  The ubiquitous nature of the IoT devices has brought serious security
implications to its users. A lot of consumer IoT devices have little to no
security implementation at all, thus risking user's privacy and making them
target of mass cyber-attacks. Indeed, recent outbreak of Mirai botnet and its
variants have already proved the lack of security on the IoT world. Hence, it
is important to understand the security issues and attack vectors in the IoT
domain. Though significant research has been done to secure traditional
computing systems, little focus was given to the IoT realm. In this work, we
reduce this gap by developing a honeypot framework for IoT devices.
Specifically, we introduce U-PoT: a novel honeypot framework for capturing
attacks on IoT devices that use Universal Plug and Play (UPnP) protocol. A
myriad of smart home devices including smart switches, smart bulbs,
surveillance cameras, smart hubs, etc. uses the UPnP protocol. Indeed, a simple
search on Shodan IoT search engine lists 1,676,591 UPnP devices that are
exposed to public network. The popularity and ubiquitous nature of UPnP-based
IoT device necessitates a full-fledged IoT honeypot system for UPnP devices.
Our novel framework automatically creates a honeypot from UPnP device
description documents and is extendable to any device types or vendors that use
UPnP for communication. To the best of our knowledge, this is the first work
towards a flexible and configurable honeypot framework for UPnP-based IoT
devices. We released U-PoT under an open source license for further research
and created a database of UPnP device descriptions. We also evaluated our
framework on two emulated deices. Our experiments show that the emulated
devices are able to mimic the behavior of a real IoT device and trick
vendor-provided device management applications or popular IoT search engines
while having minimal performance ovherhead.
