Professor Discusses ‘Internet of Things’ Used in Massive Cyber Attack

During the attack last month, hackers used hundreds of thousands of internet-connected devices such as cameras, baby monitors, and home routers to flood servers owned by Dyn, a company that monitors and controls traffic for major websites.

The nature of the attack was not new, said Embry-Riddle Computer Science Professor Remzi Seker, but the devices used in the attack were unprecedented. Hackers often launch distributed denial of service attacks (DDos), which targets systems with a flood of incoming traffic or messages, causing the systems to overload and shut down. But during the latest attack, hackers used directed data from the “Internet of Things,” to overload sites and make them inaccessible for several hours. The Internet of Things refers to everyday objects that have network connectivity that allows them to send and receive data.

As more everyday devices become connected to the Internet, the risk of attacks increase.

“This was the first kind of attack that used the Internet of Things,” Seker said. “Data from devices such as security cameras in homes that stream to the internet were diverted to these sites. These devices sent images or video to these sites using Generic Routing Encapsulation (GRE), which clogged the networks.”

GRE is a mechanism to establish point-to-point data transfer between two computers through public Internet. The devices used can be hacked into without an owner’s knowledge. Seker said that many devices hacked into used default passwords or had weak passwords set up by the users. The attack code tries a set of known username-password combinations on devices located on the Internet.

“In addition to using stronger passwords you need to research and think about the security implications of anything you are installing on your network,” Seker said. “Do some research before you purchase equipment to determine how secure it is. Some of the services we utilize have become commodity without enough scrutiny.”

These cameras could also be used for spying purposes, Seker said.

“I call it the Internet of Troubles,” Seker said. “Connectivity is important as systems evolve but it also opens you up to potential attacks. You have to focus on the quality, not just the service. A service has to go through many iterations and scrutiny before it becomes a commodity. This has not been the case when it comes to services offered through computers and the Internet.”

The cybersecurity industry often changes by the day and that’s why it’s an important field for students to enter and be part of new solutions. As the industry seeks more avenues to protect networks from attacks like DDoS, the Internet of Things will need more secure features. Overall, Seker says that he is optimistic about the future of cybersecurity because he believes systems will evolve to address the threats and meet the expectations.

“We need to come up with more innovative ways to design and update systems,” Seker said. “But it’s not cheap to be prepared for these attacks. This case was such a massive attack that companies needed much more resources for handling it than what they had at their disposal.”

Also read: “Tips for Producing Strong Passwords”