Internet of Things botnets: You ain’t seen nothing yet

Internet of Things (IoT) botnet "Mirai" is the shape of things to come and future assaults could be even more severe, a leading security research firm warns.

Mirai powered the largest ever DDoS attack ever, spawning a 620Gbps DDoS against KrebsOnSecurity. Source code for the malware was released on hacker forums last week.

The malware relied on factory default or hard-coded usernames and passwords to compromise vulnerable IoT devices such as insecure routers, IP cameras, digital video recorders and the like.

PenTestPartners, the UK security consultancy behind numerous hack on Iot devices ranging from Wi-Fi enabled kettles to cars, said that the botnet finally illustrates the consequences of IoT vendors cutting the corners on security.

“We’ve said many times previously that IoT would make for the perfect botnet: Easy to compromise, hard to patch and the owner likely won’t ever have a clue that they’re part of the botnet,” PenTestPartners notes.

PenTestPartners warns that tweaks in the techniques used by black hats could be used to develop an even more potent threat. “This piece could be misconstrued as educating the DDoSser,” the firm explains in a disclaimer. “It isn’t – they will already have worked this improved attack out for themselves. This article is about ensuring that everyone knows what to expect in future and to help mitigate the effects.”

Future IoT bots could use the web rather than Telnet (as used by Mirai), making it far harder for ISPs to block attack traffic. Using the web also offers increased stealth.

PenTestPartners - which doesn’t sell DDoS mitigation services itself - is making its warning in order to encourage more diligence in applying available firmware updates to IP CCTV cameras and other IoT devices as advocating greater use of network segmentation as a defensive strategy.

Independent infosec consultant Brian Honan, the founder and head of Ireland’s CERT, welcomed PenTestParners’ take on the implications of IoT insecurity for wider internet hygiene.

“For much of IoT security the focus of attention and research is on better securing the devices themselves and on protecting the privacy of the device owners,” Honan said. “However, we overlook that insecure devices can have bigger implications, as these devices can be, and indeed have been, used to undermine the security of other systems. The recent DDoS attack, one of the biggest yet seen, on Brian Kreb's website is a shining example of how insecure devices can be leveraged to attack others.”

Ryan Lester, director of IoT strategy at Xively by LogMeIn, commented: "Many companies use security shortcuts such as embedded private keys or weak authentication to speed up the development phase of IoT but this approach is quite risky. A rigorous assessment of the security implications may increase the cost of development, but it will save time and the cost of flaws discovered down the road."®