IoT manufacturers should take heed from the recent Mirai DDoS attacks.
Late last year, a widespread attack on Dyn DNS “Managed DNS” infrastructure wreaked havoc across the internet and brought down a number of major websites, including PayPal, Twitter, Amazon, Netflix, GitHub, and Reddit. Instead of going after the sites directly, Mirai targeted the web’s domain name system (DNS), which acts as an “address book” that matches common domain names, such as Amazon.com, with their corresponding DNS addresses, which are what browsers use to locate the site’s web server and load its content. The source of the attack was an open source malware strain called Mirai, which works by infecting vulnerable IoT devices, such as routers, printers, webcams, even DVRs.
How does Mirai infect IoT devices?
The Mirai malware takes advantage of a very serious vulnerability in IoT devices: the fact that most users do not change the default passwords their devices are shipped with, either because they don’t know how, they don’t realize the importance of doing so, or both. In some cases, the login credentials may be encoded in the device’s firmware, making it difficult or impossible for end users to change them. Meanwhile, manufacturer default passwords are widely available online. There are 68 user name and password combinations in the Mirai botnet source code, many of which are used for multiple IoT devices made by the same manufacturers. Therefore, just one set of credentials could allow a hacker to access hundreds, possibly thousands of devices.
Hackers use Mirai to scan the internet for specific devices, then attempt to access them using their manufacturer default credentials. Once hackers access a device, they turn it into a “zombie” – often without the device’s owner even realizing it. Once a large number of “zombie” devices have been amassed, they are used to flood specific web servers with so many junk requests that they slow to a crawl or crash.
IoT Manufacturers Have Been Put on Notice
Cyber security issues have plagued the IoT industry for years, and as these devices proliferate, cyber attacks that involve connected devices are becoming more frequent and more serious. Yet, as discussed in a previous blog, only 10% of organizations have a cyber security plan to address the Internet of Things, and 68% have no methods for testing IoT devices. Meanwhile, nearly 60% of consumers report being “very” or “highly concerned” about IoT security.
As a result of the Mirai malware attack, Chinese manufacturer Hangzhou Xiongmai voluntarily recalled its home webcams, and it’s possible that we’ll see more recalls if and when Mirai rears its head again. Of course, IoT manufacturers could and must take proactive steps to prevent these sorts of attacks in the first place. IoT devices should be configured to require users to change the default credentials the first time they log in, preferably to a strong password, and manufacturers should never hard-code credentials into a device’s firmware.
Unfortunately, the Mirai malware isn’t going anywhere, and if IoT manufacturers do not step up to the plate, it could be altered for use in even more insidious attacks in the future.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.