  In recent years, the emerging Internet-of-Things (IoT) has led to rising
concerns about the security of networked embedded devices. In this work, we
focus on the adaptation of Honeypots for improving the security of IoTs.
Low-interaction honeypots are used so far in the context of IoT. Such honeypots
are limited and easily detectable, and thus, there is a need to find ways how
to develop high-interaction, reliable, IoT honeypots that will attract skilled
attackers. In this work, we propose the SIPHON architecture - a Scalable
high-Interaction Honeypot platform for IoT devices. Our architecture leverages
IoT devices that are physically at one location and are connected to the
Internet through so-called wormholes distributed around the world. The
resulting architecture allows exposing few physical devices over a large number
of geographically distributed IP addresses. We demonstrate the proposed
architecture in a large scale experiment with 39 wormhole instances in 16
cities in 9 countries. Based on this setup, six physical IP cameras, one NVR
and one IP printer are presented as 85 real IoT devices on the Internet,
attracting a daily traffic of 700MB for a period of two months. A preliminary
analysis of the collected traffic indicates that devices in some cities
attracted significantly more traffic than others (ranging from 600 000 incoming
TCP connections for the most popular destination to less than 50000 for the
least popular). We recorded over 400 brute-force login attempts to the
web-interface of our devices using a total of 1826 distinct credentials, from
which 11 attempts were successful. Moreover, we noted login attempts to Telnet
and SSH ports some of which used credentials found in the recently disclosed
Mirai malware.
