Abstract
With the ubiquitous deployment of Internet of Things (IoT) devices in many fields, more and more IoT botnets have taken a variety of penetration methods to infect vulnerable IoT devices. Nowadays, a substantial Peer-to-Peer (P2P) IoT botnet named Pink has infected over 1.6 million IoT devices since January 2020, and its impact once exceeded other notorious IoT botnets, such as Mirai, Hajime, Mozi, and so on. Pink is the first IoT botnet using a hybrid topology with centralized and decentralized network architectures. Its two distinct features can be summarized as follows. (i) Different from the conventional P2P IoT botnet based on the public Distributed Hash Table (DHT) service, Pink introduces a novel mechanism called B-segment to build a P2P network, which makes it challenging to track the entire botnet. (ii) Pink is the first IoT botnet to leverage third-party services to propagate configuration files, thereby increasing its resilience. In this paper, we propose an active detection method to measure and understand the development and changes of the Pink botnet continuously. Through daily and continuous measuring of the Pink botnet since January 2022, we firstly provide a comprehensive view of its inapparent network, including bot sizes, global geographic distribution, daily activity, configuration analysis, and Pink botnet countermeasures. We believe that our measurement result is infinitely close to the boundary of the Pink network. Through this study, we reveal that deeper penetration attacks are occurring in the IoT field, and there is an urgent need to improve the security protection of IoT devices. Meanwhile, we hope that this study can promote future research on IoT botnets.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
MaxMind: http://www.maxmind.com/en/home.
References
Alex, T., Hui, W., Genshen, Y.: Mozi is dead and the poison remains (2021). https://blog.netlab.360.com/the_death_of_mozi_cn/
Turing, A., Wang, H.: Mozi, another botnet using DHT (2019). https://blog.netlab.360.com/mozi-another-botnet-using-dht/
Turing, A., Wang, H.: Pink, a botnet that competed with the vendor to control the massive infected devices (2021). https://blog.netlab.360.com/pink-en/
Antonakakis, M., et al.: Understanding the MIRAI botnet. In: 26th USENIX security symposium (USENIX Security 2017) (2017)
Cyware: Experts disclose pink botnet amidst multiple DDoS alerts (2021). https://cyware.com/news/experts-disclose-pink-botnet-amidst-multiple-ddos-alerts-662ed0c4
Dagon, D., Gu, G., Lee, C.P., Lee, W.: A taxonomy of botnet structures. In: Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007), pp. 325–339. IEEE (2007)
Edwards, S., Profetis, I.: Hajime: analysis of a decentralized internet worm for IoT devices. In: Rapidity Networks, Security Research Group, Technical report (2016)
Herwig, S., Harvey, K., Hughey, G., Roberts, R., Levin, D.: Measurement and analysis of Hajime, a peer-to-peer IoT botnet. In: Network and Distributed System Security (NDSS) Symposium (2019)
Van Der wiel, J., Vicente Diaz, Y.N.: Hajime, the mysterious evolving botnet (2017). https://securelist.com/hajime-the-mysterious-evolving-botnet/78160/
Kalliamvakou, E., Gousios, G., Blincoe, K., Singer, L., German, D.M., Damian, D.: The promises and perils of mining github. In: Proceedings of the 11th Working Conference on Mining Software Repositories, pp. 92–101 (2014)
Kambourakis, G., Kolias, C., Stavrou, A.: The MIRAI botnet and the IoT zombie armies. In: IEEE Military Communications Conference (MILCOM) (2017)
Lueth, K.L.: State of the IoT 2020: 12 billion IoT connections, surpassing non-IoT for the first time (2020). https://iot-analytics.com/state-of-the-iot-2020-12-billion-iot-connections-surpassing-non-iot-for-the-first-time/
Marzano, A., et al.: The evolution of bashlite and Mirai IoT botnets. In: 2018 IEEE Symposium on Computers and Communications (ISCC), pp. 00813–00818. IEEE (2018)
Meulen, R.v.d.: Gartner says 8.4 billion connected “things” will be in use in 2017 up 31 percent from 2016. In: Gartner. Letzte Aktualisierung (2017)
Pa, Y.M.P., Suzuki, S., Yoshioka, K., Matsumoto, T., Kasama, T., Rossow, C.: IoTpot: a novel honeypot for revealing current IoT threats. J. Inf. Process. 24(3), 522–533 (2016)
Sidhu, J.: SysCoin: a peer-to-peer electronic cash system with blockchain-based services for e-business. In: 2017 26th International Conference on Computer Communication and Networks (ICCCN), pp. 1–6. IEEE (2017)
Team, C.: Experts disclose pink botnet amidst multiple DDoS alerts (2021). https://cyberintelmag.com/malware-viruses/pink-botnet-malware-infected-more-than-1-6-million-devices-according-to-researchers/
Trendmicro: IoT botnet (2016). https://www.trendmicro.com/vinfo/us/security/definition/iot-botnet
Tu, T.F., Qin, J.W., Zhang, H., Chen, M., Xu, T., Huang, Y.: A comprehensive study of mozi botnet. Int. J. Intell. Syst. (2022)
Vu, S.N.T., Stege, M., El-Habr, P.I., Bang, J., Dragoni, N.: A survey on botnets: incentives, evolution, detection and current trends. Future Internet (2021)
Acknowledgment
We thank the anonymous reviewers for their insightful comments. This work is supported by The National Key Research and Development Program of China (No. 2019YFB1005201, No. 2019YFB1005203 and No. 2019YFB1005205).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
About this paper
Cite this paper
Wang, B., Sang, Y., Zhang, Y., Li, S., Ge, R., Ding, Y. (2022). A Longitudinal Measurement and Analysis of Pink, a Hybrid P2P IoT Botnet. In: Gao, H., Wang, X., Wei, W., Dagiuklas, T. (eds) Collaborative Computing: Networking, Applications and Worksharing. CollaborateCom 2022. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 461. Springer, Cham. https://doi.org/10.1007/978-3-031-24386-8_23
Download citation
DOI: https://doi.org/10.1007/978-3-031-24386-8_23
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-24385-1
Online ISBN: 978-3-031-24386-8
eBook Packages: Computer ScienceComputer Science (R0)