The Internet of Things (IoT) is built of many small smart objects continuously connected to the Internet. This makes these devices an easy target for attacks exploiting vulnerabilities at the network, application, and mobile level. With that it comes as no surprise that distributed denial of service attacks leveraging these vulnerable devices have become a new standard for effective botnets. In this paper, we propose Heimdall, a whitelist-based intrusion detection technique tailored to IoT devices. Heimdall operates on routers acting as gateways for IoT as a homogeneous defense for all devices behind the router. Our experimental results show that our defense mechanism is effective and has minimal overhead.

As embedded systems have increased in performance and reliability, their applications have expanded into new domains such as automated drone-based delivery mechanisms. Security of these drones, also referred to as unmanned aerial vehicles (UAVs), is crucial due to their use in many different domains. In this paper, we present a stealthy attack strategy that allows the attacker to change sensor values and modify the UAV navigation path. As the attack is stealthy, the system will continue to execute normally and thus the ground station or other monitoring entities and systems will not be able to detect that an attack is undergoing. With respect to defense, we propose a strategy that combines software and hardware techniques. At software level, we propose a fine grained randomization based approach that modifies the layout of the executable code and hinders code-reuse attack. To strengthen the security of our defense, we leverage a custom hardware platform designed and built by us. The platform isolates the code binary and randomized binary in such a way that the actual code being executed is never exposed for an attacker to analyze. We have implemented a prototype of this defense technique and present results to demonstrate the effectiveness and efficiency of this defense strategy.

Code-reuse attacks, such as return-oriented programming (ROP), are a class of buffer overflow attacks that repurpose existing executable code towards malicious purposes. These attacks bypass defenses against code injection attacks by chaining together sequence of instructions, commonly known as gadgets, to execute the desired attack logic. A common feature of these attacks is the reliance on the knowledge of memory layout of the executable code. We propose a fine grained randomization based approach that breaks these assumptions by modifying the layout of the executable code and hinders code-reuse attack. Our solution, Marlin, randomizes the internal structure of the executable code by randomly shuffling the function blocks in the target binary. This denies the attacker the necessary a priori knowledge of instruction addresses for constructing the desired exploit payload. Our approach can be applied to any ELF binary and every execution of this binary uses a different randomization. We have integrated Marlin into the bash shell that randomizes the target executable before launching it. Our work shows that such an approach incurs low overhead and significantly increases the level of security against code-reuse based attacks.