Cyber Attacks
It’s just over a week since the largest cyber attack ever. That knocked Twitter, Spotify and CNN off the internet by targeting Dyn, who look after their DNS. It’s about two weeks since the second largest attack, and the odds are there’ll be an even bigger attack soon.
This attack was based around hundreds of thousands of webcams and DVRs infected by the Mirai botnet sending vast quantities of DNS requests. It’s a simple botnet, as it controls simple things, so it can’t do that much damage. Unless you’re Twitter, Spotify, CNN, or Dyn. Right now, it seems to focus on damaging other people’s networks rather than yours. Next week it might do something else.
Insecure by design and usage
One manufacturer (Hangzhou Xiongmai) has admitted to problems in the way their products are typically set up and they’ve issued software updates and a product recall. Unfortunately, Hangzhou Xiangmai Technology don’t sell to consumers. All their stuff is rebranded and sold on by someone else.
They’ve urged owners to change usernames and passwords. It’s a start I suppose, but your DVR/Webcam won’t have their label, even if they made it.
Unfortunately, you can’t easily find something with a CE mark or Kitemark to denote “this device is designed to be secure”, as sadly, there isn’t such a thing.
Improve Your Own Security
You can make your own devices more secure by:
- resetting them to factory defaults.
- changing the username and password – DON’T REUSE THESE CREDENTIALS
- applying any patches or updates from the manufacturer.
However, that may not address all the vulnerabilities in your device. Some of these things are awesomely badly designed.
If you’re not sure what to do with the webcam, the DVR and all the other IoT stuff, speak to your IT people, or us.
We’ll be posting more blogs about ‘The Internet of Things’ and DDOS attacks so please keep tuned in.
Any doubts or questions, please call and we’ll be delighted to help.
