A longitudinal Measurement and Analysis Study of Mozi, an Evolving P2P IoT Botnet
Binglai Wang, Yafei Sang, Yongzheng Zhang, Shuhao Li, Xiaolin Xu · 2022
Due to the remarkable diversity and ubiquity of IoT devices, many IoT botnets like Mirai and Hajime are inclined to infect vulnerable embedded devices to achieve the purpose of scale expansion and future attacks. Nowadays, a novel, evolving P2P botnet in the wild, named Mozi, targets numerous devices but substantially differs in many aspects involving self-proliferation, network control, and distribution situations. To uncover the curtain, throughout detailed measurement–a novel active probing approach (namely Bawa) for tracking Mozi’s dynamic topology infrastructure and passive collection of Mozi binaries and its download URLs, we provide a holistic view of Mozi, including its scale and geographic distribution. The dataset1collected in a passive mode is available to assist in tracking and mitigating the Mozi botnet’s expansion.