[BreachExchange] Massive Cyberattack Triggers Recalls and Serious IoT Concerns

[Inga Goddijn]

http://www.sci-tech-today.com/news/Massive-Cyberattack-Triggers-Recalls/story.xhtml?story_id=12200DMHZ8W2

The cyberattack that took out huge portions of the Internet last week has
now led to a major product recall. Hangzhou Xiongmai Technology, a Chinese
electronics company, has acknowledged that weak default passwords on many
of its devices were partly to blame for the Oct. 21 attack.

The components maker, which builds parts for everything from security
cameras to digital recorders, said it would be recalling millions of
Web-enabled cameras that were sold in the U.S. The company described the
attack as a major blow to the Internet of Things movement, saying it has
shaken customer confidence in the level of security of all Internet-capable
devices.

This Could Have Been Avoided

Despite the surprise and devastation achieved during Friday’s attack, it
was not inevitable. In fact, Hangzhou Xiongmai said it first become aware
that some of its cameras had a security flaw last year. The company issued
a firmware update to fix the issue last September and urged customers to
change the password from the default setting.

Only devices that were sold before April 2015 failed to update their
firmware. Those devices were still using the default password and were
connected to the Internet when they were exploited, the company said. That
should imply less than 10,000 devices, according to the company's numbers.

Nevertheless, Hangzhou Xiongmai has agreed to recall up to 4 million
products as an act of good faith. While the company primarily makes
components for industrial and commercial devices, such as surveillance
equipment for banks, stores, and residential areas, most of the devices it
sells in the U.S. are for personal and consumer use. That might explain why
so many devices were running old firmware using the default password.

The Shape of (the Internet of) Things To Come

Friday’s attack managed to take out huge swaths of the Internet throughout
the U.S., including popular sites such as Twitter and Netflix, by targeting
Dyn Inc., a New Hampshire-based company responsible for providing much of
the domain name service infrastructure in the US. The group responsible for
the attack was able to overwhelm Dyn’s servers with a distributed denial of
service attack.

To achieve their goal, the hackers used a malware tool known as Mirai to
take control of IoT devices, such as security cameras, using Hangzhou
Xiongmai’s hardware components to form a botnet. Once under the hackers’
control, the botnet was able to generate fake network traffic from tens of
millions of IP addresses, overwhelming Dyn’s ability to respond.

So far, the identity of the group responsible for Friday’s attack remains a
mystery, as does whatever motive was behind it. What is certain is that it
represented one of the largest and most sophisticated attacks against a
major Internet infrastructure provider in history. And the use of IoT
devices, rather than laptops or desktops, may represent a chilling new
development in the annals of cybercrime.

Such devices are expected to proliferate in the coming years, and many
continue to lack sufficient security safeguards. Friday’s attack may prove
to be only a glimpse of what’s to come.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20161026/4d03c1f1/attachment.html>