Internet of Things (IoT) security concerns have shifted from early adopter observations to mainstream worries. As noted by the Computer Business Review, almost 50 percent of companies surveyed said that security was the “biggest inhibitor” to getting the most out of their IoT network.

According to Softpedia, these worries may be worthwhile — a massive closed-circuit television (CCTV) botnet was recently pinpointed as the source of aggressive DDoS attacks. Is this camera compromise the first sign of big IoT trouble?

Smile for the CCTV Botnet!

As noted by Network World, the camera conundrum first came to light when a jewelry store tapped digital defense firm Sucuri to mitigate a serious distributed denial-of-service (DDoS) attack — more than 35,000 HTTP requests were being generated each second, making it impossible for the site to operate. Sucuri dropped the site behind their web application firewall (WAF) and expected the attack to abate, but instead found the intensity ramped up to 50,000 HTTP requests.

This number was worrisome enough, but the company also noticed that there was no flutter to the attacks as bots went online or offline, suggesting that all endpoints connected to the botnet were active at all times.

Research led Sucuri to 25,513 unique IP addresses, all linked to CCTV cameras around the world. Twenty-four percent were located in Taiwan, 12 percent in the U.S. and 9 percent in Indonesia, but all told, 95 different countries had cameras that were part of the botnet. Of note is that 46 percent of these systems were running a generic H.264 DVR made by Chinese firm TVT, which was notified about firmware issues by security expert Rotem Kerner earlier this year, Softpedia reported.

The result? A botnet bonanza — much larger than the first CCTV botnet detected last October, which used only 900 cameras to carry out attacks.

No Small Problem

IoT networks present a unique security challenge: While connected devices are typically small and have limited functionality, in large groups they’re extremely dangerous. Take the camera botnet. Not only were tens of thousands of CCTV endpoints available to compromise, but these devices were designed for i4/7 Internet connection, granting attackers nearly limitless DDoS power.

While there’s interest in better IoT security, new issues continue to emerge. Dark Reading pointed to the recent Nissan Leaf debacle, which saw security researcher Troy Hunt easily hack the car’s climate controls after the vehicle-maker refused to plug the holes in the app, one of which was a total lack of authorization.

Here’s the bottom line: This CCTV botnet is an obvious symptom of a larger disease — the continued corporate assumption that IoT offerings don’t require the same level of IT security as traditional devices. Instead, companies need to think of IoT devices like ants, where a single bite is annoying but 10,000 could be incapacitating. In aggregate, IoT devices are capable of zooming in on even the smallest security flaws.