{"id":4780,"date":"2016-11-01T15:52:27","date_gmt":"2016-11-01T19:52:27","guid":{"rendered":"http:\/\/ncjolt.org\/?p=4780"},"modified":"2020-06-04T20:52:58","modified_gmt":"2020-06-04T20:52:58","slug":"ddos-attack-exposes-vulnerability-internet-things","status":"publish","type":"post","link":"https:\/\/journals.law.unc.edu\/ncjolt\/blogs\/ddos-attack-exposes-vulnerability-internet-things\/","title":{"rendered":"DDoS Attack exposes Vulnerability of Internet of Things"},"content":{"rendered":"

On Friday, October 21st, attackers controlling a vast collection of internet connected devices launched a denial-of-service attack<\/a><\/span> on web technology provider Dynamic Network Service, Inc., also know as Dyn. Dyn provides domain name system services to many popular websites, which is a key part of the “digital supply train<\/a>“<\/span>\u00a0which allows users to access websites like Twitter and Netflix. The attack serves as a validation for those that have long warned<\/a><\/span> that the “Internet of things<\/a><\/span>”\u00a0(referring the the multitude of common household devices that are connected to the internet) has created an opportunity for hackers to infiltrate average American households. While many will dismiss Friday\u2019s internet outage as a mere inconvenience, the attacks pose a threat to average Americans and large corporations alike.
\nFriday\u2019s attack was a large distributed denial of service or DDoS<\/a><\/span>, which aims to overwhelm servers with data requests from hundreds of thousands of internet devices. These often innocuous pieces of hardware (like thermostats or security cameras) sent requests to Dyn\u2019s DNS servers in such volume that some of Dyn\u2019s clients<\/a><\/span> (like Amazon Web Services) experienced outages as well. In the past hackers have targeted home computers with malware in order to create a “botnet<\/a><\/span>”\u00a0or network of compromised computers that don\u2019t appear compromised, but can be utilized at a hacker\u2019s command to terrible effect. However this attack utilized a large number of internet connected devices, including some web cameras that have now been recalled<\/a><\/span> by their Chinese manufacturer. While some devices don\u2019t have robust protection mechanisms, others like Apple\u2019s HomeKit<\/a><\/span> implement tough security and privacy protections.
\nSome sources have speculated<\/a><\/span> that attacks such as these are simply attempts by an unknown party to probe \u201cthe defenses of the companies that run critical pieces of the Internet.\u201d This possibility adds an extra element or urgency to a situation that already involved the privacy and protection of millions of Americans. Many sources have highlighted the fragility and insecurity<\/a><\/span> of Internet of things devices, and that such devices will continue to be likely targets for hackers in the future.<\/p>\n

\u201cBob Gourley<\/a><\/span>, co-founder of the cyber security consultancy Cognitio and former CTO of the Defense Intelligence Agency, said that DDoS attacks are up 75% this year, and that the average size of these attacks is growing.\u201d<\/p><\/blockquote>\n

Experts attempting to pin down the motivation behind the attacks have cited reasons ranging from politics to revenge to money, but also suggested has been industrial sabotage. Researchers<\/a><\/span> have found that many hackers sell the services of their botnets online, usually utilizing PayPal or Bitcoin to exchange payment for their services. Following the release of the source code for Mirai, a control software, criminal gangs have begun charging to employ it in cyberattacks<\/a><\/span>. In fact, some individuals have explicitly advertised<\/a><\/span> for sale the use of an internet of things botnet created from Mirai code, asking as little as $4,600 for control of 50,000 bots, while 100,000 cost only $7500.
\nBig businesses are in prime position to suffer from DDoS attacks, but can protect<\/a><\/span> themselves by utilizing multiple vendors for core services like routing internet traffic in order to better protect themselves. However, Internet of things creators also have a duty<\/a><\/span> to implement stronger standards and protocols for security for products that they sell to the American public. Most users of home computers are oblivious to potential security issues regarding their machines, and would be even less aware of the threat posed by unsecured internet connected devices. Hopefully this attack will serve as a wake up call for American companies, citizens, and the US government to take proactive steps to increase protections for internet connected devices and to secure critical internet infrastructure.<\/p>\n","protected":false},"excerpt":{"rendered":"

On Friday, October 21st, attackers controlling a vast collection of internet connected devices launched a denial-of-service attack on web technology provider Dynamic Network Service, Inc., also know as Dyn. Dyn provides domain name system services to many popular websites, which is a key part of the “digital supply train“\u00a0which allows users to access websites like …<\/a><\/p>\n","protected":false},"author":1,"featured_media":4781,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[51],"tags":[],"_links":{"self":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/4780"}],"collection":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/comments?post=4780"}],"version-history":[{"count":1,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/4780\/revisions"}],"predecessor-version":[{"id":7142,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/posts\/4780\/revisions\/7142"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/media\/4781"}],"wp:attachment":[{"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/media?parent=4780"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/categories?post=4780"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/journals.law.unc.edu\/ncjolt\/wp-json\/wp\/v2\/tags?post=4780"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}