On Oct. 21, 2016, an extremely large distributed denial-of-service (DDoS) attack on Dyn prevented many internet users on the East Coast of the U.S. from accessing websites such as Netflix, PayPal, Spotify and Twitter for several hours. Dyn provides domain name system (DNS) services to other businesses. DNS services resolve web addresses into IP addresses, which is necessary for users’ web browsers to connect with web providers’ servers. The DDoS attack on Dyn was reportedly similar to the 620 gigabits of traffic per second that targeted Brian Krebs’ website, KrebsOnSecurity, on Sept. 20, 2016. Later in September 2016, a DDoS attack against webhost provider OVH broke the record for largest recorded DDoS attack, with attack rates of at least 1.1 terabits per second.
These historically large DDoS attacks were made possible when attackers used the “Mirai” malware to capture internet of things (IoT) devices and herd them into botnet armies that attackers used to send massive amounts of traffic to targeted servers. The IoT devices used in the attacks were primarily internet-connected cameras but also included internet routers, digital video recorders and internet-connected printers. The attackers’ tasks were made easier, as Brian Krebs reported, because the devices were deployed with standard default user names and passwords, which users had not changed. Even if users deployed the IoT device behind routers, which should have made them unreachable from the internet, the devices use technology known as universal plug and play (UPnP), which automatically opens ports to enable reaching the devices from the internet. If users had changed the default user names and passwords on the devices’ web interfaces, that may not have changed the default user names and passwords for telnet or SSH access to the devices, which the Mirai malware uses to communicate with the devices.
The threat that additional DDoS attacks will be launched using Mirai malware and vulnerable IoT devices increased substantially when the source code for the Mirai malware was posted online at the end of September 2016.
According to Krebs, a Chinese company, XiongMai Technologies, admitted that it had sold networked cameras until September 2015 that were accessible by attackers using Mirai malware. XiongMai said that it planned to recall the vulnerable products.
Even if XiongMai recalls and replaces its pre-2015 devices with devices that cannot be compromised by Mirai or similar malware, billions of other vulnerable IoT devices will remain. U.S. Senator Mark Warner, in a letter to Federal Communications Commission (FCC) Chairman Tom Wheeler, quoted a Juniper Networks estimate that by the end of 2020 there will be 13.4 to 38.5 billion IoT devices. Roland Dobbins, a principal engineer at Arbor Networks is quoted in Wired as stating, “I’m not worried about the future, I’m worried about the past, because there are all these zillions of devices out there that are ripe for exploitation.”
Given that currently deployed IoT devices can serve as a platform for DDoS attacks that can take down large internet companies, the internet itself is at risk. As Senator Warner stated in his letter to Chairman Wheeler, “[w]hile the internet was not designed with security in mind, its resiliency – which serves as its animating principle – is now being undermined.” Security expert Bruce Schneier was more blunt about the IoT DDoS threat: “We simply have to fix this. … This problem is only...
