Detecting Evasive Malware on IoT Devices Using Electromagnetic Emanations

Cybersecurity researchers have proposed a novel approach that
leverages electromagnetic field emanations from the Internet of
Things (IoT) devices as a side-channel to glean precise knowledge
about the different kinds of malware targeting the embedded
systems, even in scenarios where obfuscation techniques have been
applied to hinder analysis.

With the rapid adoption of IoT appliances presenting an
attractive attack surface for threat actors, in part due to them
being equipped with higher processing power and capable of running
fully functional operating systems, the latest research aims to
improve malware analysis to mitigate potential security risks.

The findings were presented by a group of academics from the
Research Institute of Computer Science, and Random Systems (IRISA)
at the Annual Computer Security Applications Conference (ACSAC^[1]) held last month.

“[Electromagnetic] emanation that is measured from the device is
practically undetectable by the malware,” the researchers said^[2]
in a paper. “Therefore, malware evasion techniques cannot be
straightforwardly applied unlike for dynamic software monitoring.
Also, since a malware does not have control on outside
hardware-level, a protection system relying on hard]ware features
cannot be taken down, even if the malware owns the maximum
privilege on the machine.”

The goal is to take advantage of the side channel information to
detect anomalies in emanations when they deviate from previously
observed patterns and raise an alert when suspicious behavior
emulating the malware is recorded in comparison to the system’s
normal state.

Not only does this require no modifications on the target
devices, the framework devised in the study enables the detection
and classification of stealthy malware such as kernel-level
rootkits, ransomware, and distributed denial-of-service (DDoS)
botnets like Mirai, counting unseen variants.

Taking place over three phases, the side channel approach
involves measuring electromagnetic emanations when executing 30
different malware binaries as well as performing benign video,
music, picture, and camera-related activities to train a
convolutional neural network (CNN^[3]) model for classifying
real-world malware samples. Specifically, the framework takes as
input an executable and outputs its malware label by solely relying
on the side-channel information.

In an experimental setup^[4], the researchers opted
for a Raspberry Pi 2B as a target device with 900 MHz quad-core ARM
Cortex A7 processor and 1 GB memory, with the electromagnetic
signals acquired and amplified using a combination of an
oscilloscope and a PA 303 BNC preamplifier, effectively predicting
the three malware types and their associated families with an
accuracy of 99.82% and 99.61%.

“[B]y using simple neural network models, it is possible to gain
considerable information about the state of a monitored device, by
observing solely its [electromagnetic] emanations,” the researchers
concluded. “Our system is robust against various code
transformation/obfuscation, including random junk insertion,
packing, and virtualization, even when the transformation is
previously not known to the system.”