Internet of Things (IoT) security concerns have shifted from early adopter observations to mainstream worries. As noted by the Computer Business Review, almost 50 percent of companies surveyed said that security was the “biggest inhibitor” to getting the most out of their IoT network.

According to Softpedia, these worries may be worthwhile — a massive closed-circuit television (CCTV) botnet was recently pinpointed as the source of aggressive DDoS attacks. Is this camera compromise the first sign of big IoT trouble?

Smile for the CCTV Botnet!

As noted by Network World, the camera conundrum first came to light when a jewelry store tapped digital defense firm Sucuri to mitigate a serious distributed denial-of-service (DDoS) attack — more than 35,000 HTTP requests were being generated each second, making it impossible for the site to operate. Sucuri dropped the site behind their web application firewall (WAF) and expected the attack to abate, but instead found the intensity ramped up to 50,000 HTTP requests.

This number was worrisome enough, but the company also noticed that there was no flutter to the attacks as bots went online or offline, suggesting that all endpoints connected to the botnet were active at all times.

Research led Sucuri to 25,513 unique IP addresses, all linked to CCTV cameras around the world. Twenty-four percent were located in Taiwan, 12 percent in the U.S. and 9 percent in Indonesia, but all told, 95 different countries had cameras that were part of the botnet. Of note is that 46 percent of these systems were running a generic H.264 DVR made by Chinese firm TVT, which was notified about firmware issues by security expert Rotem Kerner earlier this year, Softpedia reported.

The result? A botnet bonanza — much larger than the first CCTV botnet detected last October, which used only 900 cameras to carry out attacks.

No Small Problem

IoT networks present a unique security challenge: While connected devices are typically small and have limited functionality, in large groups they’re extremely dangerous. Take the camera botnet. Not only were tens of thousands of CCTV endpoints available to compromise, but these devices were designed for i4/7 Internet connection, granting attackers nearly limitless DDoS power.

While there’s interest in better IoT security, new issues continue to emerge. Dark Reading pointed to the recent Nissan Leaf debacle, which saw security researcher Troy Hunt easily hack the car’s climate controls after the vehicle-maker refused to plug the holes in the app, one of which was a total lack of authorization.

Here’s the bottom line: This CCTV botnet is an obvious symptom of a larger disease — the continued corporate assumption that IoT offerings don’t require the same level of IT security as traditional devices. Instead, companies need to think of IoT devices like ants, where a single bite is annoying but 10,000 could be incapacitating. In aggregate, IoT devices are capable of zooming in on even the smallest security flaws.

More from

The White House on Quantum Encryption and IoT Labels

A recent White House Fact Sheet outlined the current and future U.S. cybersecurity priorities. While most of the topics covered were in line with expectations, others drew more attention. The emphasis on critical infrastructure protection is clearly a top national priority. However, the plan is to create a labeling system for IoT devices, identifying the ones with the highest cybersecurity standards. Few expected that news. The topic of quantum-resistant encryption reveals that such concerns may become a reality sooner than…

Contain Breaches and Gain Visibility With Microsegmentation

Organizations must grapple with challenges from various market forces. Digital transformation, cloud adoption, hybrid work environments and geopolitical and economic challenges all have a part to play. These forces have especially manifested in more significant security threats to expanding IT attack surfaces. Breach containment is essential, and zero trust security principles can be applied to curtail attacks across IT environments, minimizing business disruption proactively. Microsegmentation has emerged as a viable solution through its continuous visualization of workload and device communications…

CEO, CIO or CFO: Who Should Your CISO Report To?

As we move deeper into a digitally dependent future, the growing concern of data breaches and other cyber threats has led to the rise of the Chief Information Security Officer (CISO). This position is essential in almost every company that relies on digital information. They are responsible for developing and implementing strategies to harden the organization's defenses against cyberattacks. However, while many organizations don't question the value of a CISO, there should be more debate over who this important role…

Malware-as-a-Service Flaunts Its Tally of Users and Victims

As time passes, the security landscape keeps getting stranger and scarier. How long did the “not if, but when” mentality towards cyberattacks last — a few years, maybe? Now, security pros think in terms of how often will their organization be attacked and at what cost. Or they consider how the difference between legitimate Software-as-a-Service (SaaS) brands and Malware-as-a-Service (MaaS) gangs keeps getting blurrier. MaaS operators provide web-based services, slick UX, tiered subscriptions, newsletters and Telegram channels that keep users…