312-50 Question 413
Single answer▪ IoT AttacksDuring an authorized assessment of a smart office, you identify several IP cameras, smart thermostats, and badge readers connected to the same flat internal network. The client is concerned about IoT devices being recruited into a botnet similar to Mirai. You capture traffic from one camera and observe repeated outbound TCP connection attempts to many random public IP addresses on ports 23 and 2323, followed by login attempts using common default credential pairs. Which finding most strongly indicates that the camera is behaving as part of an IoT botnet propagation attack rather than simply being misconfigured?
- A
The camera is sending repeated Telnet connection attempts to large numbers of external hosts and trying common default usernames and passwords
- B
The camera is generating regular NTP requests to public time servers to maintain correct system time
- C
The camera is uploading motion recordings to the vendor's cloud service over HTTPS
- D
The camera is using DHCP to renew its lease and then querying the local DNS resolver
Show answer and explanation
Correct answer: A
Explanation
The key distinction in this scenario is between normal IoT network behavior and active propagation behavior associated with malware such as Mirai. Mirai-class botnets typically compromise poorly secured IoT devices by scanning for accessible Telnet services, especially on ports 23 and 2323, and then attempting authentication with default credentials. That combination of external scanning plus repetitive default-credential login attempts is a strong behavioral indicator of botnet activity.
From a CEH perspective, candidates should recognize network-based indicators of compromise in IoT environments, especially where devices are deployed on flat networks with weak segmentation. Practical follow-up actions would include isolating the device, checking for exposed management services, validating firmware integrity, changing default credentials, disabling Telnet in favor of secure management protocols where supported, and segmenting IoT devices from user and server networks.
This aligns with widely recognized IoT security best practices, including guidance from OWASP IoT Top 10 and NIST recommendations for IoT device security, which emphasize eliminating default passwords, minimizing exposed services, monitoring device traffic patterns, and applying network segmentation to reduce lateral movement and botnet risk.
- A. Correct.
Correct. Large-scale outbound scanning for external hosts on Telnet ports 23 and 2323, followed by attempts to authenticate with default credentials, is a classic indicator of IoT malware propagation behavior. Mirai is well known for scanning the internet for exposed Telnet services and attempting logins using a built-in list of default or weak credentials. In a real assessment, this pattern strongly suggests compromise and botnet activity rather than normal device operation.
- B. Incorrect.
Incorrect. NTP traffic is common and expected for many IoT devices because accurate time is needed for logs, certificates, scheduling, and telemetry. Public NTP use may raise policy questions, but by itself it does not indicate botnet propagation or compromise.
- C. Incorrect.
Incorrect. Uploading video or telemetry to a vendor cloud endpoint over HTTPS can be normal behavior for internet-connected cameras, assuming this aligns with the device's documented features and deployment model. While cloud exfiltration could be abused in some cases, the scenario specifically describes internet-wide Telnet scanning and credential spraying, which is a much stronger indicator of botnet propagation.
- D. Incorrect.
Incorrect. DHCP lease renewal and DNS lookups to an internal resolver are routine network behaviors. These actions do not indicate that the device is attempting to spread malware or join a botnet.