The Internet of Things (IoT) is a collection of interconnected devices, each becoming increasingly complicated and numerous. They frequently employ modified hardware and software without taking security risks into account, which makes them a target for cybercriminals, especially malware and rootkit crafter. In this extended abstract, we will present two strategies for exploiting electromagnetic side channels to address two issues: rootkit detection dificulties and malware categorization challenges in the presence of obfuscations. Both tactics center on IoT devices, target ARM (raspberry-Pi) and MIPS (CI.20) architectures, and use machine/deep learning techniques. These results were published at, ∙ ACSAC-2021: “Obfuscation Revealed: Leveraging Electromagnetic Signals for Obfuscated Malware Classification” [1] (with an extended version presented at hardwear.io'22 USA), ∙ RAID-2022: “ULTRA: Ultimate Rootkit Detection over the Air”[2].
show that we are able to classify altered malware samples with unseen obfuscation techniques during the training phase, and to determine what kind of obfuscations were applied to the binary, which makes our approach particularly useful for malware analysts. • Targets: Raspberry Pi 2B (ARM processor), CI20 (MIPS processor), • Acquisition: Picoscope 6407, H-Field Probe (Langer RF-R 0.3-3), connected to a H-Field Probe (Langer RF-R 0.3-3), where the EM signal is amplified using a Langer PA-303 +30dB (Fig. 1). • Samples, labels, number of traces: all information available in tabular 3. • code:
→ https://github.com/ahma-hub • data:
→ https://zenodo.org/record/5414107 • talk at hardwear.io’22 USA of an extended version (with a additional target board CI20 embedded a MIPS processor): → https://m.youtube.com/watch?v=oCohqwfUpsQ&feature=youtu.be State-of-the-art A summary of the state-of-the-art, regarding malware analysis througth side-channel is available in Tab. 1. 2. ULTRA: Ultimate Rootkit Detection over the Air We suggest the ULTRA framework, which operates outside of the “box” (literal device) and requires no resources from the target device, , as visible on Figure 2, to identify rootkits efectively and eficiently. A software-defined radio is used by ULTRA to measure electromagnetic emission, preprocess signals, and then detect and categorize rootkit activities. ULTRA baits the rootkit to elicit action. We focus on two IoT devices with ARM and MIPS architectures as use cases. During the ofline learning phase, the suggested method produced encouraging results with high accuracy for detecting both known and unknown rootkits. The classification of rootkit families and distinctive variants, obfuscated rootkits, probe dislocation, benign noise (kernel) activities, and comparison with software-based solutions are all part of our experimental investigation.
• Targets: Raspberry Pi 2B (ARM processor), CI20 (MIPS processor), • Acquisition: SDR (software define radio, hackRF), H-Field Probe (Langer RF-R 0.3-3), connected to a H-Field Probe (Langer RF-R 0.3-3), where the EM signal is amplified using a Langer PA-303 +30dB (Fig. 2).
• code:
→ https://gitlab.com/ultra-RK/ultra • data:
→ https://zenodo.org/record/5902451 State-of-th-art A summary of the state-of-the-art, regarding rootkit detection by side-channel is available in Tab. 2. Comparison with related works on kernel-level or user-level rootkit (user RK) detection using diferent side-channel analysis techniques: HPC, DMA, Power consumption (Power) and EM.
Article
WnP
Baits
ML
DL Classification ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗
Sample size 8 5 4 12 23 5 5 9 3. Ongoing Next-steps Currently, we are focusing on the reproducibility of our results. First, we are in contact with researchers that are building the same setup. Second, we built student projects to make the ULTRA framework more portable using a Jetson Nano board that embeds a GPU. Finally, we are collaborating to improve the classification step. Acknowledgments The work was supported by the French Agence Nationale de la Recherche (ANR) under reference ANR-18-CE39-0001 (AHMA). We thank our colleague Ronan Lashermes and Olivier Zendra who provided hardware and side-channel insights and greatly assisted this work. ] ] ] ] * * + + [ [ [ [ ] ] ] ] ] [* [* [* [+ [* ] ] ]* ]* ]+ ]* ]* ]* ]+ en ign
y y y y * + [ [ [ [ [ [ [ c t rcaynn []*rcy rcann rcann rcann rcann itt[ok itt[ok litseh litseh litseh litseh litseh ][* litseh litseh ignn ignn ignn ignn tsao tseeh s t o a o o o o o o a a a a a e ab ab eb eb eb eb r . g n g g g g r r b b b b b lit fe sp e e r r ( r i n lttsceeaagbxuE ra34odnm iiram iireaaa_qoddpum liiiitrrzeaa_vum fliiittreaa_nm iif-rcabm fliitt-rceaaanm ii-rsabum ii-raxpum rcagoynn -rcaxgoypunn --rsceaaxgoypunn -rsceaagoynn -rsceagodynn --rsceaxgodypunn liitrrzceaa2_vgoyunn flttrceaa_goynnn frcca_bgoynn rsca_bgoyunn flttrcceaa_goynnn rceaaa_gqooddypunn iitttra__ookKm iiittrs_ookkn litseabh liftscea_bbh fllitttseeaa_bhn litsea_xbpuh litseeaaa_bqoddpuh lflitttsceeaa_bhhn litssea_bbuh lliiittrszeeaa_bvuh liaaodypu rrrcceeaaodm ittrceeakpu iceeevooddn .lcceeaouhhnnTm iittrseeaagphhnn sg m irm go sab scea irgn ta tr du d n
y y y y y y y y y y y ilaym iegnn iira iira iira ira iira ia iira iira rcaonn rcaonn rcaonn rcaonn rcaonn rcaonn rcaonn rcaynn rcaonn rcaonn rcaonn rcaonn ita_K iisn litseah litseah litseah litseah litseah liteh litseah litseah iegnn iegnn iegnn iegnn lreaaw eebun itrraon F b m m m i m ir m m g g g g g g g o g g g g m k b b b b b sa b b b b b b m sa f m m g b ll h %
e + .k u e iissreeaannm a34odnm .iirraa7m iireaaa_qoddpu Pliiiitrrzeaa_vurocfliittreaa_neediif-rcabingfliitt-rceaansoii-rsabufthii-raxpme30rcaoynnth C-rcaxgoypnn&E--sceaxgopunSA-rsceagoynR-rsceagoynn(20--sexgopunn23)irrca_oynnV flttrceaa_oynn frcca_boynn rsca_boyunn flttrcceaa_oynnn rcaaa_ooddypnn ..it-a459177_vK ..ii--s914577vn+ litseah liftscea_bh fllitttseeaa_hn litsea_xpuh litseaaa_qoddph fllitttsceeaa_hn litssea_buh lliiittrszeaa_vuh liaaodyu rrcceeaaodm 7itrceeakpu7 iceevooddn :ltreaaagwmM ltsceeaaphhm lrssseeaapum B r m m m m m m m u g u a a d d g g g g g g m k b b b b b b b b p r t e 3 e e e e e e e e e e e a a a a a a a re ra ra ra ra r r r r r r r u e q iz a l p a fu od tru n f en b x x x bO ad iv tte cb tt su pu pu pu lfa lfa
c s g d a e t k r c e a
p k _ c t a o P n d e z i l a u t u ir irg itr V o v d d d e e e k k k c c c d a d d a a d e p e e p p e k _ k k _ _ k c t c c t t c a o a a o o a p n p p n n p n p tru n f b tte od i te c u fla d v t b s c a
lfa e u e aq liz p a n o u f te x d en b tr c t p d t u i b fla u a t s v lfa c y m b a
s
p r n s g re fo iebn (][* 20%