Perimeter

1/31/2018
01:00 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

IoT Botnets by the Numbers

IoT devices are a botherder's dream attack-vector.
Previous
1 of 10
Next

Image Source: Adobe Stock

Image Source: Adobe Stock

Even before Mirai burst onto the scene a year-and-a-half ago, security experts had been warning anyone who listened about how juicy Internet of things (IoT) devices were looking to criminal botnet herders. Proliferating faster than black t-shirts at a security conference, IoT sensors have spread throughout our personal and business lives inside cameras, automobiles, TVs, refrigerators, wearable technology, and more.

They offer the perfect combination of variables for attackers seeking an ideal botnet node: ubiquity, connectivity, poor default settings, rampant software vulnerability - and utter forgetability. Once these devices are deployed, they're rarely patched or even monitored. So it was only a matter of time before cybercriminals started harvesting them for botnet operations.

Mirai offered one of the first large-scale implementations of IoT botnets, and since its inception in late 2016 the attacks have been relentless.

Here is a rundown of some of the most relevant stats around IoT botnet attacks.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 10
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
2/5/2018 | 7:18:27 PM
Re: Frightening? Gets worse
@REISEN: I wouldn't put implanted medical devices in the same risk category as "smart" home appliances.  You have a couple of layers of added safeguard protection.

Your doctors and the device maker are responsible (in both senses of the word).  It's also probable that your device can't be reprogrammed remotely.  Interception and misuse of your device's sensor data is technically possible; but hard to imagine anyone wanting to.  Contact your doctor, if you need more reasons not to worry about it.  -- Wish you well.  
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/5/2018 | 2:12:23 PM
Frightening? Gets worse
I am the owner of an internal defibulator (could be a pacemaker for arguments sake) and it has a wireless output to a small box in my kitchen to transmit data and box by phone to hospital.  Now I wonder about that? 
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
2/5/2018 | 11:53:57 AM
Re: Why is anybody surprised?
"...computer systems have proven to be vulnerable, why should we trust IOT personal items to be any different?"  In some ways IOT is worse - principally, in that compromise is less noticeable, until it's painfully obvious.  Even when attackers make no special effort to remain undetected, IoT device processing is generally not user interactive, and a hack doesn't have to be disruptive: "Ah! The fridge door located at this address hasn't been opened in 3 days; I bet they're out of town."
rjones2818
50%
50%
rjones2818,
User Rank: Strategist
2/5/2018 | 10:40:09 AM
Why is anybody surprised?
The fault lies with the companies who have unleashed an immature technology upon the world in a rush to grub for more money.  Many regular computer systems have proven to be vulnerable, why should we trust IOT personal items to be any different?
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
2/5/2018 | 9:23:43 AM
Don't want no IoT
It's hard to find appliances, cars, office equipment without IoT anymore.  And it's frightening.  I have a pretty old kitchen, so I'm not worred about it, but when things break down will anything I choose include IoT comms on it?  Will I have the choice of turning off any communication?  How will this affect self driving cars.  This really is could become very scary.

I agree with the 1st post.  We've reared of a generation of me, dependent, and spoiled.  Far in between there are golden nuggets, but they may not be easy to find.
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/31/2018 | 3:36:30 PM
Brought to justice?
"...three creators of Mirai come to justice..."  5 years and $250k fines are a lot for people that didn't kill anyone; but trivial compared to the economic damage they  caused.  I hope we all realize that economic damage can severely damage lives - even fataly. 

"...developed Mirai in their dorm room."  That highlights the culture component of the problem.  Solutions there will be difficult and generational. 
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.