IoT-Forensics

IoT Forensics is the term coined to describe a new branch of computer forensics dedicated to the particular features and requirements of digital investigations in Internet of Things (IoT) scenarios.

The IoTest (EXPLORA) project is focused on this topic. In particular, there are three directions within this research topic at NICS lab. First, the definition of “Digital Witness” has been formalised in different research papers and journals, where the most representative is [1]. This definition includes a discussion about the feasibility of this approach considering the embedded anti-tampering solutions with cryptographic capabilities available in multiple devices (e.g. TPM, secure element) together with the requirements for digital evidence collection considering multiple standards. Second, an important part of this solution is to promote the citizen collaboration towards their personal devices. Considering the nature of the digital witness approach, there are several privacy issues that must be considered. In order to cover these, the solution has been widely analysed from the privacy point of view in [2], also defining a solution to enable the anonymous witnessing approach. Furthermore, this analysis reflected that there is a lack of solutions to consider privacy and digital forensics tradeoffs, in particular in IoT-Forensics. In order to provide a solution the PRoFIT framework is defined in [3]. Moreover, this model is used to adapt the digital witness in order to balance privacy and digital forensics requirements based on the context of a digital investigation [4]. In [5], privacy-aware digital forensics solutions and challenges are analysed in deep considering several contexts, not only IoT Forensics.

Part of the efforts in this specific topic are meant to test the approach in realistic scenarios. To this end, its viability is being studied to solve different problems within the proactive 5G security in the digital forensic field, such as: [6] and [7]. Also, as a proof of concept, a prototype of digital witness has been developed for Android systems using a Google Pixel 3 terminal and, specifically, the secure chip Titan M as secure element. The solution has been named SELVIA and its source code is available at GitHub.

The patent [8] (national patent extended to international patent) includes a detailed description of a tentative architecture for digital witnessing, considering the different components that will be operating into the digital device.

Malware-driven Honeypots

In 2016, ransomware grew considerably, affecting almost half of businesses worldwide. Infections via e-mail, phishing and botnet nodes remain the most commonly used methods to compromise computers in the business environment. As a consequence, one of the biggest concerns today is how to respond effectively to malware dissemination campaigns. Honeypot systems are designed to capture attacks by simulating real services and/or applications. They employ deception techniques that try to satisfy the attacker’s demands, providing him/her with valid responses to service requests and apparently accepting modifications they want to make on the system.

There are two main scenarios commonly used for deploying honeypots: i) replicate live services of the production environment and ii) research environments. The efforts in NICS Lab focus on the second scenario, where the goal is to show a configuration of honeypots that enables attacks to be captured, to later analyse new techniques used. The main issue when designing this type of solution is the lack of information prior to the attack. Currently, there are principally two approaches to the problem: (a) studying only specific scenarios (web servers, SSH/Telnet protocols, etc.), and (b) implementing specialized trap systems for a reduced set of malware families (eg. Mirai). However, new malware attacking these honeypots will not necessarily activate all stages of the attack, due to an unfulfilled requirement. In order to solve part of these problems, in [9] the Hogney architecture is proposed for the deployment of malware-driven honeypots. This new concept refers to honeypots that have been dynamically configured according to the environment expected by malware. The adaptation mechanism designed here is built on services that offer up-to-date and relevant intelligence information on current threats. Thus, the Hogney architecture takes advantage of recent Indicators Of Compromise (IOC) and information about suspicious activity currently being studied by analysts. The information gathered from these services is then used to adapt honeypots to fulfill malware requirements, inviting them to unleash their full strength. In addition, in [10] a methodology to deploy relevant honeypots in IoT environments is proposed. The methodology is divided in five phases and considers aspects as the ranking popularity of the chosen devices and the requirement for avoiding the detection of our trap nodes as honeypots by some of the most popular IoT scanners (e.g. Shodan).

Technical Resources: Digital Forensics and Malware Analysis lab

NICS Lab has one laboratory isolated from the rest of the University of Malaga, used for the development of prototypes and security tests of those projects and research works with other teams, subject to confidential requirements. It is in this laboratory where NICS Lab has diverse malware and forensic tools and computing resources for performing very delicate task, such as: reverse engineering, infrastructure for the virtualized execution of malware, digital evidence recovery and analysis, forensic examination of memory, hard disk and network traffic. For this purpose, NICS Lab has top quality software tools like IDA Pro, Encase Forensic Deluxe and AccessData Forensic Toolkit. We also have a wide set of development kits for analysing wireless communications, operating in different frequencies and covering protocols like ZigBee, Bluetooth Low Energy, 6LoWPAN, RFID, NFC and SDR transceptors, etc. Also tools for analysing serial communications, Modbus, Rs-232, USB and Ethernet.

All these tools and resources are also used for deploying new use cases used for training professionals in various specialization courses.