Recent DDos Attack Exploits Internet of Things (IoT)
Last week I wrote about the cyber-attack that took out huge portions of the Internet has now led to a major product recall. Hangzhou Xiongmai Technology, a Chinese electronics company, has acknowledged that weak default passwords on many of its devices were partly to blame for the October 21 attack.
The components maker, which builds parts for everything from security cameras to digital recorders, said it would be recalling millions of Web-enabled cameras that were sold in the U.S. The company described the attack as a major blow to the Internet of Things movement, saying it has shaken customer confidence in the level of security of all Internet-capable devices.
Despite the surprise and devastation achieved during Friday’s attack, it was not inevitable. In fact, Hangzhou Xiongmai reported that it first became aware that some of its cameras had a security flaw last year. The company issued a firmware update to fix the issue last September and urged customers to change the password from the default setting.
Only devices that were sold before April 2015 failed to update their firmware. Those devices were still using the default password and were connected to the Internet when they were exploited.
Hangzhou Xiongmai has now agreed to recall up to 4 million products. While the company primarily makes components for industrial and commercial devices, such as surveillance equipment for banks, stores, and residential areas, most of the devices it sells in the U.S. are for personal and consumer use. That might explain why so many devices were running old firmware using the default password.
Dealing with the Internet of Things
Friday’s attack managed to take out huge parts of the Internet throughout the United States including popular sites such as Twitter and Netflix, by targeting Dyn Inc., a New Hampshire-based company responsible for providing much of the domain name service infrastructure in the US. The group responsible for the attack was able to overwhelm Dyn’s servers with a distributed denial of service attack.
To achieve their goal, the hackers used a malware tool known as Mirai to take control of IoT devices, such as security cameras, using Hangzhou Xiongmai’s hardware components to form a botnet. Once under the hackers’ control, the botnet was able to generate fake network traffic from tens of millions of IP addresses, overwhelming Dyn’s ability to respond.
This was one of the largest and most sophisticated attacks against a major Internet infrastructure provider in history. And the use of IoT devices, rather than laptops or desktops, may represent a chilling new development in the annals of cybercrime.
Such devices are expected to proliferate in the coming years, and many continue to lack sufficient security safeguards. Friday’s attack may prove to be only a glimpse of what’s to come.