Distributed denial-of-service (DDoS) attacks using authentic IoT devices are easy to detect based upon the extreme increase in traffic. However, they are one of the more difficult attacks to remediate. Remediation requires discerning authentic traffic from malicious traffic — all generated from authentic devices. An authentic device is an internet-enabled endpoint that has historically generated benign traffic.

The Domain Name System (DNS) DDoS attack that occurred on October 21 most likely used hijacked cameras, home automation devices and internet-enabled appliances by detecting factory-supplied passwords. They send an excessive amount of valid traffic with deterministic and nondeterministic intent.

Remediating an attack involves the detection of an extraneous number, or anomalous frequency of requests, by requesting devices and temporarily blacklisting those devices. You cannot permanently blacklist these devices, as they are authentic and potentially perform strategic security and safety functions. Likewise, geoblockers are not as effective in thwarting these attacks since they are hijacked authentic devices that are globally geolocated —hence the difficulty in remediation.

These attackers took a multiphased approach to accomplish their mission. First, they developed botnets to scan the internet in an attempt to find devices with factory-set passwords. Most of these devices are Linux-based, and it is fairly easy with root access to inject an executable to perform a continual stream of DNS requests. The botnets then infected the devices with this malicious application.

In parallel, botnets most likely probed DNS providers to see which providers would be susceptible to these types of attacks. This involved submitting micro-requests to providers to disclose if, how and at what threshold the provider blocked the requesting device. The knowledge of both susceptible devices and susceptible providers allowed the perfect medium for a successful attack.

DDoS attacks are usually short-lived and cause outages measured in hours; it takes a great deal of planning and work for a relatively short interruption. A malicious organization investing this much work would use its talent and resources for a more direct monetary compensation. This attack was most probably the work of a well-organized and directed group to ascertain the damage that could be caused by the disruption. These types of DDoS attacks could have significant effects in times of war, political campaigns, national emergencies, weather events and the like — that is, a malicious intent where a short-term disruption could have significant implications for people to communicate effectively.

Most likely the attackers did not reveal all the infected devices and will continue to supplement their inventory in preparation for an additional attack. So what can be done to prevent this in the future?

  1. IoT device manufacturers should require that factory passwords be updated on devices before they can be enabled.
  2. Service providers must have the flexibility to change and modify their systems quickly for different attack vectors. DNS service providers already have detection and remediation technologies. Unfortunately, the magnitude of the attack significantly changes the detection vectors; one thousand devices sending 500 DNS requests per minute have a very different attack vector than 400,000 devices sending 25 DNS requests per minute.
  3. The ability to detect DNS probing for malicious intent.
  4. Disclosure of the command-and-control (C&C) enterprise that controls the infected devices. All the infected devices most likely would periodically check with a centralized C&C authority to coordinate the attack. Global visibility of DNS traffic would enable the detection of a worldwide coordinated attack.

Finally, it is important that we do not blame DYN for poor security measures. This is one of the largest DDoS attacks using authentic systems that our industry has experienced. DYN was unfortunate to be the first vendor to experience an attack of this magnitude, requiring it to modify its detection and remediation technologies under duress. DYN performed remarkably to remediate this attack as quickly as it did based on the event’s significance. It is an exponential curve when relating the attack vectors to the remediation systems: The more geographically dispersed the devices are, the more authentic they are, and the lower the per-device threshold, the greater the difficulty in detection.

More from

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…