Cybersecurity analysts believe the distributed-denial-of-service attack gainst internet performance company Dyn was carried out using an "Internet of Things" made up of various internet-connected home devices including CCTV video cameras and digital video recorders. Security firm Flashpoint confirmed a form of malware known as Mirai was used to hack products made by Chinese company XiongMai Technologies. The devices feature factory-default usernames and passwords that can not be changed, making them vulnerable to being hacked and used to hurl junk traffic in order to shut down online services. Photo by Twin Design/Shutterstock/UPI

MANCHESTER, N.H., Oct. 22 (UPI) -- Hackers used "smart" home devices connected to the internet as weapons in the cyberattack against internet performance company Dyn, security experts said.

Security analysts believe the Friday distributed-denial-of-service attack, which shutdown popular websites such as Twitter, Spotify, Netflix, Reddit and Amazon was carried out using CCTV video cameras, digital video recorders and other similar devices.

Security firm Flashpoint confirmed the attack used "botnets" infected with a form of malware known as "Mirai" to access an "Internet of Things" made up of various internet-connected home devices, according to the BBC.

"Mirai scours the Web for IoT devices protected by little more than factory-default usernames and passwords, and then enlists the devices in attacks that hurl junk traffic at an online target until it can no longer accommodate legitimate visitors or users," cybersecurity expert Brian Krebs wrote on his blog.

Allison Nixon, director of research at Flashpoint, told Krebs the majority of the devices involved in the attack on Dyn used digital video recorders and IP cameras made by Chinese company XiongMai Technologies.

"It's remarkable that virtually an entire company's product line has just been turned into a botnet that is now attacking the United States," Nixon said.

Krebs, whose website was targeted by a similar attack in September, said the XiongMai devices are "essentially unfixable" and will remain a danger to others unless they are totally removed from the internet.

"The issue with these particular devices is that a user cannot feasibly change this password," Zach Wikholm of Flashpoint said. "The password is hardcoded into the firmware, and the tools necessary to disable it are not present. Even worse, the web interface is not aware that these credentials even exist."</s>CLOSE Jefferson Graham offers 4 tips on how to protect your home network from a hack on #TalkingTech.

This file photo taken on September 11, 2013 shows the logo of social networking website 'Twitter' displayed on a computer screen in London. Twitter was one of the website impacted by Friday's attacks. (Photo: LEON NEAL, AFP/Getty Images)

SAN FRANCISCO — Technology experts warned for years that the millions of Internet-connected "smart" devices we use every day are weak, easily hijacked and could be turned against us.

The massive siege on Dyn, a New Hampshire-based company that monitors and routes Internet traffic, shows those ominous predictions are now a reality.

An unknown attacker intermittently knocked many popular websites offline for hours Friday, from Amazon to Twitter and Netflix to Etsy. How the breach occurred is a cautionary tale of the how the rush to make humdrum devices “smart” while sometimes leaving out crucial security can have major consequences.

Dyn, a provider of Internet management for multiple companies, was hit with a large-scale distributed denial of service attack (DDoS), in which its servers were flooded with millions of fake requests for information, so many that they could no longer respond to real ones and crashed under the weight.

Who orchestrated the attack is still unknown. But how they did it — by enslaving ordinary household electronic devices such as DVRs, routers and digital closed-circuit cameras —is established.

The attackers created a digital army of co-opted robot networks, a "botnet," that spewed millions of nonsense messages at Dyn's servers. Like a firehose, they could direct it at will, knocking out the servers, turning down the flow and then hitting it full blast once again.

The specific weapon? An easy-to-use botnet-creating software called Mirai that requires little technical expertise. An unknown person released it to the hacker underground earlier this month, and security experts immediately warned it might come into more general use.

Mirai insinuates itself into household devices without the owner's knowledge, using them as platforms to send the sever-clogging messages even as the device continues to do its day job for its true owner.

The software uses malware from phishing emails to first infect a computer or home network, then spreads to everything on it, taking over DVRs, cable set-top boxes, routers and even Internet-connected cameras used by stores and businesses for surveillance.

That breadth of "attack surface," as security experts call it, is one of the things that makes Mirai so difficult to fight, said Kyle York, Dyn’s chief strategy officer.

“The complexity of this attack is because it’s so distributed. It’s coming from tens of millions of source IP addresses that are globally distributed around the world. What they’re doing is moving around the world with each attack," he said.

A woman looks at the FBI internet site page dedicated to the DSN Malware on July 9, 2012 in Paris. (Photo: MICHEL RUBINEL, AFP/Getty Images)

Internet of (dangerous) Things

As long as companies have been gleefully making and selling Internet-connected devices (the so-called Internet of Things or IoT), computer security experts have warned the security included with them was far too weak, or sometimes even nonexistent.

"IoT security has been horribly flawed ever since it first became a thing, largely because of the pace that new products have to go to market, and the fact that designing security is seen by vendors as ‘slowing things down,’" said Casey Ellis, CEO of Bugcrowd, a San Francisco-based computer security service.

This "avalanche" of smart and connected devices has created an environment where software and implementation flaws can be exploited at previously unseen levels, "effectively turning them into widely distributed information weapons," said Mike Ahmadi, director of critical systems security for security company Synopsys.

The danger is two-fold: The devices can be hacked into by one individual and potentially used to enter the owner's home computer network, putting their personal information at risk, or it can be easily taken over and turned into a node on a botnet.

Either way, stronger security would protect both the devices' owners and the larger Internet. However, security is too often left out — and also needs to be continually updated.

While users at least sometimes are willing to install security updates to their phones or computers, the idea of going around and doing software or firmware security updates on thermostats, garage door openers and even refrigerators has yet to catch on.

"The threat research community needs to find a way to prevent the IoT devices from participating in these attacks. They are valuable to the bot army controller because they are usually always on and have high capacity connections that generate huge botnet power," said Jeff Schilling, chief of operations and security at computer security firm Armor.

Read or Share this story: http://usat.ly/2eEBal6</s>The huge attack on global internet access, which blocked some of the world’s most popular websites, is believed to have been unleashed by hackers using common devices like webcams and digital recorders.

Among the sites targeted on Friday were Twitter, Paypal and Spotify. All were customers of Dyn, an infrastructure company in New Hampshire in the US that acts as a switchboard for internet traffic.

Outages were intermittent and varied by geography, but reportedly began in the eastern US before spreading to other parts of the country and Europe.



Users complained they could not reach dozens of internet destinations, including Mashable, CNN, the New York Times, the Wall Street Journal, Yelp and some businesses hosted by Amazon.

Hackers used hundreds of thousands of internet-connected devices that had previously been infected with a malicious code – known as a “botnet” or, jokingly, a “zombie army” – to force an especially potent distributed denial of service (DDoS) attack.

The aim of a DDoS attack is to overwhelm an online service with traffic from multiple sources, rendering it unavailable. Dyn said attacks were coming from millions of internet addresses, making it one of the largest attacks ever seen.

Dyn said it had resolved one attack, which disrupted operations for about two hours, but disclosed a second a few hours later that was causing further disruptions. By the evening it was fighting a third.

At least some of the malicious traffic was coming from connected devices, including webcams and digital video recorders. 



Security researchers working with Dyn to investigate the attack have linked it to a network of web-enabled CCTV cameras made by a single Chinese company, XiongMai Technologies.

Allison Nixon, director of research at the security firm Flashpoint, said its web-enabled CCTV cameras and digital video recorders were forcibly networked together using the sophisticated malware program Mirai to direct the crushing number of connection requests to Dyn’s customers.

“It’s remarkable that virtually an entire company’s product line has just been turned into a botnet that is now attacking the United States,” she told security researcher Brian Krebs.

The Guardian has contacted XiongMai for comment.

The same Mirai malware was used in September to launch what was then described as the biggest DDoS attack ever on Krebs’ website, Krebs on Security. His reporting on cybercrime has made him a target in the past.



Hackers released the source code for Mirai earlier this month, inspiring a significant number of copycats.

Experts had warned of increasingly sophisticated botnets – in essence, a weaponised combination of malware and as many as 100,000 hijacked individual devices – just days before Friday’s attack.



Researchers at Level 3 Communications, a global communications company focused on managed security, warned earlier this week that “the threat from these botnets is growing” as more and more devices were connected to the web.

The US Department of Homeland Security had issued a warning last week.

Mirai was the most sophisticated botnet malware Level 3 had seen yet, able to rotate the IP addresses (likely to avoid detection) about three times as often as had been observed with other botnets.

More worryingly still, it was “becoming still more sophisticated”.

Mirai targeted household and everyday devices – such as DVRs, cameras and even kettles – that were connected to the internet, a concept of connectivity commonly referred to as “the internet of things” (IoT). Many were devised without particular mind to security.

Level 3 researchers said the majority – as many as 80% – of botnets were networked DVRs, with the rest routers and other miscellaneous devices such as IP cameras and Linux servers.

“The devices are often operated with the default passwords, which are simple for bot herders to guess.”

Michael Mimoso, of cybersecurity research group Kaspersky Lab, estimated on Wednesday that the number of compromised devices had reached 493,000, with most in the US. “But Brazil and Colombia are also high on the list”.



Dyn categorized the attack as “resolved” shortly after 6pm New York time, but it is still not known who deployed the botnet, and why.

“The complexity of the attacks is what’s making it very challenging for us,” the company’s chief strategy officer, Kyle York, told Reuters. Homeland Security and the Federal Bureau of Investigation said they were investigating.

A tweet from WikiLeaks at 5pm Friday New York time implied that its supporters were behind the attack.

“Mr. Assange is still alive and WikiLeaks is still publishing. We ask supporters to stop taking down the US internet. You proved your point.”

Security researcher Bruce Schneier caused waves when he wrote in September that someone, probably a country, was “learning how to take down the internet”.

He wrote that “a large nation state” (“China or Russia would be my first guesses”) had been testing increasing levels of DDoS attacks against unnamed core internet infrastructure providers in what seemed like a test of capability. 



Nixon told Reuters there was no reason to think a national government was behind Friday’s assaults, but attacks carried out on a for-hire basis were famously difficult to attribute.
Security analysts state that the October 21 denial-of-service attacks on Internet performance management company Dyn was perpetrated using Mirai malware-created botnets that used consumer internet of things (IoT) smart devices, such as digital video recorders, cable set-top boxes, routers, etc. Technology experts warn that the security included with IoT is weak, or sometimes even nonexistent.