The always-on hyper-connected world we live in brings with it huge potential, some of it good and some of it bad. The age of hyper-connectivity has enabled the Internet of Things (IoT) to succeed, which promises more personalised and automated services, optimised resource utilisation and added convenience, but have we ignored the risks and merely focused on the hype?
The number of connected devices has grown at an unprecedented rate with current estimates at between 6-12 billion devices. This number seems enormous but if you doubt it, I suggest you login into your home router and look at how many devices are registered – you may be surprised when you see your TVs, amplifiers and heating thermostats featuring on the list.
We already have cars that can drive themselves and buildings that can configure their environmental control systems based on your presence. The amount of machine-to-machine communication going on around us is growing all the time, but in many cases, we haven’t considered ‘security’ to be part of our buying or implementation processes.
IoT devices, by their very nature, must be easy to deploy and use, but we should not forget that these devices are just small computers. How many of us would plug a computer straight into the Internet using the (old) original, un-patched version of an OS, with no firewall or security devices to protect it, using the default username and password? Not many, but this is what is happening in many cases with IoT devices.
Emerging threats
2016 brought the darker side of the connected world more sharply into focus, with the proliferation of botnets, and weaponised DDoS services, based on IoT devices. If we think back to the early noughties DDoS attacks were often generated by large botnets of compromised end-user’s workstations, because of multiple vulnerabilities and a lack of security awareness.
Cyber-criminals have realised that IoT devices offer a significant capability, just waiting to be exploited in a similar way, and we all saw how thousands of relatively small, innocuous CCTV cameras and DVRs could be leveraged to generate Distributed Denial of Service (DDoS) attacks at 500Gbps or greater, affecting the availability of Internet services from many well-known Internet brands.
Many IoT devices have good connectivity on unmonitored network segments, and enough processing capability to drive a significant volume of DDoS attack traffic. Attacks from these devices are responsible for some of the increased scale and frequency of DDoS activity reported in Arbor Networks’ annual Worldwide Infrastructure Security Report (WISR). And, DDoS is just one use-case for compromised IoT devices – more on that later….
The layered defence strategy
Compromised IoT devices offer attackers a new way to threaten the availability of the Internet services we use, but the best way to protect our businesses has stayed the same. Most businesses today are reliant on the data and application services they utilise via the Internet, and availability issues can be very costly. To combat today’s DDoS threat, businesses and governments alike need to implement a multilayer DDoS protection strategy.
Multi-layered defences incorporate both an on-premise and cloud or ISP-based component. The on-premise component allows businesses to detect and mitigate attacks immediately, before there is any service impact. However, the on-premise solution can’t deal with increasingly common, large attacks that can saturate Internet connectivity, and this is where the cloud or ISP-based service steps in – to deal with the higher magnitude attacks. The good news is that many more enterprises are adopting layered defence. Arbor’s WISR showed that 30% of enterprise organisations had adopted this model in 2016, up from 23% in 2015. &
Putting the right defences in place does require investment, and there are many competing priorities in businesses for both IT and security budget. But given the dependence most businesses now have on connectivity for interaction with customers, partners and suppliers, these kinds of defences are essential. Incorporating availability threats into business and IT risk assessment processes can help to quantify the potential impact of a DDoS attack, helping to prioritise investment, and the WISR report shows that around two-thirds of enterprises have now taken this step.
The tip of the iceberg
The combination of DDoS and IoT devices will undoubtedly continue to make the news headlines in the latter part of 2017, as we see even larger attacks causing problems for both service providers and enterprises. However, DDoS is only one of the ways in which IoT devices can be exploited. We are already seeing compromised IoT devices being used as proxies to obfuscate the original source of traffic. And, if you are thinking that the risk to IoT is limited to those devices that are exposed to the Internet – think again.
Windows malware that looks to scan local networks for IoT devices to infect is already a reality. This would allow attackers to gain a foothold within a network, using our IoT devices, so that they could then move on to target other resources inside or outside of our networks.
The hyperconnected world provides us with some amazing opportunities, mostly positive, but some negative, such as the use of IoT devices to amplify existing threats and create new ones. One thing we can all do is try to avoid becoming a part of the problem, and the solution here is simply to implement good IT security hygiene when we deploy IoT devices.
Improving the security of IoT devices and preventing their compromise are key goals of the security industry and the manufacturers of these devices, but until that is done, and it may take some time, everyone needs to protect themselves from the threats we know that are out there, and DDoS is a significant and growing threat.
Tim Murphy is the Australian country manager for Arbor Networks.