It’s 2016 and the “Internet of Things” is in full swing. It is estimated that there are over 6 billion devices already connected and that number is expected to grow to over 21 billion by 2020. Everything from ingestibles to wearables, drones, cars and even whole buildings are being connected to the internet.

While it may be convenient to be able to control your refrigerator, thermostat or DVR from your phone, connecting all these devices opens the door to (not so)new security threats. In the last few months it has come to light that in order to keep cost down on many of these device, not much thought has been put into securing them.

It turns out that many of these IoT devices are being shipped with default user names and passwords like Admin/Admin. This vulnerability has not gone unnoticed on the internet underground and is already being exploited. While DDoS attacks are by no means a new phenomenon these unsecured IoT devices are being hijacked to magnify their strength and the problem is likely to only get worse. Just last month the source code for an IoT botnet dubbed “Mirai” was released to the world. This software continuously scans the internet for insecure IoT devices and then loads malicious software that turns them into “bots” by forcing them to connect to a control server to be leveraged in powerful, large scale attacks designed to disrupt internet traffic.

To put this into perspective, in 2015 the largest DDoS attack recorded came in around 149Gbps of traffic. The two largest attacks this year have weighed in at 555Gbps and 623Gbps and both were powered by Mirai.

So what does this mean? So far, not much thankfully. Most of the reported attacks using these IoT botnets have been directed at game servers or individual users. However the recent attacks on DNS provider Dyn, which prevented users in Europe and North America from accessing many of the Internets largest platforms and services, has show the disruptive power of these botnets.

As more and more critical devices are connected and critical services rely on the internet the disruption caused by these botnets has the potential to cause very real damage if aimed at physical infrastructure.

So what can users do to help limit the impact and protect their devices? For the average user, not much. Many of these devices have complex or non-existent methods of changing their administrative credentials. For most users this is something they are not even going to think about when setting up a new device. What is needed is for hardware vendors to step up their game and stop viewing security as nothing more than a cost.

congress

Earlier this week security experts spoke in front of congress and warned representatives that the current lack of security standards for IoT devices was a big part of the problem, and that IoT manufacturers needed to embrace additional security practices to prevent harm to users and the internet. It was argued that government regulation was required to force manufacturers to secure their devices. We can only hope that these warnings have not fallen on deaf ears and the problem of IoT security is addressed sooner rather than later.