I've read a certain amount about the Mirai worm, a virus that attacks Internet of Things devices using default usernames and passwords and essentially is wired to produce a Distributed Denial of Service (DDoS).

However, I've recently read about another worm, BrickerBot, also a virus attack on Internet of Things devices. According to this article on thenextweb.com results in a Permanent Denial of Service (PDoS).

What is the difference between these two attacks as relates to the denial of service? Otherwise stated, what is the difference between DDoS and PDoS as relates to these IoT attacks?

  • They're both DoS attacks, but all of the rest is different. – immibis Apr 11 '17 at 0:27
up vote 16 down vote accepted
+50

DDoS vs. "PDoS"

1. DDoS (for reference)

A conventional distributed denial of service attack (DDos) is a class of denial of service (DoS) attacks in which a distributed system (botnet) consisting of nodes controlled via some application (Mirai, LizardStresser, gafgyt, etc.) is used to consume the resources of the target system or systems to the point of exhaustion. A good explanation of this is given on security.SE.

An explanation of how Mirai-controlled botnets accomplish denial of service can be found in an analysis by Incapsula:

Like most malware in this category, Mirai is built for two core purposes:

  • Locate and compromise IoT devices to further grow the botnet.
  • Launch DDoS attacks based on instructions received from a remote C&C.

To fulfill its recruitment function, Mirai performs wide-ranging scans of IP addresses. The purpose of these scans is to locate under-secured IoT devices that could be remotely accessed via easily guessable login credentials—usually factory default usernames and passwords (e.g., admin/admin).

Mirai uses a brute force technique for guessing passwords a.k.a. dictionary attacks...

Mirai’s attack function enables it to launch HTTP floods and various network (OSI layer 3-4) DDoS attacks. When attacking HTTP floods, Mirai bots hide behind the following default user-agents...

For network layer assaults, Mirai is capable of launching GRE IP and GRE ETH floods, as well as SYN and ACK floods, STOMP (Simple Text Oriented Message Protocol) floods, DNS floods and UDP flood attacks.

These types of botnets accomplish resource exhaustion resulting in denial of service by using controlled devices to generate such large volumes of network traffic directed towards the target system that the resources provided by that system become inaccessible for the duration of the attack. Once the attack ceases, the target system no longer has its resources consumed to the point of exhaustion and can again respond to legitimate incoming client requests.

2. "PDoS"

The BrickerBot campaign is fundamentally different: instead of integrating embedded systems into a botnet which is then used to orchestrate large-scale attacks on servers, the embedded systems themselves are the target.

From Radware's post on BrickerBot “BrickerBot” Results In Permanent Denial-of-Service:

Imagine a fast moving bot attack designed to render the victim’s hardware from functioning. Called Permanent Denial-of-Service (PDoS), this form of cyber-attack is becoming increasingly popular in 2017 as more incidents involving this hardware-damaging assault occur.

Also known loosely as “phlashing” in some circles, PDoS is an attack that damages a system so badly that it requires replacement or reinstallation of hardware. By exploiting security flaws or misconfigurations, PDoS can destroy the firmware and/or basic functions of system. It is a contrast to its well-known cousin, the DDoS attack, which overloads systems with requests meant to saturate resources through unintended usage.

The embedded systems targeted for permanent incapacitation do not have some application downloaded onto them for purposes of remote control and are never part of a botnet (emphasis mine):

Compromising a Device

The Bricker Bot PDoS attack used Telnet brute force - the same exploit vector used by Mirai - to breach a victim’s devices. Bricker does not try to download a binary, so Radware does not have a complete list of credentials that were used for the brute force attempt, but were able to record that the first attempted username/password pair was consistently 'root'/'vizxv.’

Corrupting a Device

Upon successful access to the device, the PDoS bot performed a series of Linux commands that would ultimately lead to corrupted storage, followed by commands to disrupt Internet connectivity, device performance, and the wiping of all files on the device.

A third difference is that this campaign involves a small number of attacker-controlled devices, instead of many thousands or millions:

Over a four-day period, Radware’s honeypot recorded 1,895 PDoS attempts performed from several locations around the world.

The PDoS attempts originated from a limited number of IP addresses spread around the world. All devices are exposing port 22 (SSH) and running an older version of the Dropbear SSH server. Most of the devices were identified by Shodan as Ubiquiti network devices; among them are Access Points and Bridges with beam directivity.

Summary

Given the number of ways that the BrickerBot "PDoS" campaign fundamentally differs from conventional "DDoS" campaigns like Mirai, using similar-sounding terminology is likely to result in confusion.

  • DDoS attacks are typically conducted by a botmaster with control over a distributed network of devices in order to prevent clients from accessing server resources for the duration of the attack, whereas "BrickerBot" is a campaign to "brick" embedded systems
  • Botnet clients are controlled via an application installed on the client by the attacker. In the BrickerBot campaign, commands are remotely executed via telnet without the use of a controlling application (e.g. malware)
  • DDoS attacks employ a large number (thousands, millions) of controlled devices, whereas the BrickerBot campaign uses a comparatively small number of systems to orchestrate so-called "PDoS" attacks
  • the BrickerBot campaign targets embedded systems for incapacitation, whereas Mirai and the like target embedded systems in order to integrate them into a botnet
  • Excellent detailed answer! – anonymous2 Apr 10 '17 at 17:38
  • Wow you read that fast. And thanks, I have an interest in embedded systems security – SYS_V Apr 10 '17 at 17:40
  • 1
    Great answer! After your first paragraph for the "PDoS" explanation I had the "oh I see" moment where I realised the malware's title is pretty much self-explanatory. The Bot that Bricks IoT devices. Duh! – Reece Apr 10 '17 at 23:20
  • 1
    @PierreLebon there already was a malware war - Mirai obviously wants control of the devices it infects, and to do so, it does already try to knock out (some) other malware if it has already been infected. – Baldrickk Apr 11 '17 at 12:37
  • 1
    @PierreLebon if you look at function killer_init() lines 190 to 220 and function memory_scan_match() lines 494 to 539 in the killer.c file in Mirai's source code, you will find that Mirai scans device memory in search of processes matching those of competing botnets and subsequently kills those processes. Mirai also kills telnet on devices it infects, so there is no need for it to "patch" the device; it is already not susceptible to direct attack from "BrickerBot" – SYS_V Apr 11 '17 at 12:59

DDoSes are ephemeral. Once the attack vector is removed or the DDoS stops the device works. (Or in the case of Mirai, the rest of the internet works.)

PDoSes update the device so it cannot work, ever again.

Mirai used IoT devices as a DDoS source. Mirai-infected devices still worked; the DDoS aspect was in addition to their normal functionality. It wasn't a DDoS against the device itself.

If it had eliminated normal functioning and provided no way to remove it, it would have been a PDoS against the device and the source of a DDoS against the internet in general.

  • Ah, that makes sense. So the brickerbot worm is actually defuncting the IoT devices, whereas Mirai simply hacked the device so as to perform a DDoS attack on other servers? – anonymous2 Apr 10 '17 at 16:45
  • @anonymous2 That's my understanding, yup. Being able to brick connected devices is generally just annoying, but it could lead to actual danger in enough cases to be concerned about. – Dave Newton Apr 10 '17 at 16:47
  • Bricking connected devices is what can bring big cities clause to apocalypse! Once the runner won't be able to publish or check their last performance, they will start to wander forming a whole horde ... Oh I must start packing a IOT apocalypse emergencie pack. – Drag and Drop Apr 11 '17 at 7:24

Elaborating a bit on what Dave wrote, the main differentiating factor is that in case of DDoS bot nets the IoT devices are used as attackers, usually not even impeding the devices function in any major way. After all those attackers don't want to lose the power of having a bot net that is able of carrying out DDoS attacks on third parties. The IoT consumer usually doesn't notice anything.

The BrickerBot however attacks the devices itself and disables the device. Thus, the IoT consumer is the target of the attack and not the unwitting provider of attack potential.

As a lot of blogs assume (take this example) the bot might be a preventive strike to reduce potential targets for DDoS worms. Mainly because there is very few to be gained by just destroying stuff, besides reducing the bot net potential—or competition.

One might consider this a good thing, since this is a threat that actually threatens IoT manufacturers(' image) and the consumer, increasing the urgency to properly secure IoT devices.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.