Something major happened in October. Internet of Things (IoT) devices were exploited by cybercriminals and turned into a rogue and malevolent army. A series of distributed denial of service (DDoS) attacks affected websites connected to the cloud-based internet performance management company Dyn, including Amazon, Twitter, Reddit, Spotify and PayPal. It’s possibly a watershed moment.
“We have been shown just how vulnerable the internet – which is now an integral part of the critical infrastructure of the US and many other countries – is to disruptive abuse conducted at scale, by persons whose identity is not immediately ascertainable,” ESET’s Stephen Cobb concluded in his analysis of the event.
Now, with Christmas upon us and the increasingly volatile world markets never more dependent upon online transactions, everyone is desperate to stop repeat attacks.
- Wait, what’s IoT?
Definitions vary, but the ‘Internet of Things’ refers to ‘smart devices’ like refrigerators that will tell us when we’re out of milk. But also, many smaller less outlandishly smart objects, such thermostats, coffee machines and cars. These gadgets are embedded with electronics, software, sensors and network connectivity so that they can connect to the internet.
- So, what’s the problem?
Anything that connects to the internet, even if it doesn’t contain your medical records, poses a risk. The October 21st attacks were made possible by the large number of unsecured internet-connected digital devices, such as home routers and surveillance cameras.
The attackers infected thousands of them with malicious code to form a botnet. Now, this is not a sophisticated means of attack, but there is strength in numbers. They can be used to swamp targeted servers, especially if they march in all at once.
- How did the attacks actually happen?
Remember that bit in the instruction manual where it told you to change the default password? Well, if you didn’t, then chances are your IoT device could spring to life as a cyber zombie. The DDoS-attackers know the default passwords for many IoT devices and used them to get in. It’s a bit like leaving your house keys under a flowerpot for anyone to find.
Anyone putting an IoT router, camera, TV or even refrigerator online without first changing the default password is enabling attacks of this type. Recent ESET research suggests at least 15% of home routers are unsecured – that’s an estimated 105 million potentially rogue routers.
- Wait, do I need IoT devices?
Some people dismiss IoT devices as gimmicky; others believe that in a few years we’ll all have smart cupboards that tell us what we can have for dinner. But there are numerous discernible benefits, such as the sensors in smartphones and smartwatches that provide real information about our health. Or the “blackbox” telematics in cars which can prove how safe or unsafe our driving is and thus help with insurance claims.
- So, this is a new problem?
Nope. The possibility for exploitation of this kind has been common knowledge since, well, the dawn of IoTs. But, we didn’t realize quite how vulnerable we were until October. Malicious code infecting routers is nothing new, as this ESET research clearly demonstrates.
The advice to change the default passwords on these devices is definitely not new and has been reiterated many times. Yet you can lead a horse to water, but there’s no making them drink. Two years ago WeLiveSecurity reported on the existence of 73,000 security cameras with default passwords.
- How far does it go back?
The IoT actually goes way back as far as the 1980s. But in a slightly Back to the Future iteration. Researchers at Carnegie Mellon University first came up with an internet-connected Coke vending machine in 1982.
- Surely, internet giants have the power to stop this?
Sure they do. But that doesn’t mean some of them haven’t left gaping holes available for malicious exploitation. At the Black Hat security conference last year, security research students from University of Central Florida demonstrated how they could compromise Google’s Nest thermostat within 15 seconds.
Daniel Buentello, one of the team members, was quoted as saying in 2014: “This is a computer that the user can’t put an antivirus on. Worse yet, there’s a secret backdoor that a bad person could use and stay there forever. It’s a literal fly on the wall.”
- What can I personally do to stop this?
Look at IoT devices like any other computer. Immediately change the default password and check regularly for security patches, and always use the HTTPS interface when possible. When you’re not using the device, turn it off. If the device has other connection protocols that are not in use, disable them.
These things might sound simple, but you’d be alarmed by how easy it is to opt for convenience over good sense. Only half of respondents to this ESET survey indicated that they’d changed their router passwords.
- What can companies do to stop this?
You might think, ‘What’s the point? If an attacker can breach Amazon, then what hope does my firm have?’ Well, don’t give up hope. Organizations can defend against DDoS attacks in a range of ways including boosting the infrastructure of their networks and ensuring complete visibility of the traffic entering or exiting their networks. This can help detect DDoS attacks, while ensuring they’ve sufficient DDoS mitigation capacity and capabilities. Finally, have in place a DDoS defense plan, which is kept updated and is rehearsed on a regular basis.
Think of it like a fire drill for your network. Also, watch out for Telnet servers. These are the dinosaurs of the digital universe and as such should be extinct, because they’re so easily exploited. Never connect one to a public-facing device.
- But … and this is a big but …
The tech might have been around for a while but these kinds of attacks are brand new. As such there are no agreed best practice protection methods for stopping an IoT from turning against you.
At least, not ones that the experts can agree on. Some believe you should apply a firewall in your home or business and to regulate control of them to authorized users. However, another method would be to apply a certification approach: allowing only users with the right security certificate to control the devices and automatically barring any unauthorized profiles. If in doubt, unplug it.
Author Editor, ESET
