The nation’s growing attachment to an “Internet of Things” likely helped hackers launch a massive distributed denial-of-service attack that led to problems on numerous major websites on Friday, Dyn, the company that manages much of the Internet’s infrastructure, said Friday.
“This was not your everyday DDoS attack,” Dyn chief strategist Kyle York told The New York Times. “The nature and source of the attack is under investigation.”
Friday’s attack, which caused issues for users on Twitter, Netflix, Spotify, Airbnb, The New York TImes, Reddit, Etsy, SoundCloud and more, seems to have used the hundreds of thousands of Internet-connected devices to spread.
Such devices, like baby monitors, home routers, cameras, and more appear to have been infected with software that allow hackers to take down servers by flooding them with too much traffic.
Dyn’s servers monitor internet traffic and reroute it, and reported the attack just after 7 a.m. Friday. At first, the attacks made sites inaccessible on the East Coast, but in three waves, the attack spread nationwide.
The Federal Bureau of Investigation and the Department of Homeland Security are investigating the attack to determine its roots, including the possibility that a nation-state attack could be to blame.
However, security experts have been warning for year that the ever-widening number of devices being connected online could lead to breaches and online attacks.
Dyn, which is based in Manchester, New Hampshire, said that by 9:30 a.m., the first assault was stopped, but at 11:52 a.m., its servers were again attacked, and then under a traffic deluge again at 5 p.m.
By going after Dyn, the attackers were able to hit multiple websites.
Dyn hosts the Domain Name System, or DNS, which translates web addresses into numerical code that allows computers to communicate. Without the DNS servers operated by internet service providers, the internet could not operate.
Friday’s attacks didn’t go after the websites themselves, but still blocked the sites or slowed down access to them.
Dave Allen, general counsel for Dyn, said tens of millions of internet addresses were used to flood the company’s servers, and most came from connected devices infected with Mirai, a form of malware.
Last week, it was determined that 493,000 devices has been infected with the malware, or double the amount infected last month.
Meanwhile, elections officials are concerned that a similar attack could keep citizens from voting online.
In 31 states, along with the District of Columbia, people overseas, including in the military and civilians, can vote online.
“A DDoS attack could certainly impact these votes and make a big difference in swing states,” Dr. Barbara Simons, a member of the board of advisers to the federal Election Assistance Commission, told The TImes. “This is a strong argument for why we should not allow voters to send their voted ballots over the internet.”
