[News] Internet of Things bracing for Mirai botnet expansion

[StyM]

http://www.bit-tech.net/news/bits/20...ansion-mirai/1

Security experts are warning of a potential increase in distributed denial of service attacks (DDoS) powered by Internet of Things (IoT) products, from IP cameras to thermostats, following the release of the Mirai botnet source code.

The Internet of Things (IoT), the latest name giving to what is essentially a mixture of machine-to-machine (M2M) communications and adding 'intelligence' in the form of embedded computers to everyday objects, brings plenty of good into people's lives. From being able to unlock your front door with your smartphone or adjust the temperature of your heating system before you even get home, IoT products are designed to make life easier. In their rush to get to market, however, many manufacturers are failing to keep their users secure. Many IoT devices are based on outdated operating systems with known security vulnerabilities running code that has never been properly tested for its robustness, often with default and baked-in username and password combinations; few of these, too, are ever updated by companies.

The potential for malicious misuse of IoT devices, which by their very nature can run code and are connected to the internet, was adeptly proven by the Mirai botnet which has been responsible for some of the largest distributed denial of service (DDoS) attacks in history. Now, the source code for that botnet is publicly available, having been released on the Hackforums site over the weekend.

'My guess is that (if it?s not already happening) there will soon be many Internet users complaining to their ISPs about slow Internet speeds as a result of hacked IoT devices on their network hogging all the bandwidth. On the bright side, if that happens it may help to lessen the number of vulnerable systems,' predicated Brian Krebs in a report on the source code release this weekend. 'On the not-so-cheerful side, there are plenty of new, default-insecure IoT devices being plugged into the Internet each day. Gartner Inc. forecasts that 6.4 billion connected things will be in use worldwide in 2016, up 30 percent from 2015, and will reach 20.8 billion by 2020. In 2016, 5.5 million new things will get connected each day, Gartner estimates.'

'Manufacturers must do a better job of either insuring that each device has a unique default password, or they must force users to change the password once the default is entered, when the device is first installed,' added Nsfocus chief intelligence analyst Stephen Gates. 'If this problem is not solved on a global scale, Mr. Krebs is correct. Soon we may see DDoS attacks that are capable of taking down major portions of the Internet, as well as causing brownouts, creating intolerable latency, or making the Internet unusable. This is all collateral damage caused by a failure of good judgement by using the same factory default passwords on IoT devices in the first place.'

[drmrlordx]

Unfortunately, many of the devices likely compromised by Mirai are insecure by design, full of backdoors that l33+ h4x0rz are likely exploiting for their own gain. Simply changing default passwords just won't do the trick.

[Sparky]

Despite being a geek I am (so far) actively avoiding such things. Just seems like way too many risks or issues with such devices.

[drmrlordx]

Agreed, "smart" devices are best left offline unless you're sure they meet the minimum security standards for your home network. Not to speak of the office. The most disturbing is that a lot of IP cameras are problems, too, and a lot of business have/want those.

[Sparky]

I'm doing my own thing with IP cameras that are intranet-only and use something like iSpy or the likes to control them. The only thing you can really do from the web interface on the cameras is to change the IP configuration, and you can't hit them from the internet anyway without breaking down my firewall since it has zero port forwards or connections to any of the cameras. You'd have to access the server PC, which yes does have port connections to the internet for obvious reasons, but I currently don't even have any ports forwarded for iSpy usage outside of home (just haven't gotten there yet and when I do it won't be default anything).