The proliferation of IoT (Internet of Things) devices offer numerous benefits for consumers when they plug devices such as cameras, light bulbs, thermostats, digital video recorders, refrigerators and other household items into the Internet. It is estimated that billions of IoT devices are in operation right now and their use is growing by leaps and bounds.

The lack of adequate security measures in these devices, however, poses serious risks to users and the greater Internet community. This is because vulnerabilities in IoT devices come from several sources:

• Some devices use default and easily discoverable passwords that hackers can exploit.
• Others devices have hardcoded credentials that users are not able to change.
• Many devices lack automated firmware updates, forcing consumers to monitor and install updates on their own.
• The global nature of the IoT device marketplace means that many products are manufactured in foreign countries that have yet to adopt stringent cyber security practices.

IoT devices are also attractive targets because users often have no way of knowing when they have been compromised.  Unlike computers and phones, which have endpoint protection capabilities, compromised IoT devices may go unnoticed for a long time.

With a new family of malware targeting IoT devices, attackers are able to leverage the infected devices to create Distributed Denial of Service (DDoS) botnets that impact not just those devices, but potentially any device on the Internet. IoT makes these DDoS attacks difficult to stop because they come from so many different locations on the Internet.

In one recent case, 150,000 IoT devices were used to generate more than 500 gigabits per second of traffic to flood Internet-infrastructure provider Dyn, which struggled for over 10 hours to mitigate a flood of data that caused its domain name services to become unreachable. This resulted in intermittent service outages for its clients, including Twitter, Netflix, PayPal, and Spotify.

Of note is that the Dyn attack relied on just a fraction of the total available compromised IoT nodes – estimated at only 8 percent – demonstrating the potential for significantly greater damage from these new threats, particularly as they migrate from consumer systems to industrial, financial and healthcare systems. DDoS attacks of 1 terabits per second are now possible.

DataLink offers cloud and on-premises solutions for mitigating DDoS attacks, thereby preventing loss of bandwidth and server availability.  Contact us today: 410.729.0440 or sales@DataLinkTech.com.