A Practical Approach to Protect IoT Devices against Attacks and Compile Security Incident Datasets

Table 2

BPF expression to mitigate CVE-2018-17173 vulnerability.

BPF expression	ip[2 : 2] > 0x008A and ip[9] == 0x06 and tcp[2 : 2] == 0x2378 and tcp[32] == 0x47 and tcp[77 : 4] == 0x3d253237 and tcp[81 : 4] == 0x2532302d and tcp[85] == 0x3b
BPF assembler code				Bytecode
(000) ldh	[12]			22
(001) jeq	#0x800	jt 2	jf 21	40 0 0 12
(002) ldh	[16]			21 0 19 2048
(003) jgt	#0x8a	jt 4	jf 21	40 0 0 16
(004) ldb	[23]			37 0 17 138
(005) jeq	#0x6	jt 6	jf 21	48 0 0 23
(006) jeq	#0x6	jt 7	jf 21	21 0 15 6
(007) ldh	[20]			21 0 14 6
(008) jset	#0x1fff	jt 21	jf 9	40 0 0 20
(009) ldxb	4  ([14]&0xf)			69 12 0 8191
(010) ldh	[x + 16]			177 0 0 14
(011) jeq	#0x2378	jt 12	jf 21	72 0 0 16
(012) ldb	[x + 46]			21 0 9 9080
(013) jeq	#0x47	jt 14	jf 21	80 0 0 46
(014) ld	[x + 91]			21 0 7 71
(015) jeq	#0x3d253237	jt 16	jf 21	64 0 0 91
(016) ld	[x + 95]			21 0 5 1025847863
(017) jeq	#0x2532302d	jt 18	jf 21	64 0 0 95
(018) ldb	[x + 99]			21 0 3 624046125
(019) jeq	#0x3b	jt 20	jf 21	80 0 0 99
(020) ret	#262144			21 0 1 59
(021) ret	#0			6 0 0 262144
				6 0 0 0
Iptables commands
iptables -t filter -A INPUT -m bpf --bytecode “22,40 0 0 12,21 0 19 2048,40 0 0 16,37 0 17 138,48 0 0 23,21 0 15 6,21 0 14 6,40 0 0 20,69 12 0 8191,177 0 0 14,72 0 0 16,21 0 9 9080,80 0 0 46,21 0 7 71,64 0 0 91,21 0 5 1025847863,64 0 0 95,21 0 3 624046125,80 0 0 99,21 0 1 59,6 0 0 262144,6 0 0 0” -j DROP
iptables -t filter -A INPUT -m bpf --bytecode “22,40 0 0 12,21 0 19 2048,40 0 0 16,37 0 17 138,48 0 0 23,21 0 15 6,21 0 14 6,40 0 0 20,69 12 0 8191,177 0 0 14,72 0 0 16,21 0 9 9080,80 0 0 46,21 0 7 71,64 0 0 91,21 0 5 1025847863,64 0 0 95,21 0 3 624046125,80 0 0 99,21 0 1 59,6 0 0 262144,6 0 0 0” -j LOG --log-prefix “Filter.tlk”