April 27, 2017 By Larry Loeb 2 min read

Sierra Tel (ST) won’t forget April 10. On that date this year, the California-based telecommunications company may have been taken down by two warring families of botnets that attacked an Internet of Things (IoT) device in its network.

An IoT Device With a Checkered History

When its customers in Mariposa and Oakhurst, California, started to complain that they had lost all connectivity, the company determined that all these customers were using the same modem, the ZyXel HN51.

While ST diagnosed the cause of the problem rather quickly, Bleeping Computer reported that it took until April 22 for all the affected customers to obtain replacement devices. Frustrated customers quickly exhausted available supplies of the modem when the company offered them an opportunity to swap out old devices at its offices.

The ZyXel HN51 has a checkered history. This is the same modem that caused Deutsche Telekom to go offline for nearly a full day last year, according to Bleeping Computer. It took the German ISP about that long to regain control over its devices through a firmware update. A week later, some British ISPs experienced the same problem. At the time, the Mirai IoT botnet was thought to be the culprit.

The ZyXel modem uses the TR-069 control interface as a way for system administrators to assert hardware-level control on modems in a network. But that interface can be exploited, according to SANS, requiring strict filtering at the network or modem interface to prevent the exploits from occurring.

Vigilante Justice

It’s possible that a vigilante IoT construct could have caused this failure while trying to neutralize rogue IoT devices. One such construct, BrickerBot, is said to be able to wipe any onboard memory in a device and rewrite it with random garbage, Bleeping Computer reported. That would require device replacement, which is just what ST was forced to do.

A clear solution is nowhere in sight. Other unknown threat actors may be at work here as well, and this particular modem has proven to be exploitable. But a system operator such as ST must be aware of the actions that need to be implemented by a network to avoid bricked devices. No matter how or why they get bricked, they’ll almost always come with irate customers attached.

More from

What does resilience in the cyber world look like in 2025 and beyond?

6 min read -  Back in 2021, we ran a series called “A Journey in Organizational Resilience.” These issues of this series remain applicable today and, in many cases, are more important than ever, given the rapid changes of the last few years. But the term "resilience" can be difficult to define, and when we define it, we may limit its scope, missing the big picture.In the age of generative artificial intelligence (gen AI), the prevalence of breach data from infostealers and the near-constant…

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today