Following the recent massive DDoS attacks powered by botnets which have hit the headlines, we’ve had another warning about the amount of potentially vulnerable devices out there which could be compromised and used in such assaults – and the worrying scale these numbers might reach in the future, unless we take action.
Security firm BullGuard scanned in excess of 100,000 IPs hunting for such vulnerable IoT devices (including the likes of security cameras, DVRs, routers and so forth), and managed a hit rate of 4.6%.
The company applied that to an estimate of the 4 billion connected devices currently out there, to work out a rough number of 185 million vulnerable devices which could be leveraged in Mirai-style botnet attacks.
Of course, the really worrying thing is when you extrapolate this using the typical figures expected for IoT gadget growth by the end of the decade – with analyst firms reckoning some 50 billion devices will be in play. That would mean something like 920 million vulnerable pieces of hardware, almost a billion-strong army of potential DDoS cannon fodder.
Back to basics
As Paul Lipman, chief executive at BullGuard, observed, people need to “ensure that basic security measures are in place” with their devices, the main consideration in this case being that they must not be left on their default username and password settings (which is how these things are so easily hacked en masse).
Manufacturers need to play a role as well, of course, and figure out ways of ensuring that hardware isn’t left on default settings by users.
Or we could be in for a lot of trouble down the line, as these DDoS attacks are only going to get bigger. Recently, we’ve seen DDoS firepower to the tune of 799Gbps – that was one blast that hit French hosting provider OVH.com – and havoc was wreaked this time last week as many big websites went down due to a DNS service provider being hit by weighty DDoS blasts.
Perhaps the worst worrying news in recent times, though, is this week’s revelation that a freshly discovered amplification technique could lead to assaults reaching a truly frightening volume of 35Tbps or more.
Combine that sort of exploit with the explosive growth expected in the IoT, and you’ve got problems which could really lay waste to their victims – or indeed large chunks of the entire internet as we saw last week.
Via: SC Magazine
