of IoT devices. We achieve this by performing two experiments – a static binary analysis that checks for specific patterns and identifies a binary to a publicly disclosed vulnerability, and a dynamic binary analysis focusing on linking program behavior to malicious actions. We further extend upon this by analyzing ELF section metadata of “tagged” binaries to determine if we can link specific ELF section sizes and entropies to malicious binaries. Through our work, we see that a large portion of vulnerabilities occurs due to improperly validated inputs, followed by weak credentials and improperly secured files. Moreover, we have also found that we are unable to link ELF section metadata to malicious binaries, as a result of anti-analysis efforts by malware authors. Our intention with this work is to understand how malware attacks IoT devices, thereby highlighting the specific security areas that must be prioritized in IoT device development.