Rootkits are the most challenging malware threats against server and desktop systems. They are created by highly skilled actors and are deployed in advanced persistent threat attacks. Lately and even in the future, rootkits will become a real threat to billions of IoT devices. Existing malware detection techniques based on static or dynamic analysis face major shortcomings, which become more apparent when it is necessary to detect threats on IoT devices.

The Internet of Things (IoT) is constituted of devices that are exponentially growing in number and in complexity. They use numerous customized firmware and hardware, without taking into consideration security issues, which make them a target for cybercriminals, especially malware authors.

In this poster we present a novel approach of using side channel information to identify the kinds of malware threats that are targeting IoT devices. Although in the presence of obfuscation techniques that can prevent static or symbolic binary analysis, a malware researcher may obtain detailed information about malware type and identification using our method by leveraging side channel by electromagnetism rather than software-layer malware analysis. By capturing 100,000 measurement traces from an IoT system infected with different malware samples, we can obtain this information without altering the actual hardware. As a result, it can be implemented without any overhead, regardless of the resources available. Furthermore, our method has the advantage of non-trivial for malware authors to avoid. We were able to distinguish malware families based on side-channel knowledge without being able to see what exact hardware was involved. We were able to predict three generic malware forms (and one benign class) with a 99.89% percent accuracy in our tests. Furthermore, our results show that we are able to classify altered malware samples with unseen obfuscation techniques during the training phase, and to determine what kind of obfuscations, which makes our approach particularly useful for malware analysts.

The Internet of things (IoT) has come into widespread use, and data protection and integrity are critical for connected IoT devices in order to maintain security and privacy. Low-power wide-area (LPWA) technologies for IoT wireless communication achieve data protection and integrity by using encryption and message authentication. However, side-channel analysis techniques exist that have the capacity to recover secret information from a device. In this paper, we apply a side-channel analysis technique to the payload encryption process and message authentication code generation process on a real LoRaWAN end-device. The entire AES-128 key for the payload encryption can be recovered with 260 electromagnetic(EM)-leakage traces and 12 bytes of the key for message authentication code generation can be recovered with 140 EM-leakage traces.

International audience