{"id":51123,"date":"2016-07-08T10:55:14","date_gmt":"2016-07-08T17:55:14","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=51123"},"modified":"2025-08-15T05:11:08","modified_gmt":"2025-08-15T12:11:08","slug":"botnets-use-iot-devices","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/botnets-use-iot-devices\/","title":{"rendered":"Update Your Toaster: How IoT Devices Can Be Conscripted into Botnets"},"content":{"rendered":"

Charles Strite, according to Lemelson-MIT<\/a>, first introduced the modern toaster in 1926. It was, and remains to this day, a handy instrument for simultaneously warming two sides of a slice of bread before ejecting the finished product \u2014 toast \u2014 with a familiar springy *pop*. The device\u2019s design was so successful that it has largely remained the same since 1926, dutifully popping toast across America for close to a century.<\/p>\n

For some, this means the toaster is due for an upgrade<\/a> to the Internet of Things (IoT) \u2014 a network of internet-connected devices that talk to one another and to internet-based services for better efficiency, automation and convenience. The toaster isn\u2019t alone. Fridges, washing machines, vacuum cleaners and a plethora of additional appliances are gaining connectivity under the IoT umbrella in the hopes of making our lives easier.<\/p>\n

But many of these devices lack sophisticated security measures, which makes them easy pickings for cybercriminals. They\u2019re desirable targets, too, because IoT devices can easily be conscripted into botnets<\/a> \u2014 networks of hijacked computers used to amplify attacks, flood servers and otherwise cause mayhem on a targeted website. In fact, according to Motherboard\u2019s Lorenzo Franceschi-Bicchierai<\/a>, some cybercriminals have just used IoT devices in their own botnet attack.<\/p>\n

According to Motherboard, a group of cybercriminals used an IoT-based botnet to launch a Distributed Denial of Service<\/a> (DDoS) attack \u2014 an attack that uses a collection of computing devices to flood a target server with so much traffic that it cannot operate. The target was an unnamed jewelry store\u2019s website. The eye-popping fact, however, was that the attack employed more than 25,000 internet-connected CCTV cameras.<\/p>\n

So a growing development in cybercriminal capabilities \u2014 crooks using IoT devices in attacks \u2014 is now officially a reality. How did it happen? Well, as the case with many early IoT devices, the fault lies within the weak default passwords many manufacturers employ when they sell these new devices. These passwords include everything from \u201cadmin123\u201d to the product\u2019s name. Complicating this is the fact that many IoT device manufacturers rarely, if ever, update their devices to fix known vulnerabilities.<\/p>\n

The ease in which IoT devices can be hijacked is a big problem. The solution, however, starts with developing IoT devices with security in mind. Everything in these devices, from the chipset on upwards, will need to be deployed with the ability to be updated by manufacturers and secured with anti-malware solutions from the get-go.<\/p>\n

Tips to Protect Your IoT Devices<\/h2>\n

So what can you do, as an individual, to protect your IoT devices from cybercriminals? Well, here are a few tips:<\/p>\n