  Consumer IoT devices may suffer malware attacks, and be recruited into
botnets or worse. There is evidence that generic advice to device owners to
address IoT malware can be successful, but this does not account for emerging
forms of persistent IoT malware. Less is known about persistent malware, which
resides on persistent storage, requiring targeted manual effort to remove it.
This paper presents a field study on the removal of persistent IoT malware by
consumers. We partnered with an ISP to contrast remediation times of 760
customers across three malware categories: Windows malware, non-persistent IoT
malware, and persistent IoT malware. We also contacted ISP customers identified
as having persistent IoT malware on their network-attached storage devices,
specifically QSnatch. We found that persistent IoT malware exhibits a mean
infection duration many times higher than Windows or Mirai malware; QSnatch has
a survival probability of 30% after 180 days, whereby most if not all other
observed malware types have been removed. For interviewed device users, QSnatch
infections lasted longer, so are apparently more difficult to get rid of, yet
participants did not report experiencing difficulty in following notification
instructions. We see two factors driving this paradoxical finding: First, most
users reported having high technical competency. Also, we found evidence of
planning behavior for these tasks and the need for multiple notifications. Our
findings demonstrate the critical nature of interventions from outside for
persistent malware, since automatic scan of an AV tool or a power cycle, like
we are used to for Windows malware and Mirai infections, will not solve
persistent IoT malware infections.
