When popular websites like Twitter, Netflix, Spotify and Etsy were inaccessible to users for several hours on Oct. 21, it was the first time hackers used Internet-connected appliances such as web cameras to launch a cybersecurity attack.
During the attack last month, hackers used hundreds of thousands of internet-connected devices such as cameras, baby monitors, and home routers to flood servers owned by Dyn, a company that monitors and controls traffic for major websites.
The nature of the attack was not new, said Embry-Riddle Computer Science Professor Remzi Seker, but the devices used in the attack were unprecedented. Hackers often launch distributed denial of service attacks (DDos), which targets systems with a flood of incoming traffic or messages, causing the systems to overload and shut down. But during the latest attack, hackers used directed data from the “Internet of Things,” to overload sites and make them inaccessible for several hours. The Internet of Things refers to everyday objects that have network connectivity that allows them to send and receive data.
As more everyday devices become connected to the Internet, the risk of attacks increase.
“This was the first kind of attack that used the Internet of Things,” Seker said. “Data from devices such as security cameras in homes that stream to the internet were diverted to these sites. These devices sent images or video to these sites using Generic Routing Encapsulation (GRE), which clogged the networks.”
GRE is a mechanism to establish point-to-point data transfer between two computers through public Internet. The devices used can be hacked into without an owner’s knowledge. Seker said that many devices hacked into used default passwords or had weak passwords set up by the users. The attack code tries a set of known username-password combinations on devices located on the Internet.
“In addition to using stronger passwords you need to research and think about the security implications of anything you are installing on your network,” Seker said. “Do some research before you purchase equipment to determine how secure it is. Some of the services we utilize have become commodity without enough scrutiny.”
These cameras could also be used for spying purposes, Seker said.
“I call it the Internet of Troubles,” Seker said. “Connectivity is important as systems evolve but it also opens you up to potential attacks. You have to focus on the quality, not just the service. A service has to go through many iterations and scrutiny before it becomes a commodity. This has not been the case when it comes to services offered through computers and the Internet.”
The cybersecurity industry often changes by the day and that’s why it’s an important field for students to enter and be part of new solutions. As the industry seeks more avenues to protect networks from attacks like DDoS, the Internet of Things will need more secure features. Overall, Seker says that he is optimistic about the future of cybersecurity because he believes systems will evolve to address the threats and meet the expectations.
“We need to come up with more innovative ways to design and update systems,” Seker said. “But it’s not cheap to be prepared for these attacks. This case was such a massive attack that companies needed much more resources for handling it than what they had at their disposal.”
Also read: “Tips for Producing Strong Passwords”
You know WHERE you’re going. We help you GET THERE.
Embry-Riddle Aeronautical University, the world’s largest, fully accredited university specializing in aviation and aerospace, is a nonprofit, independent institution offering more than 80 baccalaureate, master’s and Ph.D. degree programs in its colleges of Arts & Sciences, Aviation, Business, Engineering and Security & Intelligence. Embry-Riddle educates students at residential campuses in Daytona Beach, Fla., and Prescott, Ariz., through the Worldwide Campus with more than 125 locations in the United States, Europe, Asia and the Middle East, and through online programs. The university is a major research center, seeking solutions to real-world problems in partnership with the aerospace industry, other universities and government agencies. For more information, visit erau.edu, follow us on Twitter (@EmbryRiddle) and facebook.com/EmbryRiddleUniversity, and find expert videos at YouTube.com/EmbryRiddleUniv.