No wonder we're being hit by Internet of Things botnets. Ever tried patching a Thing?

Akamai CSO laments pisspoor security design practices


Internet of Things devices are starting to pose a real threat to security for the sensible part of the web, Akamai's chief security officer Andy Ellis has told The Register.

Speaking in the aftermath of the large DDoS against security journalist Brian Krebs, Ellis elaborated a little on the makeup of the botnet which took down Krebs' website, saying it was mostly made up of hacked Internet of Things devices.

“We've noticed a strong overlap between the attack … and one of the botnets that we have been working at in modelling,” Ellis told El Reg, as he named the Kaiten malware as one of the vectors involved in the Krebs attack.

Kaiten has long been known as a source of IRC-controlled DDoS attacks. While the original chiefly targeted routers, this latest version also “targets DVRs and some cameras” according to Ellis.

During the attack against Krebs, Akamai jettisoned him from their DDoS mitigation service with two hours' notice. Krebs was a pro bono customer and the sheer volume of traffic – 620Gbps – threatened to affect services for Akamai's paying clients. Krebs later said he didn't blame Akamai for taking the action they did, even though Google stepped in with its Project Shield service.

“This is a very concerning thing, looking at the prevalence of IoT and the ability for [the Krebs attackers] to throw around this volume of traffic,” Ellis said. “More research is being done on the adversary side to find out how to better take control of IoT devices, whether by means of a brute force attack using a known and common credential such as the [default] admin password, which gets them into a handful of routers out there, and then [the attackers start] leveraging the bandwidth of these end users.”

The chief problem for DDoS mitigation outfits trying to defend against IoT botnets is that with so many devices potentially falling under the control of miscreants, it is straightforward for the attacker's traffic to masquerade as legitimate web traffic.

“Compromised IoT devices … have the ability to source traffic from the same IP address as a legitimate user,” said Ellis, “which obviously gives the advantage that it stops [attackers] from being trivially filtered. I don't think I'm giving anything away when I say that when you're protecting a web server, any traffic coming in that's not related to web traffic is very deep and easy for you to drop. And the more that an adversary can look like a legitimate user, the more difficult it becomes, the more resources you have to expend to identify that that's an attacker and mitigating it.”

Culture change needed in IoT architecture

Part of the problem is the sheer difficulty of patching and updating IoT devices to take advantage of the latest vuln plugs.

Ellis said: “If you have an iPhone it auto updates in the background and you press OK and it takes care of it for you. We've become so used to that on the internet of general purpose computing devices that when we look at the Internet of Things – or as one of my colleagues likes to call it, Things on the Internet – there aren't devices built into that same robust infrastructure.”

Then he spelled out the painful upgrade process for most current IoT devices:

If I want to patch them, I need to go to the vendor website, hunt for my model of device, download an executable to my desktop and run it, when the executable will open a network hole and patch, upgrade the firmware on my device. You walk through that and to you and I that probably seems like, 'that's painful but at least I understood what it was I was doing'.

For most users that's a really challenging thing. They're not professional systems administrators. Why do we expect them to treat these devices the same way that a systems administrator treats enterprise-class routers?

He also said that IoT devices ought to be “deployed in a fashion that makes them automatically udpate and keep themselves secure all the time.”

As for the Krebs hack, does the widespread use of an IoT botnet mean that the whole concept of IoT security is fatally flawed? Do we need to trash it all and start over?

“We don't know for certain that every machine involved in this was IoT; it's quite possible that the attacker spliced together a botnet including traditionally compromised servers as well as these IoT devices,” Ellis concluded. “Hopefully we'll learn more as we dig through the data.” ®

Similar topics


Other stories you might like

  • Prisons transcribe private phone calls with inmates using speech-to-text AI

    Plus: A drug designed by machine learning algorithms to treat liver disease reaches human clinical trials and more

    In brief Prisons around the US are installing AI speech-to-text models to automatically transcribe conversations with inmates during their phone calls.

    A series of contracts and emails from eight different states revealed how Verus, an AI application developed by LEO Technologies and based on a speech-to-text system offered by Amazon, was used to eavesdrop on prisoners’ phone calls.

    In a sales pitch, LEO’s CEO James Sexton told officials working for a jail in Cook County, Illinois, that one of its customers in Calhoun County, Alabama, uses the software to protect prisons from getting sued, according to an investigation by the Thomson Reuters Foundation.

    Continue reading
  • Battlefield 2042: Please don't be the death knell of the franchise, please don't be the death knell of the franchise

    Another terrible launch, but DICE is already working on improvements

    The RPG Greetings, traveller, and welcome back to The Register Plays Games, our monthly gaming column. Since the last edition on New World, we hit level cap and the "endgame". Around this time, item duping exploits became rife and every attempt Amazon Games made to fix it just broke something else. The post-level 60 "watermark" system for gear drops is also infuriating and tedious, but not something we were able to address in the column. So bear these things in mind if you were ever tempted. On that note, it's time to look at another newly released shit show – Battlefield 2042.

    I wanted to love Battlefield 2042, I really did. After the bum note of the first-person shooter (FPS) franchise's return to Second World War theatres with Battlefield V (2018), I stupidly assumed the next entry from EA-owned Swedish developer DICE would be a return to form. I was wrong.

    The multiplayer military FPS market is dominated by two forces: Activision's Call of Duty (COD) series and EA's Battlefield. Fans of each franchise are loyal to the point of zealotry with little crossover between player bases. Here's where I stand: COD jumped the shark with Modern Warfare 2 in 2009. It's flip-flopped from WW2 to present-day combat and back again, tried sci-fi, and even the Battle Royale trend with the free-to-play Call of Duty: Warzone (2020), which has been thoroughly ruined by hackers and developer inaction.

    Continue reading
  • American diplomats' iPhones reportedly compromised by NSO Group intrusion software

    Reuters claims nine State Department employees outside the US had their devices hacked

    The Apple iPhones of at least nine US State Department officials were compromised by an unidentified entity using NSO Group's Pegasus spyware, according to a report published Friday by Reuters.

    NSO Group in an email to The Register said it has blocked an unnamed customers' access to its system upon receiving an inquiry about the incident but has yet to confirm whether its software was involved.

    "Once the inquiry was received, and before any investigation under our compliance policy, we have decided to immediately terminate relevant customers’ access to the system, due to the severity of the allegations," an NSO spokesperson told The Register in an email. "To this point, we haven’t received any information nor the phone numbers, nor any indication that NSO’s tools were used in this case."

    Continue reading

Biting the hand that feeds IT © 1998–2021