Well I didn't planned to talk about IoT but since last Friday incident I almost had no choice. As you may know a lot of website has been taken down by a Russian hackers group, let's focus on what happened.

The best (and stupidly simple) hack of all time

In IT terms => The Russian group used a DDoS attack to take down a lot of websites (Twitter, Spotify, Reddit, etc...). They targeted the DNS server to have such huge impact. They succeed to do so because they used a lot of personal connected device in order to generate enough traffic.

With basic words => A Russian group send a question to the internet operator, "Are you here? Do you exist?". The internet operator replied "yes". However the Russian group send billion times the same questions. the internet providers (called Dyn), was so busy to reply "yes", that he didn't had time to send normal users (you & me) to the website they were trying to access.

Why we don't care about the DDoS attack?

Because such attack is really stupid and do not damage or penetrate the related website. It is exactly has if you call someone and you hear that line is busy. This is one of the oldest and more easy attack to create, it happened before and will happen again. Even such DNS providers like Dyn have some counter-measure for DDoS attacks, they can not bear it up to certain limits. Furthermore, the same Russian group already made some proof of Concept previously but nobody cares. For those who know me, I most probably already mentioned this to you, weeks before.

The true scary thing is the IoT security

In this attack, the most terrifying is the security of the connected devices. They used your baby phones, connected CCTV and others devices to send the question "is anyone there?" to Dyn provider. They hacked your stuff and you didn't even noticed. The problem is that if they can do that it means they have total access to your devices. Finally, they can use it for DDoS attack but also to watch what your are doing or if you are away so they can come to stole you!

How come such devices are not protected?

Firstly, it is mainly your fault...

Because you are not professional and want to install connected devices very easily, most of them are totally open to external connections to make it more easy to discover and to add to your personal network. Therefore, you do not configure the network rules to close unnecessary port and access control.

Secondly, The IoT distributors...

Most of them don't want to invest into Cyber protection because it would cost a lot for such devices (regarding the number and unit price). It is also a question of responsibility, do they have the right to monitor for you such devices or is it your responsibility (again...) to protect yourself?

Thirdly, too much connectivity...

Being connected 24*7 it's cool and very useful, unfortunately, being very connected means having a lot of opportunities to get hacked. For example, do you need to have your espresso machine connected to internet? really?! Your device have Bluetooth & Wi-Fi connectivity, do you need both at the same time?

My conclusion

Well, IoT need to be regulated, to have certification to be sale, to prove that some Cyber Security standard and protection exist. IoT will come in every imaginable form and connected to everything so I'm pretty confident that such certification/regulations will appear. This is your own life at risks. When computer was new, everybody started to learn how to use it... I do believe that everybody should learn basics about internet protection in our time.

Original post: DYN Cyber Attack, IoT and it's huge impact on Security!