The Channel logo


By | John Leyden 10th October 2016 13:02

Internet of Things botnets: You ain’t seen nothing yet

SSSh*t just got real

Internet of Things (IoT) botnet "Mirai" is the shape of things to come and future assaults could be even more severe, a leading security research firm warns.

Mirai powered the largest ever DDoS attack ever, spawning a 620Gbps DDoS against KrebsOnSecurity. Source code for the malware was released on hacker forums last week.

The malware relied on factory default or hard-coded usernames and passwords to compromise vulnerable IoT devices such as insecure routers, IP cameras, digital video recorders and the like.

PenTestPartners, the UK security consultancy behind numerous hack on Iot devices ranging from Wi-Fi enabled kettles to cars, said that the botnet finally illustrates the consequences of IoT vendors cutting the corners on security.

“We’ve said many times previously that IoT would make for the perfect botnet: Easy to compromise, hard to patch and the owner likely won’t ever have a clue that they’re part of the botnet,” PenTestPartners notes.

PenTestPartners warns that tweaks in the techniques used by black hats could be used to develop an even more potent threat. “This piece could be misconstrued as educating the DDoSser,” the firm explains in a disclaimer. “It isn’t – they will already have worked this improved attack out for themselves. This article is about ensuring that everyone knows what to expect in future and to help mitigate the effects.”

Future IoT bots could use the web rather than Telnet (as used by Mirai), making it far harder for ISPs to block attack traffic. Using the web also offers increased stealth.

PenTestPartners - which doesn’t sell DDoS mitigation services itself - is making its warning in order to encourage more diligence in applying available firmware updates to IP CCTV cameras and other IoT devices as advocating greater use of network segmentation as a defensive strategy.

Independent infosec consultant Brian Honan, the founder and head of Ireland’s CERT, welcomed PenTestParners’ take on the implications of IoT insecurity for wider internet hygiene.

“For much of IoT security the focus of attention and research is on better securing the devices themselves and on protecting the privacy of the device owners,” Honan said. “However, we overlook that insecure devices can have bigger implications, as these devices can be, and indeed have been, used to undermine the security of other systems. The recent DDoS attack, one of the biggest yet seen, on Brian Kreb's website is a shining example of how insecure devices can be leveraged to attack others.”

Ryan Lester, director of IoT strategy at Xively by LogMeIn, commented: "Many companies use security shortcuts such as embedded private keys or weak authentication to speed up the development phase of IoT but this approach is quite risky. A rigorous assessment of the security implications may increase the cost of development, but it will save time and the cost of flaws discovered down the road."®

comment icon Read 57 comments on this article or post a comment alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


Suit-and-tie-wearing man tries to meditate, take deep breaths in faux yoga pose. Photo by Shutterstock
Emotional intelligence, not tech skills, is the way to woo suits
League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe