The cyberattack that took out many of the internet’s most popular websites Friday is bound to happen again, local security experts say. 
 
 Friday’s distributed denial of service (DDoS) attack targeted the New Hampshire-based domain name server provider Dyn Inc. Security researchers say it was enabled by insecure Internet of Things devices whose owners failed to change a default password. Infected with the malware Mirai, hundreds of thousands — and potentially millions — of insecure devices ultimately could join this botnet army to create future havoc on the Web. 
 
 “For Internet of Things, there’s been an explosion in this sector. Your connected refrigerator, your door alarm, your webcams, there’s a proliferation of devices. They’re in people’s homes. They’re secured by ordinary people who don’t know much about security and don’t change the credentials,” said John Black, a professor at the University of Colorado and the director of education for SecureSet Academy in Denver. “Somebody somewhere has figured this out and probed the internet to find these devices. And they’ve found thousands and thousands of them.” 
 
 Mirai was released publicly on the dark Web this month, according to Brian Krebs, a cybersecurity journalist whose own site was knocked offline by the malware in September, before the public release. 
 
 This week, security researchers at Level 3 Communications in Broomfield, estimated that the Mirai army had doubled in size to 493,000 IoT bots since Oct. 1. On Friday, Level 3’s chief security officer, Dale Drew, said about 10 percent of the bots were involved in Friday’s attack. 
 
 “Mirai is a DDoS-for-rent environment. The person buying time on that botnet could be buying time on others as well,” Drew said during a Periscope interview explaining the cyberattack. 
 
 Friday’s attack on Dyn left many users thinking their internet service was down. But really, Dyn was unable to keep up with the numerous requests to translate common names, like Twitter.com, into the proper numerical address. They couldn’t reach Spotify, Reddit or the New York Times. But if users knew the numerical IP address, they could still get to the site. 
 
 In the past, denial of service attacks were done by zombie computer network of either malware infected computers or sympathetic supporters, said Black. But with access to the massive IoT device community, the potential for major interruptions in the future is unprecedented. 
 
 “It’s very useful (for hackers) if you can take a service offline for a couple of hours,” Black said. “The new IoT base technique is generating so much traffic at a level that we’re not able to deal with yet, which is really going to suck because we’ve grown use to working on the internet.” 
 
 Level 3’s vast internet network, which literally connects countries via undersea communications cables, was operating normally on Friday, Drew said. While outage sites like DownDetector.com pointed to Level 3 being down, he said that happens when people are trying to get to, for example, Amazon, but can’t because of the DNS attack. 
 
 “It looks like you can’t get there because of the network so people are blaming the network for that particular issue when it’s really directory assistance that won’t give you the IP address,” Drew said. “If you knew the IP address, you could get there.” 
 
 If a denial of service appears to be happening to your site, Drew recommends businesses call their internet service provider for guidance. They can also change their DNS source by switching to a different provider. 
 
 For consumers, Black recommends making sure all your computer devices — from Nest thermostats to Hue lightbulbs — are protected with unique passwords. 
 
 “The problem is that you’re an unwitting accessory to this problem but you’re probably not affected by it much. Someone loses Twitter for a couple hours, and they don’t care very much,” Black said. “Getting people motivated to lock their device is hard.” ||||| A massive and sustained Internet attack that has caused outages and network congestion today for a large number of Web sites was launched with the help of hacked “Internet of Things” (IoT) devices, such as CCTV video cameras and digital video recorders, new data suggests. 
 
 Earlier today cyber criminals began training their attack cannons on Dyn, an Internet infrastructure company that provides critical technology services to some of the Internet’s top destinations. The attack began creating problems for Internet users reaching an array of sites, including Twitter, Amazon, Tumblr, Reddit, Spotify and Netflix. 
 
 At first, it was unclear who or what was behind the attack on Dyn. But over the past few hours, at least one computer security firm has come out saying the attack involved Mirai, the same malware strain that was used in the record 620 Gpbs attack on my site last month. At the end September 2016, the hacker responsible for creating the Mirai malware released the source code for it, effectively letting anyone build their own attack army using Mirai. 
 
 Mirai scours the Web for IoT devices protected by little more than factory-default usernames and passwords, and then enlists the devices in attacks that hurl junk traffic at an online target until it can no longer accommodate legitimate visitors or users. 
 
 According to researchers at security firm Flashpoint, today’s attack was launched at least in part by a Mirai-based botnet. Allison Nixon, director of research at Flashpoint, said the botnet used in today’s ongoing attack is built on the backs of hacked IoT devices — mainly compromised digital video recorders (DVRs) and IP cameras made by a Chinese hi-tech company called XiongMai Technologies. The components that XiongMai makes are sold downstream to vendors who then use it in their own products. 
 
 “It’s remarkable that virtually an entire company’s product line has just been turned into a botnet that is now attacking the United States,” Nixon said, noting that Flashpoint hasn’t ruled out the possibility of multiple botnets being involved in the attack on Dyn. 
 
 “At least one Mirai [control server] issued an attack command to hit Dyn,” Nixon said. “Some people are theorizing that there were multiple botnets involved here. What we can say is that we’ve seen a Mirai botnet participating in the attack.” 
 
 As I noted earlier this month in Europe to Push New Security Rules Amid IoT Mess, many of these products from XiongMai and other makers of inexpensive, mass-produced IoT devices are essentially unfixable, and will remain a danger to others unless and until they are completely unplugged from the Internet. 
 
 That’s because while many of these devices allow users to change the default usernames and passwords on a Web-based administration panel that ships with the products, those machines can still be reached via more obscure, less user-friendly communications services called “Telnet” and “SSH.” 
 
 Telnet and SSH are command-line, text-based interfaces that are typically accessed via a command prompt (e.g., in Microsoft Windows, a user could click Start, and in the search box type “cmd.exe” to launch a command prompt, and then type “telnet” to reach a username and password prompt at the target host). 
 
 “The issue with these particular devices is that a user cannot feasibly change this password,” Flashpoint’s Zach Wikholm told KrebsOnSecurity. “The password is hardcoded into the firmware, and the tools necessary to disable it are not present. Even worse, the web interface is not aware that these credentials even exist.” 
 
 Flashpoint’s researchers said they scanned the Internet on Oct. 6 for systems that showed signs of running the vulnerable hardware, and found more than 515,000 of them were vulnerable to the flaws they discovered. 
 
 “I truly think this IoT infrastructure is very dangerous on the whole and does deserve attention from anyone who can take action,” Flashpoint’s Nixon said. 
 
 It’s unclear what it will take to get a handle on the security problems introduced by millions of insecure IoT devices that are ripe for being abused in these sorts of assaults. 
 
 As I noted in The Democratization of Censorship, to address the threat from the mass-proliferation of hardware devices such as Internet routers, DVRs and IP cameras that ship with default-insecure settings, we probably need an industry security association, with published standards that all members adhere to and are audited against periodically. 
 
 The wholesalers and retailers of these devices might then be encouraged to shift their focus toward buying and promoting connected devices which have this industry security association seal of approval. Consumers also would need to be educated to look for that seal of approval. Something like Underwriters Laboratories (UL), but for the Internet, perhaps. 
 
 Until then, these insecure IoT devices are going to stick around like a bad rash — unless and until there is a major, global effort to recall and remove vulnerable systems from the Internet. In my humble opinion, this global cleanup effort should be funded mainly by the companies that are dumping these cheap, poorly-secured hardware devices onto the market in an apparent bid to own the market. Well, they should be made to own the cleanup efforts as well. 
 
 Devices infected with Mirai are instructed to scour the Internet for IoT devices protected by more than 60 default usernames and passwords. The entire list of those passwords — and my best approximation of which firms are responsible for producing those hardware devices — can be found at my story, Who Makes the IoT Things Under Attack. 
 
 Update 10:30 a.m., Oct. 22: Corrected attribution on outage graphic. 
 
 Tags: Allison Nixon, Dyn, Flashpoint, internet of things, mirai, Underwriters Laboratories, XiongMai Technologies, Zach Wikholm
– The distributed denial of service attack that sent Internet users into a tailspin Friday was the most powerful of its kind by far, say cybersecurity researchers, and they're especially alarmed because it looks to be the work of amateur hackers. Twitter, Netflix, Reddit, and other sites went down as the Mirai botnet took over poorly protected "Internet of things" devices like DVRs and webcams—whose owners hadn't changed the devices' default passwords—and bombarded domain host company Dyn with traffic so regular users couldn't get through. Apparently there were a lot of insecure devices out there to use. Dyn says there were "100,000 malicious endpoints" leading an attack twice as powerful as any other DDoS attack reported, per the Guardian. Researchers from cybersecurity firm Flashpoint suspect the attack was tied to the community at Hackforums.net—where the Mirai source code was published earlier this month, per Mashable—and was meant to target a video game company, perhaps the PlayStation Network, reports Computer World. If amateur hackers did so much damage, "imagine what a well-resourced state actor could do with insecure IoT devices," says a cybersecurity rep at the Council on Foreign Relations. "We have a serious problem with the cyber insecurity of IoT devices and no real strategy to combat it." Experts recommend users reset an IoT device to its factory settings to erase any existing malware, then create a new password immediately.