In October 2016, hackers exploited unsecure networks and used webcams, DVRs and other Internet-connected devices to launch a massive Distributed Denial of Service (DDoS) attack that brought down nearly 80 websites including Netflix, CNN and Pinterest.
A DDoS attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. This attack was unusual in that it used tens of millions of IP addresses to attack a Domain Name System (DNS) company that directs users to major websites instead of directly attacking the targeted websites. DNS converts the website name entered into a browser (e.g., http://www.netflix.com/) into machine-readable Internet IP addresses such as 52.72.161.241.
These hackers used devices infected with the Mirai botnet to carry out the attack. According to Wired, “Mirai is a type of malware that automatically finds Internet of Things (IoT) devices to infect and conscripts them into a botnet—a group of computing devices that can be centrally controlled. From there this IoT army can be used to mount DDoS attacks in which a firehose of junk traffic floods a target’s servers with malicious traffic.”
The Internet of Things (IoT) connects everything from cameras and DVRs to thermostats and smart lightbulbs to the Internet, often with little or no security. This lack of security, and the fact that there are billions of these devices connected to the Internet, makes the IoT a powerful weapon for the bad guys. Many of the IoT devices used in this attack were made by a Chinese company called XiongMai. These devices use a default password which is easily compromised by malware, a trait shared with many other IoT devices.
Although it is probably not possible to stop all IoT devices from being compromised, there are steps consumers can take to protect their devices. NextAdvisor recommends that users always change default passwords when connecting a new device to the Internet, always use a password-protected Internet connection and pay attention to recalls of IoT devices. According to KrebsOnSecurity, even these steps will not solve the problem in many cases and it will be up to manufacturers to make devices that are more secure.
