Difficult for Thee, But Not for Me

Difficult for Thee, But Not for Me: Measuring the Difficulty and User Experience of Remediating Persistent IoT Malware

Rodriguez, Elsa (Student TU Delft)
Fukkink, Max (Student TU Delft)
Parkin, S.E. (TU Delft Organisation & Governance)
van Eeten, M.J.G. (TU Delft Organisation & Governance)
Hernandez Ganan, C. (TU Delft Organisation & Governance)

2022

Consumer IoT devices may suffer malware attacks, and be recruited into botnets or worse. There is evidence that generic advice to device owners to address IoT malware can be successful, but this does not account for emerging forms of persistent IoT malware. Less is known about persistent malware, which resides on persistent storage, requiring targeted manual effort to remove it. This paper presents a field study on the removal of persistent IoT malware by consumers. We partnered with an ISP to contrast remediation times of 760 customers across three malware categories: Windows malware, non-persistent IoT malware, and persistent IoT malware. We also contacted ISP customers identified as having persistent IoT malware on their network-attached storage devices, specifically QSnatch. We found that persistent IoT malware exhibits a mean infection duration many times higher than Windows or Mirai malware; QSnatch has a survival probability of 30% after 180 days, whereby most if not all other observed malware types have been removed. For interviewed device users, QSnatch infections lasted longer, so are apparently more difficult to get rid of, yet participants did not report experiencing difficulty in following notification instructions. We see two factors driving this paradoxical finding: First, most users reported having high technical competency. Also, we found evidence of planning behavior for these tasks and the need for multiple notifications. Our findings demonstrate the critical nature of interventions from outside for persistent malware, since automatic scan of an AV tool or a power cycle, like we are used to for Windows malware and Mirai infections, will not solve persistent IoT malware infections.

IoT malware remediation
IoT security
notifications
persistent IoT malware
QSnatch

http://resolver.tudelft.nl/uuid:1ed1420e-4879-448e-b903-d0fd2df11cd8

https://doi.org/10.1109/EuroSP53844.2022.00032

Institute of Electrical and Electronics Engineers (IEEE)

2023-07-01

9781665416146

Proceedings - 7th IEEE European Symposium on Security and Privacy, Euro S and P 2022

7th IEEE European Symposium on Security and Privacy, Euro S and P 2022, 2022-06-06 → 2022-06-10, Genoa, Italy

Proceedings - 7th IEEE European Symposium on Security and Privacy, Euro S and P 2022

Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

Institutional Repository

conference paper

© 2022 Elsa Rodriguez, Max Fukkink, S.E. Parkin, M.J.G. van Eeten, C. Hernandez Ganan