Weaponised IoT attacks: what does the future hold?

CCTV Handbook 2017 Editor's Choice, Information Security

The explosion of connected devices onto our networks is fuelling our imaginations and inspiring incredible visions for the future. There is limitless potential in being able to connect and integrate our cars, houses, appliances, and everything else we own.

We’re falling in love with the so-called Internet of Things (IoT): from the simple example of a connected fridge reordering the milk when it’s running low; to the more sophisticated business realm of connected trucks that process inventory, firing off automated chain reactions within the operations.

Gartner expects we’ll see over 20 billion connected devices by 2020 – promising to fundamentally change the way we live and work. But on the other side of the coin, it thrusts us into a new realm of cyber threats. Suddenly, it’s possible to weaponise hundreds of thousands, millions, or even billions of IoT devices – creating marauding zombie armies that haul servers down with sustained DDoS attacks.

Darren Anstee, chief security technologist at Arbor Networks, explains that: “IoT botnet cybercrime capitalises on weak default passwords of many mass-market surveillance cameras, routers and digital video recorders, infiltrating them with malware and then using them to launch well-orchestrated DDoS attacks.

“Last year we saw the first expression of the now infamous Mirai botnet attack. Mirai represents a new high-water mark in the cyber criminal community. It points towards a number of worrying trends for the future,” Anstee adds.

So, just how will these attacks evolve?

Increased use of reflection amplification

The first wave of IoT botnet attacks may not have used DNS amplification or reflection, but as companies raise their guards, these advanced techniques will be woven into the botnet attacks, allowing attackers to multiply attack traffic multiple fold. By continually scanning networks for new, insecure IoT devices, and then amplifying their presence, hackers are able to flood their victims’ networks with incredible force.

“Weaponised IoT attacks will become more subtle and stealthy than the bold and ground-breaking Mirai bot – which was more about making a statement than it was about actual financial gain,” notes Anstee.

Lower barriers to entry

IoT attacks are actually not that difficult to pull off. For this reason, they’re popping up at a rapid rate. From universities that are taken offline by breaches to their connected light bulbs and vending machines, to the devastating attack which temporarily took the whole of Liberia offline, there are reports every day of new attacks.

“Systems can be easily compromised with publicly available exploit kits and related information,” reveals Anstee. Barriers to entry are lowered by the relative ease that someone can develop their own army of botnets, or rent others’ armies within the dark web.

Automation and agility

“What really made the likes of Mirai and its derivatives successful was the release of the Metasploit module, which made automating the recruitment and weaponisation of devices far easier,” he explains.

In the future, we’ll see attacks that leverage automation at every layer and constantly morph their approaches to get the best possible result. For example, while the original Mirai code looked for 61 different usernames and passwords, future iterations may try millions of different passwords.

Ultimately, these types of threats are likely to thrive over the coming years. They exploit weaknesses in two major areas (the hardware of the connected devices themselves, and the lack of DDoS resistance tools within the targeted victim). Because of the nature of these vulnerabilities, it is very hard for governments and ISPs to come together in coordinating an effective response.

It’s a matter that has received attention in senior political echelons, with former US president Barack Obama quoted as saying that future presidents face the challenge of “how do we continue to get all the benefits of being in cyberspace, but protect our finances, protect our privacy? What is true is that we are all connected. We’re all wired now” ( http://www.computerworld.com/article/3135285/security/ddos-attack-shows-dangers-of-iot-running-rampant.html).

For more information contact Bryan Hamman, Arbor, [email protected]





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Data resilience at VeeamON
Technews Publishing SMART Security Solutions Infrastructure Information Security
SMART Security Solutions attended the VeeamON Tour in Johannesburg in August to learn more about data resilience and Veeam’s initiatives to enhance data protection, both on-site and in the cloud.

Read more...
Get the AI fundamentals right
Technews Publishing SMART Security Solutions Leaderware Editor's Choice Surveillance AI & Data Analytics
Much of the marketing for CCTV AI detection implies the client can just drop the AI into their existing systems and operations, and they will be detecting all criminals and be far more efficient when doing it.

Read more...
SMART Surveillance Conference in Johannesburg
Arteco Global Africa Technews Publishing SMART Security Solutions Axis Communications SA neaMetrics Editor's Choice Surveillance Security Services & Risk Management Logistics (Industry) AI & Data Analytics
SMART Security Solutions hosted its annual SMART Surveillance Conference in Johannesburg in July, welcoming several guests, sponsors, and speakers for an informative and enjoyable day examining the evolution of the surveillance market.

Read more...
Secure data protection without hardware lock-in
Infrastructure Information Security News & Events
New Veeam Software Appliance empowers IT teams to achieve instant protection with Veeam’s fully preconfigured, software-only appliance, delivering enterprise-ready simplified deployment and operational efficiency, robust cyber resilience.

Read more...
South African fire standards in a nutshell
Fire & Safety Editor's Choice Training & Education
The importance of compliant fire detection systems and proper fire protection cannot be overstated, especially for businesses. Statistics reveal that 44% of businesses fail to reopen after a fire.

Read more...
The growing role of hybrid backup
Infrastructure Information Security
As Africa’s digital economy rapidly grows, businesses across the continent are facing the challenge of securing data in an environment characterised by evolving cyberthreats, unreliable connectivity and diverse regulatory frameworks.

Read more...
Choicejacking bypasses smartphone charging security
News & Events Information Security
Choicejacking is a new cyberthreat that bypasses smartphone charging security defences to confirm, without the victim’s input or consent, that the victim wishes to connect in data-transfer mode.

Read more...
Most wanted malware
News & Events Information Security
Check Point Software Technologies unveiled its Global Threat Index for June 2025, highlighting a surge in new and evolving threats. Eight African countries are among the most targeted as malware leaders AsyncRAT and FakeUpdates expand.

Read more...
LidarVision for substation security
Fire & Safety Government and Parastatal (Industry) Editor's Choice
EG.D supplies electricity to 2,7 million people in the southern regions of the Czech Republic, on the borders of Austria and Germany. The company operates and maintains infrastructure, including power lines and high-voltage transformer substations.

Read more...
Standards for fire detection
Fire & Safety Associations Editor's Choice
In previous articles in the series on fire standards, Nick Collins discussed SANS 10400-T and SANS 10139. In this editorial, he continues with SANS 322 – Fire Detection and Alarm Systems for Hospitals.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.