Skip to main content

An Inside Look at IoT Malware

Part of the Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering book series (LNICST,volume 202)


It was reported that over 20 billion of Internet of Things (IoT) devices have connected to Internet. Moreover, the estimated number in 2020 will increase up to 50.1 billion. Different from traditional security-related areas in which researchers have made many efforts on them for many years, researches on IoT have just started to receive attentions in recent years. The IoT devices are exposing to many security problems, such as weak passwords, backdoors and various vulnerabilities including buffer overflow, authentication bypass and so on. In this paper, we systemically analyze multiple IoT malware which have appeared in the recent years and classify the IoT malware into two categories according to the way in which IoT malware infect devices: one is to infect IoT devices by brute force attacks through a dictionary of weak usernames and passwords; while the other one by exploiting unfixed or zero-day vulnerabilities found in IoT devices. We choose Mirai, Darlloz and BASHLITE as examples to illustrate the attacks. At the end, we present strategies to defend against IoT malware.


  • Internet of Things
  • Malware
  • Botnet

This is a preview of subscription content, access via your institution.

Buying options

USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-3-319-60753-5_19
  • Chapter length: 11 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
USD   54.99
Price excludes VAT (USA)
  • ISBN: 978-3-319-60753-5
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   72.00
Price excludes VAT (USA)
Fig. 1.
Fig. 2.
Fig. 3.
Fig. 4.
Fig. 5.
Fig. 6.
Fig. 7.


  1. Symantec blog.

  2. Jing, Q., Vasilakos, A.V., Wan, J., et al.: Security of the Internet of Things: perspectives and challenges. Wirel. Netw. 20(8), 2481–2501 (2014)

    CrossRef  Google Scholar 

  3. Zhang, Z.K., Cho, M.C.Y., Wang, C.W., Hsu, C.W., Chen, C.K., Shieh, S.: IoT security: ongoing challenges and research opportunities. In: 2014 IEEE 7th International Conference on Service-Oriented Computing and Applications, pp. 230–234. IEEE (2014)

    Google Scholar 

  4. Inside the Internet of Things village at DefCon.

  5. Chen, K., Wang, P., Lee, Y., et al.: Finding unknown malice in 10 seconds: mass vetting for new threats at the Google-Play scale. In: USENIX Security, vol. 15 (2015)

    Google Scholar 

  6. Enjoy Safer Technology.

  7. Dyn blog.

  8. Hackers create more IoT botnets with Mirai source code.

  9. The Qbot.

  10. Linux.Darlloz.

  11. Remaiten.

  12. Mirai Source.

  13. GeekPwn blog.

  14. Common Vulnerabilities and Exposures.

  15. Mirai bots attack 1 m German routers.

  16. Symantec blog.

  17. CVE-2012-1823.

  18. ShellShock.

  19. Busybox.

  20. Chakrabarty, S., Engels, D.W.: A secure IoT architecture for Smart Cities. In: 2016 13th IEEE Annual Consumer Communications & Networking Conference (CCNC). IEEE (2016)

    Google Scholar 

  21. Jerald, A.V., Rabara, S.A., Bai, D.P.: Secure IoT architecture for integrated smart services environment. In: 2016 3rd International Conference on Computing for Sustainable Global Development (INDIACom), pp. 800–805. IEEE, October 2016

    Google Scholar 

  22. Sun, H., Wang, X., Buyya, R., et al.: CloudEyes: cloud-based malware detection with reversible sketch for resource-constrained Internet of Things (IoT) devices. Pract. Exp., Software (2016)

    Google Scholar 

  23. Ham, H.S., Kim, H.H., Kim, M.S., et al.: Linear SVM-based android malware detection for reliable IoT services. J. Appl. Math. (2014)

    Google Scholar 

  24. Chen, K., Liu, P., Zhang, Y.: Achieving accuracy and scalability simultaneously in detecting application clones on android markets. In: Proceedings of the 36th International Conference on Software Engineering, pp. 175–186. ACM (2014)

    Google Scholar 

  25. Chen, K., Wang, X., Chen, Y., et al.: Following devil’s footprints: cross-platform analysis of potentially harmful libraries on android and iOS. In: 2016 IEEE Symposium on Security and Privacy (SP), pp. 357–376. IEEE (2016)

    Google Scholar 

  26. Pa, Y.M.P., Suzuki, S., Yoshioka, K., et al.: IoTPOT: analysing the rise of IoT compromises. EMU 9, 1 (2015)

    Google Scholar 

  27. Wu, C.-J., et al.: IoT malware behavior analysis and classification using text mining algorithm (2016)

    Google Scholar 

  28. Yang, J.H., Ryu, Y.: Design and development of a command-line tool for portable executable file analysis and malware detection in IoT devices. Int. J. Secur. Appl. 9(8), 127–136 (2015)

    Google Scholar 

  29. Min, B., Varadharajan, V.: Design and evaluation of feature distributed malware attacks against the Internet of Things (IoT). In: 2015 20th International Conference on Engineering of Complex Computer Systems (ICECCS). IEEE (2015)

    Google Scholar 

  30. SDN.

  31. Vandana, C.P.: Security improvement in IoT based on Software Defined Networking (SDN)

    Google Scholar 

Download references


The IIE authors were supported in part by NSFC U1536106, 61100226, Youth Innovation Promotion Association CAS, and strategic priority research program of CAS (XDA06010701). Yingjun Zhang was supported by National High Technology Research and Development Program of China (863 Program) (No. 2015AA016006) and NSFC 61303248.

Author information

Authors and Affiliations


Corresponding author

Correspondence to Aohui Wang .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and Permissions

Copyright information

© 2017 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

About this paper

Cite this paper

Wang, A., Liang, R., Liu, X., Zhang, Y., Chen, K., Li, J. (2017). An Inside Look at IoT Malware. In: Chen, F., Luo, Y. (eds) Industrial IoT Technologies and Applications. Industrial IoT 2017. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 202. Springer, Cham.

Download citation

  • DOI:

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-60752-8

  • Online ISBN: 978-3-319-60753-5

  • eBook Packages: Computer ScienceComputer Science (R0)