Security News > 2022 > January > Detecting Evasive Malware on IoT Devices Using Electromagnetic Emanations

Cybersecurity researchers have proposed a novel approach that leverages electromagnetic field emanations from the Internet of Things devices as a side-channel to glean precise knowledge about the different kinds of malware targeting the embedded systems, even in scenarios where obfuscation techniques have been applied to hinder analysis.

With the rapid adoption of IoT appliances presenting an attractive attack surface for threat actors, in part due to them being equipped with higher processing power and capable of running fully functional operating systems, the latest research aims to improve malware analysis to mitigate potential security risks.

"Therefore, malware evasion techniques cannot be straightforwardly applied unlike for dynamic software monitoring. Also, since a malware does not have control on outside hardware-level, a protection system relying on hard]ware features cannot be taken down, even if the malware owns the maximum privilege on the machine."

The goal is to take advantage of the side channel information to detect anomalies in emanations when they deviate from previously observed patterns and raise an alert when suspicious behavior emulating the malware is recorded in comparison to the system's normal state.

Taking place over three phases, the side channel approach involves measuring electromagnetic emanations when executing 30 different malware binaries as well as performing benign video, music, picture, and camera-related activities to train a convolutional neural network model for classifying real-world malware samples.

In an experimental setup, the researchers opted for a Raspberry Pi 2B as a target device with 900 MHz quad-core ARM Cortex A7 processor and 1 GB memory, with the electromagnetic signals acquired and amplified using a combination of an oscilloscope and a PA 303 BNC preamplifier, effectively predicting the three malware types and their associated families with an accuracy of 99.82% and 99.61%. "[B]y using simple neural network models, it is possible to gain considerable information about the state of a monitored device, by observing solely its emanations," the researchers concluded.

News URL

https://thehackernews.com/2022/01/detecting-evasive-malware-on-iot.html