[Mud] cleaning up evil things

[Michael Richardson <[e-mail]>]

On Thursday, I was pointed at this paper:
  https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_02B-2_Cetin_paper.pdf

I attach the abstract below.  I think that this is particularly relevant to
the discussion of what to do when devices go bad.  Quarantine/walled garden
is the way to go was my take home, much more effective than emails.
That any emails must be well-written emails and specific.

Also that many small business use consumer/retail connections, but maybe
would be willing to invest in pro-sumer equiment if it will keep them online.

(I still feel that describing Mirai as an IoT botnet, as opposed to a home
router/PVR botnet is wrong, the world does not agree with me)



----


Abstract—With the rise of IoT botnets, the remediation of
infected devices has become a critical task. As over 87% of
these devices reside in broadband networks, this task will fall
primarily to consumers and the Internet Service Providers. We
present the first empirical study of IoT malware cleanup in the
wild – more specifically, of removing Mirai infections in the
network of a medium-sized ISP. To measure remediation rates,
we combine data from an observational study and a randomized
controlled trial involving 220 consumers who suffered a Mirai
infection together with data from honeypots and darknets. We
find that quarantining and notifying infected customers via a
walled garden, a best practice from ISP botnet mitigation for
conventional malware, remediates 92% of the infections within
14 days. Email-only notifications have no observable impact
compared to a control group where no notifications were sent. We
also measure surprisingly high natural remediation rates of 58-
74% for this control group and for two reference networks where
users were also not notified. Even more surprising, reinfection
rates are low. Only 5% of the customers who remediated suffered
another infection in the five months after our first study. This
stands in contrast to our lab tests, which observed reinfection
of real IoT devices within minutes – a discrepancy for which
we explore various different possible explanations, but find no
satisfactory answer. We gather data on customer experiences
and actions via 76 phone interviews and the communications
logs of the ISP. Remediation succeeds even though many users
are operating from the wrong mental model – e.g., they run antivirus software on their PC to solve the infection of an IoT device.
While quarantining infected devices is clearly highly effective,
future work will have to resolve several remaining mysteries.
Furthermore, it will be hard to scale up the walled garden solution
`because of the weak incentives of the ISPs.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-