A compromised IoT device is initiating random connections to an attacker's server in order to exfiltrate sensitive dat a. Which type of attack is being used?

A reverse shell is a session initiated from a compromised target machine back to an attacker's listening server. This technique is frequently used to bypass network firewalls that typically filter incoming connections but allow outgoing traffic. In this scenario, the compromised IoT device is initiating the connection outbound to the attacker's server. This establishes a command-and-control channel, allowing the attacker to execute commands remotely and exfiltrate sensitive data, which is the exact behavior described.

A. Man-in-the-middle (MITM): This attack involves an attacker intercepting and relaying communication between two legitimate parties, not a direct connection initiated from a victim to an attacker.
B. SSL session hijack: This involves stealing a valid session token to take over an existing authenticated session, which is different from creating a new, malicious outbound connection.
D. Honeypot: This is a decoy system set up by defenders to attract and analyze attacks; it is a defensive tool, not an attack method used by a compromised device.

1. Erickson, J. (2008). Hacking: The Art of Exploitation, 2nd Edition. No Starch Press. In Chapter 0x300, "Networking," the concept of shellcode is discussed, including bind shells (attacker connects to victim) and reverse shells (victim connects to attacker). Section 0x363, "Reverse Shell," explicitly details how the target machine initiates the connection back to the attacker to bypass firewalls.

2. Balasundaram, S., & Ramaraj, E. (2022). A Survey on Reverse Shell Attack. 2022 International Conference on Advanced Computing and Communication Systems (ICACCS), 1, 1580-1585. The paper defines a reverse shell: "In a reverse shell attack, the target machine communicates back to the attacking machine. The attacking machine has a listener port on which it receives the connection, and by which code execution or command execution can be achieved." (Section II.A). DOI: https://doi.org/10.1109/ICACCS54159.2022.9785189

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Lecture 15: Network Security. The lecture notes discuss network firewalls and their typical configuration to block incoming connections while allowing outgoing ones. This provides the fundamental rationale for why attackers use reverse shells—to establish a connection from inside the protected network to the outside world. (Available at: https://ocw.mit.edu/courses/6-858-computer-systems-security-fall-2014/)