classic | mobile
Follow us on:
Follow us on Facebook  Share via Twitter  Share via LinkedIn
 

Search...
Hi-Tech Security Solutions Business Directory
Residential Estate Security Handbook 2018


Weaponised IoT attacks: what does the future hold?
April 2017, This Week's Editor's Pick, Cyber Security

The explosion of connected devices onto our networks is fuelling our imaginations and inspiring incredible visions for the future. There is limitless potential in being able to connect and integrate our cars, houses, appliances, and everything else we own.

We’re falling in love with the so-called Internet of Things (IoT): from the simple example of a connected fridge reordering the milk when it’s running low; to the more sophisticated business realm of connected trucks that process inventory, firing off automated chain reactions within the operations.

Gartner expects we’ll see over 20 billion connected devices by 2020 – promising to fundamentally change the way we live and work (http://www.gartner.com/newsroom/id/3165317). But on the other side of the coin, it thrusts us into a new realm of cyber threats. Suddenly, it’s possible to weaponise hundreds of thousands, millions, or even billions of IoT devices – creating marauding zombie armies that haul servers down with sustained DDoS attacks.

Darren Anstee, chief security technologist at Arbor Networks, explains that: “IoT botnet cybercrime capitalises on weak default passwords of many mass-market surveillance cameras, routers and digital video recorders, infiltrating them with malware and then using them to launch well-orchestrated DDoS attacks.

“Last year we saw the first expression of the now infamous Mirai botnet attack. Mirai represents a new high-water mark in the cyber criminal community. It points towards a number of worrying trends for the future,” Anstee adds.

So, just how will these attacks evolve?

Increased use of reflection amplification

The first wave of IoT botnet attacks may not have used DNS amplification or reflection, but as companies raise their guards, these advanced techniques will be woven into the botnet attacks, allowing attackers to multiply attack traffic multiple fold. By continually scanning networks for new, insecure IoT devices, and then amplifying their presence, hackers are able to flood their victims’ networks with incredible force.

“Weaponised IoT attacks will become more subtle and stealthy than the bold and ground-breaking Mirai bot – which was more about making a statement than it was about actual financial gain,” notes Anstee.

Lower barriers to entry

IoT attacks are actually not that difficult to pull off. For this reason, they’re popping up at a rapid rate. From universities that are taken offline by breaches to their connected light bulbs and vending machines, to the devastating attack which temporarily took the whole of Liberia offline, there are reports every day of new attacks.

“Systems can be easily compromised with publicly available exploit kits and related information,” reveals Anstee. Barriers to entry are lowered by the relative ease that someone can develop their own army of botnets, or rent others’ armies within the dark web.

Automation and agility

“What really made the likes of Mirai and its derivatives successful was the release of the Metasploit module, which made automating the recruitment and weaponisation of devices far easier,” he explains.

In the future, we’ll see attacks that leverage automation at every layer and constantly morph their approaches to get the best possible result. For example, while the original Mirai code looked for 61 different usernames and passwords, future iterations may try millions of different passwords.

Ultimately, these types of threats are likely to thrive over the coming years. They exploit weaknesses in two major areas (the hardware of the connected devices themselves, and the lack of DDoS resistance tools within the targeted victim). Because of the nature of these vulnerabilities, it is very hard for governments and ISPs to come together in coordinating an effective response.

It’s a matter that has received attention in senior political echelons, with former US president Barack Obama quoted as saying that future presidents face the challenge of “how do we continue to get all the benefits of being in cyberspace, but protect our finances, protect our privacy? What is true is that we are all connected. We’re all wired now” ( http://www.computerworld.com/article/3135285/security/ddos-attack-shows-dangers-of-iot-running-rampant.html).

For more information contact Bryan Hamman, Arbor, bhamman@arbor.net


  Share via Twitter   Share via LinkedIn      

Further reading:

  • Trust but continually verify
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions, IT infrastructure
    Hi-Tech Security Solutions looks at access and identity management and asks some industry players what ‘zero trust’ and ‘least privilege’ access means.
  • Managing who, what and why
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security
    Today’s access control isn’t only concerned with who has access, but also what has access, why they need it and what they are doing with it.
  • Physical/logical convergence
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Integrated Solutions, IT infrastructure
    The convergence between physical and logical (or cyber) security will be a game-changer because it will change the way we do everything, from planning to design and all the way to installation and maintenance.
  • Physical and logical convergence is a fact
    November 2018, This Week's Editor's Pick, Integrated Solutions, IT infrastructure
    Convergence, the next buzzword? A dated buzzword? Is convergence ­merely ­integration on steroids? What is convergence?
  • The expanding role of IT in access control
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, IT infrastructure
    What role is IT playing in the world of physical access control and how far will its role expand in future?
  • Taking augmented identity to the world
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions
    Hi-Tech Security Solutions spoke to Gary Jones, VP Global Channel and Marketing biometric access and time solutions) at IDEMIA (formerly Morpho) about his career with the company and its new vision of Augmented Identity.
  • Tracking biometrics into a brave new digital world
    November 2018, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions
    The industry is increasingly transitioning from unimodal to more integrated multimodal biometric solutions for more accurate identity verification and faster real-time results.
  • A better approach to fingerprint biometrics
    November 2018, This Week's Editor's Pick, Access Control & Identity Management
    Not all optical biometric fingerprint scanners are created equal. The type of sensor used has a powerful impact on speed, accuracy, reliability and portability.
  • The right access decisions
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management
    Making the right access control decision depends on what you want secured and how secure it should be.
  • Digital channels and the evolution of ID
    November 2018, This Week's Editor's Pick, Access Control & Identity Management, IT infrastructure
    While the concept of identity (ID) remains unchanged, the rapid evolution of digital technology has dramatically extended both its application and form factor.
  • Using tomorrow’s tools to solve ­today’s security problems
    November 2018, Access Control & Identity Management, Cyber Security, Integrated Solutions
    It is the companies that are already investing in tomorrow’s tools to solve today’s problems that will survive the ongoing onslaught to circumvent security solutions.
  • Fingerprints protect privacy for AIDS testing
    November 2018, This Week's Editor's Pick, Access Control & Identity Management
    A creative, progressive NGO uses biometric fingerprint scanning to redefine confidentiality and AIDS treatment in South Africa.

 
 
         
Contact:
Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory (HSBD)

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Other
Terms & conditions of use, including privacy policy
PAIA Manual
         
    Mobile | Classic

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.