What is a botnet? And what does it have to do with a toaster?<\/p>\n
We\u2019ll get to that. First, a definition:<\/p>\n
A botnet is a group of internet-connected devices that bad actors hijack with malware. Using remote controls, bad actors can harness the power of the network to perform several types of attacks. These include distributed denial-of-service (DDoS) attacks that shut down internet services, breaking into other networks to steal data, and sending massive volumes of spam.<\/em><\/p>\n In a way, the metaphor of an \u201carmy of devices\u201d leveling a cyberattack works well. With thousands or even millions of compromised devices working in concert, bad actors can do plenty of harm. As we\u2019ll see in a moment, they\u2019ve done their share already.<\/p>\n Which brings us back to that toaster.<\/p>\n The pop-up toaster as we know it first hit the shelves in 1926, under the brand name \u201cToastmaster.\u201d[i]<\/a> With a familiar springy *pop*, it has ejected toast just the way we like it for nearly a century. Given that its design was so simple and effective, it\u2019s remained largely unchanged. Until now. Thanks to the internet and so-called \u201csmart home\u201d devices.<\/p>\n Toasters, among other things, are all getting connected. And have been for a few years now, to the point where the number of connected Internet of Things (IoT) devices\u00a0reaches well into the billions\u00a0worldwide \u2014 which includes smart home devices.[ii]<\/a><\/p>\n Businesses use IoT devices to track shipments and various aspects of their supply chain. Cities use them to manage traffic flow and monitor energy use. (Does your home have a smart electric meter?) And for people like us, we use them to play music on smart speakers, see who\u2019s at the front door with smart doorbells, and order groceries from an LCD screen on our smart refrigerators \u2014 just to name a few ways we\u2019ve welcomed smart home devices into our households.<\/p>\n In the U.S. alone,\u00a0smart home devices make up a $30-plus billion marketplace\u00a0per year.[iii]<\/a> However, it\u2019s still a relatively young marketplace. And with that comes several security issues.<\/p>\n First and foremost, many of these devices still lack sophisticated security measures, which makes them easy pickings for cybercriminals. Why would a cybercriminal target that smart lightbulb in your living room reading lamp? Networks are only as secure as their least secure device. Thus, if a cybercriminal can compromise that smart lightbulb, it can potentially give them access to the entire home network it is on \u2014 along with all the other devices and data on it.<\/p>\n More commonly, though, hackers target smart home devices for another reason. They conscript them into botnets. It\u2019s a highly automated affair. Hackers use bots to add devices to their networks. They scan the internet in search of vulnerable devices and use brute-force password attacks to take control of them.<\/p>\n At issue: many of these devices ship with factory usernames and passwords. Fed with that info, a hacker\u2019s bot can have a relatively good success rate because people often leave the factory password unchanged. It\u2019s an easy in.<\/p>\n Results from one real-life test show just how active these hacker bots are:<\/p>\n We created a fake smart home and set up a range of real consumer devices, from televisions to thermostats to smart security systems and even a smart kettle – and hooked it up to the internet.<\/p>\n What happened next was a deluge of attempts by cybercriminals and other unknown actors to break into our devices, at one stage, reaching 14 hacking attempts every single hour.<\/p>\n Put another way, that hourly rate added up to more than 12,000 unique scans and attack attempts a week.[iv]<\/a> Imagine all that activity pinging your smart home devices.<\/p>\n Now, with a botnet in place, hackers can wage the kinds of attacks we mentioned above, particularly DDoS attacks. DDoS attacks can shut down websites, disrupt service and even choke traffic across broad swathes of the internet.<\/p>\n Remember\u00a0the \u201cMirai\u201d botnet attack of 2016, where hackers targeted a major provider of internet infrastructure?[v]<\/a> It ended up crippling traffic in concentrated areas across the U.S., including the northeast, Great Lakes, south-central, and western regions. Millions of internet users were affected, people, businesses, and government workers alike.<\/p>\n Another more recent set of headline-makers are the December 2023 and July 2024 attacks on Amazon Web Services (AWS).[vi]<\/a>,<\/sup> [vii]<\/a> AWS provides cloud computing services to millions of businesses and organizations, large and small. Those customers saw slowdowns and disruptions for three days, which in turn slowed down and disrupted the people and services that wanted to connect with them.<\/p>\n Also in July 2024, Microsoft likewise fell victim to a DDoS attack. It affected everything from Outlook email to Azure web services, and Microsoft Office to online games of Minecraft. They all got swept up in it.[viii]<\/a><\/p>\n These attacks stand out as high-profile DDoS attacks, yet smaller botnet attacks abound, ones that don\u2019t make headlines. They can disrupt the operations of websites, public infrastructure, and businesses, not to mention the well-being of people who rely on the internet.<\/p>\n Earlier we mentioned the problem of unchanged factory usernames and passwords. These include everything from \u201cadmin123\u201d to the product\u2019s name. Easy to remember, and highly insecure. The practice is so common that they get posted in bulk on hacking websites, making it easy for cybercriminals to simply look up the type of device they want to attack.<\/p>\n Complicating security yet further is the fact that\u00a0some IoT and smart home device manufacturers introduce flaws in their design, protocols, and code that make them susceptible to attacks.[ix]<\/a> The thought gets yet more unsettling when you consider that some of the flaws were found in things like smart door locks.<\/p>\n The ease with which IoT devices can be compromised is a big problem. The solution, however, starts with manufacturers that develop IoT devices with security in mind. Everything in these devices will need to be deployed with the ability to accept security updates and embed strong security solutions from the get-go.<\/p>\n Until industry standards get established to ensure such basic security, a portion of securing your IoT and smart home devices falls on us, as people and consumers.<\/p>\n As for security, you can take steps that can help keep you safer. Broadly speaking, they involve two things: protecting your devices and protecting the network they\u2019re on. These security measures will look familiar, as they follow many of the same measures you can take to protect your computers, tablets, and phones.<\/p>\n Grab online protection for your smartphone.\u00a0<\/strong><\/p>\n Many smart home devices use a smartphone as a sort of remote control, not to mention as a place for gathering, storing, and sharing data. So whether you\u2019re an Android owner or iOS owner, use online protection software on your phone<\/a>\u00a0to help keep it safe from compromise and attack.<\/p>\n Don\u2019t use the default \u2014 Set a strong, unique password.\u00a0<\/strong><\/p>\n One issue with many IoT devices is that they often come with a default username and password. This could mean that your device and thousands of others just like it all share the same credentials, which makes it painfully easy for a hacker to gain access to them because those default usernames and passwords are often published online. When you purchase any IoT device, set a fresh password using a strong method of password creation, such as ours. Likewise, create an entirely new username for additional protection as well.<\/p>\n Use multi-factor authentication.\u00a0<\/strong><\/p>\n Online banks, shops, and other services commonly offer multi-factor authentication to help protect your accounts \u2014 with the typical combination of your username, password, and a security code sent to another device you own (often a mobile phone). If your IoT device supports multi-factor authentication, consider using it there too. It throws a big barrier in the way of hackers who simply try and force their way into your device with a password\/username combination.<\/p>\n Secure your internet router too.\u00a0<\/strong><\/p>\n Another device that needs good password protection is your internet router. Make sure you use a strong and unique password as well to help prevent hackers from breaking into your home network. Also, consider changing the name of your home network so that it doesn\u2019t personally identify you. Fun alternatives to using your name or address include everything from movie lines like \u201cMay the Wi-Fi be with you\u201d to old sitcom references like \u201cCentral Perk.\u201d Also check that your router is using an encryption method, like WPA2 or the newer WPA3, which keeps your signal secure.<\/p>\n Upgrade to a newer internet router.\u00a0<\/strong><\/p>\n Older routers might have outdated security measures, which might make them more prone to attacks. If you\u2019re renting yours from your internet provider, contact them for an upgrade. If you\u2019re using your own, visit a reputable news or review site such as Consumer Reports for a list of the best routers that combine speed, capacity, and security.<\/p>\n Update your apps and devices regularly.\u00a0<\/strong><\/p>\n In addition to fixing the odd bug or adding the occasional new feature, updates often fix security gaps. Out-of-date apps and devices might have flaws that hackers can exploit, so regular updating is a must from a security standpoint. If you can set your smart home apps and devices to receive automatic updates, that\u2019s even better.<\/p>\n Set up a guest network specifically for your IoT devices.\u00a0<\/strong><\/p>\n Just as you can offer your guests secure access that\u2019s separate from your own devices, creating an additional network on your router allows you to keep your computers and smartphones separate from IoT devices. This way, if an IoT device is compromised, a hacker will still have difficulty accessing your other devices on your primary network, the one where you connect your computers and smartphones.<\/p>\n Shop smart.\u00a0<\/strong><\/p>\n Read trusted reviews and look up the manufacturer\u2019s track record online. Have their devices been compromised in the past? Do they provide regular updates for their devices to ensure ongoing security? What kind of security features do they offer? And privacy features too? Resources like Consumer Reports can provide extensive and unbiased information that can help you make a sound purchasing decision.<\/p>\n As more and more connected devices make their way into our homes, the need to ensure that they\u2019re secure only increases. More devices mean more potential avenues of attack, and your home network is only as secure as the least secure device that\u2019s on it.<\/p>\n While standards put forward by industry groups such as\u00a0UL\u00a0and\u00a0Matter\u00a0have started to take root, a good portion of keeping IoT and smart home devices secure falls on us as consumers. Taking the steps above can help prevent your connected toaster from playing its part in a botnet army attack \u2014 and it can also protect your network and your home from getting hacked.<\/p>\n It\u2019s no surprise that IoT and smart home devices have raked in billions of dollars over the years. They introduce conveniences and little touches into our homes that make life more comfortable and enjoyable. However, they\u2019re still connected devices. And like anything that\u2019s connected, they must be protected.<\/p>\n [i]<\/a> https:\/\/www.hagley.org\/librarynews\/history-making-toast<\/a><\/p>\n [ii]<\/a> https:\/\/www.statista.com\/statistics\/1183457\/iot-connected-devices-worldwide\/<\/a><\/p>\n [iii]<\/a> https:\/\/www.statista.com\/outlook\/dmo\/smart-home\/united-states<\/a><\/p>\n [iv]<\/a> https:\/\/www.which.co.uk\/news\/article\/how-the-smart-home-could-be-at-risk-from-hackers-akeR18s9eBHU<\/a><\/p>\n [v]<\/a> https:\/\/en.wikipedia.org\/wiki\/Mirai_(malware)<\/a><\/p>\n [vi]<\/a> https:\/\/www.darkreading.com\/cloud-security\/eight-hour-ddos-attack-struck-aws-customers<\/a><\/p>\n [vii]<\/a> https:\/\/www.forbes.com\/sites\/emilsayegh\/2024\/07\/31\/microsoft-and-aws-outages-a-wake-up-call-for-cloud-dependency\/<\/a><\/p>\n [viii]<\/a> https:\/\/www.bbc.com\/news\/articles\/c903e793w74o<\/a><\/p>\n [ix]<\/a> https:\/\/news.fit.edu\/academics-research\/apps-for-popular-smart-home-devices-contain-security-flaws-new-research-finds\/<\/a><\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" What is a botnet? And what does it have to do with a toaster? We\u2019ll get to that. First, a…<\/p>\n","protected":false},"author":1407,"featured_media":203898,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[10661,13],"tags":[49,4131],"coauthors":[15735],"class_list":["post-84461","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-internet-security","category-privacy-identity-protection","tag-botnet","tag-internet-of-things"],"acf":[],"yoast_head":"\nIoT security issues and big-time botnet attacks\u00a0<\/strong><\/h2>\n
Botnet attacks: Security shortcomings in IoT and smart home devices\u00a0<\/strong><\/h2>\n
Steps for a more secure network and smart devices\u00a0<\/strong><\/h2>\n
Don\u2019t let botnets burn your toast<\/strong><\/h2>\n