Menu
IoT botnet highlights the dangers of default passwords

IoT botnet highlights the dangers of default passwords

The Mirai botnet used IoT devices to launch a massive DDOS attack

A botnet responsible for a massive DDOS (distributed denial-of-service) attack was created thanks to weak default usernames and passwords found in internet-connected cameras and DVRs.

The Mirai botnet grabbed headlines last month for taking down the website of cybersecurity reporter Brian Krebs with a huge DDOS attack. Unlike most botnets, which rely on infected PCs, this one used IoT devices to target its victims.

It turns out the botnet was specifically designed to scan the internet for poorly secured products like cameras and then access them through easily guessable passwords like "admin" or "12345." Last Friday, the botnet's maker released its source code, and security experts have noticed it's built to try a list of more than 60 combinations of user names and passwords.

Those combinations were enough to allow the botnet to spread to 380,000 devices, according to its maker, who posted the source code on HackForums.

Security experts are warning that more botnets like Mirai will appear unless the hardware industry can move away from default passwords.

"There has to be some kind of mandate to make these devices more secure or require a password change once installed", said Tim Matthews, a vice president at security firm Imperva.

Researchers have long been pointing out the problems with internet-connected appliances and how they're often built without security in mind. The Mirai botnet further highlights the problem, according to Matthews.

His company has been noticing an uptick in DDOS attacks coming from botnets that are powered by smart devices. These botnets work by infecting the products with malware and enslaving them under the hacker's control.     

"We've seen this trend building since mid last year," he said. A prime example of devices that are susceptible to infection is internet-connected security cameras, which are often installed by resellers but never updated.

"One mistake that the manufacturers make is that they allow remote access to these devices," he said. "In some cases, a single camera will have 15 different infections."

As for the Mirai botnet, it appears to have been relying on cameras from a Chinese company called Dahua and from DVRs from an unknown vendor, according to internet backbone provider Level 3 Communications, which has been monitoring the DDOS attacks. 

Dahua didn't immediately respond to a request for comment. 

Krebs has posted a list of products possibly susceptible to the Mirai botnet, and it's quite long. He created the list by looking up the default usernames and passwords on Google and then matching them to products. 

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments