In horror movies, the invading threat is usually a monster, human turned evil, or something undead. But, chances are pretty good that — just like the oblivious protagonist in every scary movie – you are living in the midst of horror scenario right now and don’t know it.
You – or more accurately your Internet of Things devices in your house – may have been forced into service as part of a mercenary, zombie army that can be rented – for a reasonable fee — to take down anyone’s enemy. This botnet army relies on you being unaware of your role. So if you want to fight for good, the first step is understanding what’s going on.
Some high-profile attacks in this massive war have made the news: In May, a global ransomware virus did a terrifying amount of damage. Late last year, over 900,000 customers of Deutsche Telekom, Germany’s largest telecom company lost service because of an attack. Last October, well-known sites Paypal, Spotify, Twitter, and many others were taken down by a similar attack. And it is not only large Internet properties that are taking hits. Anyone can be the victim. Brian Krebs is a just freelance journalist but his site was taken down by a massive attack in September.
Here’s what’s happening.
Hackers built a massive botnet army by enslaving Internet connected devices – routers, cameras, and other appliances – in the homes of average people. This is easy to do. The hacker uses a bit of malware – Mirai, which is freely available on the Internet – to infect common devices. They send the malware out onto the Internet searching for devices with weak protection. The software hacks into them, infects them, and uses them to send the software out again in search of more weak devices. Once a device is infected, the hackers can call upon it at any time to do their bidding.
The easiest way to launch an attack, is for the hackers to instruct their botnet army to throw massive amounts of traffic at their target causing a distributed denial-of-service (DDoS). The traffic clogs up the service and the site chokes on it. This is exactly what happened in the recent PayPal, Twitter, etc meltdowns that affected so many people.
“Botnets are nothing new,” explains Adriel Desautels CEO of Netragard, a security services company that protects businesses from such attacks. “They have been around since the 90s — even the late 80s. What’s new is that home connections now have such high bandwidth. So when people purchase access to a botnet army they get a lot more firepower. That’s why these attacks are more noticeable.”
It also seems as if many of the botnet armies out there have been taken over by a couple of rather infamous hackers who go by the monikers BestBuy and Popopret who control – or so they claim – a massive army. These two claimed responsibility for the Deutsche Telekom attack and used the resulting media attention to announced that this massive botnet army is available to rent for prices starting a few thousand dollars. Owning a botnet army is no-doubt quite profitable.
So how can resist becoming part of this Zombie army? According to Desautels, there is no perfect safeguard. “Every piece of technology we use today is vulnerable at some level,” he says.
The best defense? “Be smart,” says Desautels.
Byron Rashed of security company InfoArmor agrees. “There is no bullet-proof security system that will protect you from malicious threats.” But criminals look for the path of least resistance and there are ways to make sure you and your devices put up some of that.
Gary Davis, chief consumer security evangelist at Intel Security, says, “The most important thing to do before bringing new Internet-connected devices into your home is to make privacy and security part of your purchase criteria. If the company doesn’t have a good reputation in those areas, avoid that device.”
And once you get a device home, make sure you update to the latest software versions and change the default passwords. “Many manufactures use simple or commonly known passwords,” says Davis. “Change these passwords to something unique and complex to add a considerable layer of difficulty for anyone trying to access the device.”
“Layering security is the best defense,” Rashed says. “Firewalls, antivirus software, and other layers of protection are necessary to reduce the risk of a successful attack. And put Internet of things devices on a secure network that does not use an obvious password.”
But, as Desautels points out, hackers do not have to get around people like him, who understand technology. There are many more people who fail to secure their devices.
Knowledge is your best defense in this war. Every little bit you learn about protecting yourself from becoming a Zombie is a step toward protecting the world from evil. Instead of fighting evil with a sword, fight it with your mind.