By now anyone who has been following the news or any form of social media is familiar with map above. This was the outage caused on Oct 21st 2016 where a massive DDoS attack targeted DYN servers resulting in major services such as Twitter, Box.Com, Reddit, Spotify and several others being unavailable.
Due to the frequent news about cyber attacks in the past, we have got desensitized to such stories. However this one is different and we should all take notice.
DDoS attacks have been around for several years and IT teams have proven tools, software and security products at their disposal to protect themselves. The fundamental premise of a DDoS attack is to overwhelm servers with a large number of simultaneous and coordinated requests. These requests come from a distributed network of hosts running malicious code making it hard for servers to differentiate between genuine and fraudulent requests. This eventually leads to the servers unable to service all requests and a (DoS) Denial of Service to genuine users.
10/21/16 DDoS Attack
Coming back to why the 10/21/16 outage is worrisome, is that the attackers used IoT / IP enabled devices such as Baby Monitors and IP Cameras to launch the DDoS attacks. With the number of “smart” IP capable devices growing exponentially, the sheer volume of available hosts that can be compromised to launch DDoS attacks is huge! Where previously, PCs and Laptops were infected with Malware to launch attacks, now every IP enabled device is potentially a weapon in the hands of the wrong people.
What compounds this issue further is the lack of sensitivity to security on IoT devices. In a rush to get to market in the fastest time, security gets minimal attention leaving these “smart” devices wide open to exploit vulnerabilities.
Expecting IoT devices to implement strong security measures is impractical. However IoT hardware and software will get more secure with time. Home gateways will implement measures to ensure IoT devices are protected as much as laptops and smart phones. Servers and infrastructure elements such as Firewalls and Load Balancers will get smarter and faster. Unfortunately, this will evolve slowly and take time. Until then, we can expect more DDOS attack that exploit the in-secure nature of IoT devices.
