DDoS Attacks on IoT. Doesn’t remind you of something… ?

DDoS Attacks on IoT. Doesn’t remind you of something… ?

It’s unfortunate that cybercriminals have many different ways of exploiting network vulnerabilities and weak spots in our cyber defenses. Considering that the number of devices we use on a daily basis is growing, more avenues of exploitation will be open to cybercriminals — unless we close those pathways.

Among the types of attacks that have recently been in an expansion, DDoS attacks on IoT devices via botnets have been especially devastating and difficult to counter. Let’s have a closer look at DDoS attacks, botnets, and ways of protection:

The Anatomy of a DDoS Attack on an IoT Device

A simple principle governs a “denial-of-service” attack: attackers use it to deny service to legitimate users. Some typical examples might include attackers overwhelming a website with requests, disrupting everyone’s access to the site, or focusing the attack on a particular target who will be denied access.

With DDoS, the attacker usually has one of three goals:

• To cause destruction or destructive change to network components;
• To destroy configuration information or its change;
• To cause consumption of non-renewable or limited resources.

DDoS attacks against IoT devices can be performed on their own, or as part of a more massive attack on an organization. It usually targets bandwidth or processing resources like memory and CPU cycles. However, the type of DDoS attacks where we often see IoT devices used is the botnet attack.

What Makes a Botnet Attack So Destructive?

A botnet is a group of connected computers that work together on performing repetitive tasks, and it does not necessarily have a malicious purpose. Unfortunately, it’s possible for an attacker to take control of a botnet by infecting a vulnerable device with malware. Then they can use the network as a group of devices to perform DDoS attacks on other IoT devices that can be much more dangerous, depending on the number of mechanisms involved. What’s more, since IoT devices often interact in the physical world in ways that other IT devices don’t, it’s difficult to monitor and safeguard them.

If we strive to protect IoT devices the same way we protect our conventional IT devices, there will invariably be faults in the system that cybercriminals might exploit. To eliminate vulnerabilities, we must think of IoT protection in its terms and take into account the various types of IoT use when we do.

Defense Against an IoT Botnet Attack

Even though the threat of botnets can’t wholly be eradicated, there are still ways to limit the impact and the scope of these attacks by taking preventative actions. One of them is placing IoT devices on a segmented network protected from external traffic. It’s also crucial to start monitoring the systems and invest in developing intrusion detection processes which would go a long way in warning a user that the system is being invaded.

What’s more, we shouldn’t forget other necessary security measures, like timely patching of the device software and the ability to control who can access a particular device. These are the capabilities that every IoT device must offer. More about the Three Types of Security in IoT

A one-size-fits-all Solution against DDoS attacks on IoT Devices?

Internet of Things is a developing technology that we must make as secure as possible, considering how quickly it’s becoming a standard part of our everyday lives and business needs. To do that, IoT developers, manufacturers, distributors and consumers must work together to eliminate common IoT vulnerabilities and ensure that each device is as secure as it can be from cyber attackers. Getting your own IoT Security Assurance Framework is by far the best cost-efficient way to address these challenges by reducing risks.

 

This article was written by Roland Atoui, Managing Director & Founder of Red Alert Labs, expert in Information Security and Certification with more than 10 years of experience in the industry. From smart cards to smart phones to smart manufacturing, Roland is a new technology enthusiast with a current mission to bring trust to the Internet of Things.