Vulnerable Internet of Things at helm of Friday cyber attacks

NEW YORK, U.S. - No doubt Internet of Things devices have bettered everyday life but according to security analysts, connected devices such as web cameras, thermostats, printers were used to flood in the DNS with heavy traffic.

The latest hacks that downed major websites - Twitter, Netflix, Reddit, Paypal, Spotify amongst many others began after they were flooded with heavy web traffic using millions of IP addresses simultaneously. 

Reports claimed that the firmwares connected devices use are vulnerable and could be exploited to create botnets which can be deployed to attack the internet service providers through ‘Distributed denial of Service’ (DDoS). The attack targeted New Hampshire-based company Dyn which monitors and routes internet traffic. And doing so, all its subscribers virtually went offline for a few hours.

Kyle York, Dyn’s chief strategy officer said, “It’s a very smart attack. We start to mitigate, they react. It keeps on happening every time. We’re learning though.”

Further, Kate Bevan, a technology journalist said, “It's your fridge, it's your printer, it's your wi-fi kettle - it's all of these devices which are online and a lot of them are incredibly insecure. They have default passwords which consumers can't change.”

A security firm, Flashpoint confirmed that hackers used ‘Mirai’ malware to source the attack. Earlier this month, Mirai program was released online and inspired a chain of attacks.

A cyber security expert Brian Krebs explained, “Mirai scours the Web for IoT (Internet of Things) devices protected by little more than factory-default usernames and passwords and then enlists the devices in attacks that hurl junk traffic at an online target until it can no longer accommodate legitimate visitors or users."

Interestingly, many of the IoT devices come from Chinese manufacturers with factory default usernames and passwords that cannot be changed. This common mistake has been the most useful resource for hackers and hacking groups.

Although hacking activities have given birth to cyber espionage, the group called New World Hackers which claimed responsibility for Friday’s hacking has demanded very less. Their espionage involves demands of better security.

A group member who calls himself as ‘Ownz’ denied making any demands but making his point clear, he said, "We will make one demand actually. Secure your website and get better servers, otherwise be attacked again."

Two other group members with pseudonyms of ‘Prophet’ and ‘Zain’ and said, “We didn’t do this to attract federal agents, only to test power.”

Even after thousands of hackings every day, neither Internet Service Providers nor the IoT industry have learnt to keep up with the sophisticated hackers. 

Cyber security firms have also failed to go a step ahead. While it has helped companies understand the vulnerability in their products and services, it has also compromised user data many times. 

James Norton, former deputy secretary at the Department of Homeland Security also echoed the similar tone. He said that the attack on one company has caused mass disruption for many others.

"I think you can see how fragile the internet network actually is," he added.

Last week, U.K. Prime Minister Theresa May banned Apple watches from cabinet meetings following hacking scares. She had previously banned smart phones from such meetings. It is believed wearables with microphones can be hacked and used as listening devices.