145,000 IoT devices hacked and used in DDoS attack
Hackers used a network of over 145,000 Internet of Things (IoT) devices to launch an attack on data hosting firm OVH. The multivector 1.5Tbps DDoS attack is understood to have come from the same source as an attack on US infosec journalist Brian Krebs. The attack highlighted two significant security issues, Comparitech.com security researcher Lee Munson says: that the number and scale of DDoS attacks is larger than ever, and that the IoT is increasingly concerning as a security. Further regulation for IoT needs to be put in place to halt further attacks of this kind, Munson added.
The machines are marching: in what is the world’s largest DDoS attack so far, hackers have enlisted a network of over 145,000 internet of things (IoT) devices, and hacked CCTV cameras to mount an attack on data hosting company OVH.

It doesn’t bode well for the future of IoT if hackers can disable an entire network of connected devices and turn them into a massive DDoS attack.

Just days after esteemed US infosec journalist Brian Krebs, of Krebs on Security, was taken offline in a 620Gbps DDOS attack, French hosting provider OVH was hit.

‘The internet of things, that marvellous evolution of network-enabled household items that promise[s] oodles of goodness to homeowners while, years on from its inception, still concerns those of us in the security industry who have long warned of manufacturers who consider the risks too late in the development cycle, or not at all’

– LEE MUNSON

This time, a fleet of cameras and digital video recorders were taken over by a multivector 1.5Tbps DDoS attack and then turned on OVH.

A DDoS attack is an attempt to make a network resource unavailable to the internet by flooding it with traffic. A number (often thousands) of unique IP addresses effectively crowd the entrance to an online store or business.

OVH chief technology officer Octave Klaba said that 145,607 hosted cameras were being used to hit the company with the equivalent of 30Mbps per IP, amounting to an overall 1.5Tbps.

Klaba confirmed that the attack used IoT devices, including hacked CCTV cameras.

This botnet with 145607 cameras/dvr (1-30Mbps per IP) is able to send >1.5Tbps DDoS. Type: tcp/ack, tcp/ack+psh, tcp/syn. — Octave Klaba / Oles (@olesovhcom) September 23, 2016

The attack is understood to come from the same sources who spearheaded the attack on Krebs. Interestingly, after Akamai pulled Krebs’ pages, Google is now bearing the brunt of attacks for providing free mitigation services to Krebs.

Should IoT devices be regulated?

While OVH has been ultimately able to prevail against the attack, the real concern is what happens if the hackers decide to mount an attack against a smaller, less technically prepared target?

“The recent OVH DDoS attack has highlighted two key security issues, neither of which looks like being addressed any time soon,” Lee Munson, security researcher for Comparitech.com explained.

“The first is the number and scale of DDoS attacks that have been taking place recently.

“Gone are the days when a few script kiddies would shackle a few computers together to flood an individual’s blog into an overloaded pocketful of submission – nowadays it’s all about huge botnets and corresponding services that can be hired by the hour, by bandwidth or based on results.

“Secondly, it is all about the internet of things, that marvellous evolution of network-enabled household items that promise[s] oodles of goodness to homeowners while, years on from its inception, still concerns those of us in the security industry who have long warned of manufacturers who consider the risks too late in the development cycle, or not at all.

“Until governments regulate IoT devices, or manufacturers at least consider more than the bottom line, cameras, fridges and toasters around the world will continue to offer themselves up as willing slaves to botnet command and control centres, waiting to be unleashed on Krebs on Security or any other website that a bad actor wants to take down,” Munson warned.