IoT under fire

October 2019 Home Security, Cyber Security

Kaspersky honeypots – networks of virtual copies of various Internet-connected devices and applications – have detected 105 million attacks on IoT devices coming from 276 000 unique IP addresses in the first six months of the year. This figure is around nine times more than the number found in H1 2018, when only around 12 million attacks were spotted originating from 69 000 IP addresses. Capitalising on weak security of IoT products, cybercriminals are intensifying their attempts to create and monetise IoT botnets. This and other findings are a part of the ‘IoT: a malware story’ report on honeypot activity in H1 2019.

Cyberattacks on IoT devices are booming, as even though more people and organisations are purchasing ‘smart’ (network-connected and interactive) devices, such as routers or DVR security cameras, not everybody considers them worth protecting. Cybercriminals, however, are seeing more and more financial opportunities in exploiting such gadgets. They use networks of infected smart devices to conduct DDoS attacks or as a proxy for other types of malicious actions. To learn more about how such attacks work and how to prevent them, Kaspersky experts set up honeypots – decoy devices used to attract the attention of cybercriminals and analyse their activities.

Based on data analysis collected from honeypots, attacks on IoT devices are usually not sophisticated, but stealth-like, as users might not even notice their devices are being exploited. The malware family behind 39% of attacks – Mirai – is capable of using exploits, meaning that these botnets can slip through old, unpatched vulnerabilities to the device and control it. Another technique is password brute-forcing, which is the chosen method of the second most widespread malware family in the list – Nyadrop. Nyadrop was seen in 38,57% of attacks and often serves as a Mirai downloader. This family has been trending as one of the most active threats for a couple of years now. The third most common botnet threatening smart devices – Gafgyt with 2,12% – also uses brute-forcing.

In addition, the researchers were able to locate the regions that became sources of infection most often in H1 2019. These are China, with 30% of all attacks taking place in this country, Brazil saw 19% and this is followed by Egypt (12%). A year ago, in H1 2018, the situation was different, with Brazil leading with 28%, China being second with 14% and Japan following with 11%.

“As people become surrounded by smart devices, we are witnessing how IoT attacks are intensifying. Judging by the enlarged number of attacks and criminals’ persistency, we can say that IoT is a fruitful area for attackers that use even the most primitive methods, like guessing password and login combinations. This is much easier than most people think: the most common combinations by far are usually ‘support/support’, followed by ‘admin/admin’ and ‘default/default’. It’s quite easy to change the default password, so we urge everyone to take this simple step towards securing your smart devices,” said Dan Demeter, security researcher at Kaspersky.

To keep your devices safe, Kaspersky recommends users:

• Install updates for the firmware you use as soon as possible. Once a vulnerability is found, it can be fixed through patches within updates.

• Always change preinstalled passwords. Use complicated passwords that include both capital and lower-case letters, numbers and symbols if possible.

• Reboot a device as soon as you think it’s acting strangely. It might help get rid of existing malware, but this doesn’t reduce the risk of getting another infection.

• Keep access to IoT devices restricted by a local VPN, allowing you to access them from your ‘home’ network, instead of publicly exposing them on the Internet.

Kaspersky recommends companies take the following measures:

• Use threat data feeds to block network connections originating from malicious network addresses detected by security researchers.

• Make sure all devices’ software is up to date. Unpatched devices should be kept in a separate network inaccessible by unauthorised users.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Kaspersky uncovers zero-day in Chrome
October 2019, Kaspersky Lab , News, Cyber Security
Kaspersky’s automated technologies have detected a new exploited vulnerability in the Google Chrome web browser.

Read more...
Cyber-securing your surveillance infrastructure
CCTV Handbook 2019, Genetec, Hikvision South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Cyber Security
When it comes to cybersecurity, understanding the risks and the solutions as well as engaging in open communication helps everyone.

Read more...
Keeping your things to yourself
October 2019, Technews Publishing , Editor's Choice, Cyber Security, Integrated Solutions, IT infrastructure
Three experts spoke to Hi-Tech Security Solutions to offer advice on keeping your IoT working for you and not for cyber criminals.

Read more...
IoT in security
October 2019, Duxbury Networking, Technews Publishing , Editor's Choice, Cyber Security, Integrated Solutions, IT infrastructure
Using the Internet of Things is not really optional these days, but securing the Internet of Things is compulsory, no matter what industry you operate in.

Read more...
NFa2p security certification
October 2019 , News, Cyber Security
Advisor Advanced obtains the highest level of certification to the NFa2p Electronic Security Standard for a complete security system.

Read more...
SOAR an essential part for security operations
October 2019 , Editor's Choice, Cyber Security, Security Services & Risk Management
MJ Strydom, MD of cybersecurity specialist company DRS discusses the challenges around the security incident response lifecycle.

Read more...
Stalkerware on the increase
October 2019, Kaspersky Lab , Cyber Security
The number of users that encountered stalkerware (commercial spyware often used as a tool for domestic espionage) increased by 35% to 37 000 in 2019.

Read more...
Reductor malware hijacks HTTPS traffic
October 2019, Kaspersky Lab , Editor's Choice, Cyber Security, News
Kaspersky researchers have discovered new malware that hijacks victims' interaction with HTTPS web pages in the process of establishing encrypted communication between the user and the website.

Read more...
SA among top 20 countries targeted in new phishing influx
October 2019 , News, Cyber Security
Recent Fortinet research has revealed that South Africa was among many countries targeted by a phishing actor or group using the same techniques.

Read more...
Only birds in the sky
October 2019, Kaspersky Lab , Home Security
Kaspersky has launched a new solution designed to help organisations and property owners defend themselves from unauthorised trespassing by civilian drones.

Read more...