text: When a crime occurs in the physical world, investigators search for specific types of evidence. 
   
   Say they're looking into a robbery. Where was the break-in point? Was a weapon used? 
   
   SEE ALSO: More than 10 million devices helped take down the internet on Friday 
   
   At Dyn, the domain name service-provider hit with a massive distributed denial of service attack on Friday that shut down a huge chunk of the internet, the company hasn't said much about its investigation. But others have unearthed new leads that may point to the perpetrators. 
   
   This photo shows Dyn, a New Hampshire internet service company, in the old mill section of the city, on Oct. 21, in Manchester, New Hampshire. Image: AP Photo/Jim Cole 
   
   Of course, the attack was so massive that the results of the investigation may not help prevent another attack. Sure, you can reenforce your windows and put a bolt on the door, but what good will that do against an innumerable number of invaders? 
   
   The attack that jammed the internet 
   
   Friday's DDoS attack on Dyn came in three waves that left the internet reeling. 
   
   Dyn allows internet users to access a range of hugely popular sites such as Twitter and Spotify, and the attack on Dyn left major websites dealing with outages and extreme slowness. 
   
   A distributed denial of service attack is when an onslaught of web traffic overwhelms a server so everyday users are unable to access it. 
   
   "The nature and source of the attack is under investigation, but it was a sophisticated attack across multiple attack vectors and internet locations," Kyle York, Dyn’s chief strategy officer, wrote in a company blog post on Saturday. 
   
   Hackers essentially weaponized video cameras to send unmanageable amounts of traffic to Dyn's servers, causing much of the Internet to slow to a crawl. Image: Dominic Lipinski/PA Wire 
   
   The investigation points to attention seeking hackers 
   
   Adam Coughlin, Dyn's director of corporate communications, told Mashable the company "should" have completed a "root cause analysis" by mid-week. 
   
   "At this point we know this was a sophisticated, highly distributed attack involving 10s of millions of IP addresses," York wrote in a blog post. 
   
   But while Dyn isn't revealing many details, the cybersecurity firm Flashpoint released more information on Tuesday about who might be behind the attack. 
   
   Flashpoint, a company that has provided analysis to Dyn, found that the hacker or group of hackers who attacked the site on Friday also targeted a video game company. 
   
   "We look at a lot of different DDoS attacks that happen, and political actors don't attack video game companies, generally," Allison Nixon, Flashpoint's director of security research at Fl Security Research, told Mashable. 
   
   Researchers also doubt the hack was intended for financial gain, since hacks for money usually target Bitcoin exchanges or gambling sites. 
   
   "They're trying to show how powerful they are, and how else do you show how powerful you are than taking down someone that's powerful." 
   
   Instead, early signs point to a hacker or a group of hackers who just wanted to show off. "They're trying to show how powerful they are, and how else do you show how powerful you are than taking down someone that's powerful," Nixon said. 
   
   According to Tuesday's report, Flashpoint believes they're "likely connected to the English-language hacking forum community, specifically users and readers of the forum hackforums.net." 
   
   The attacker used a type of malware called Mirai, which hacks poorly protected devices and uses them to hurl junk data at whatever the attacker wants. 
   
   A hacker who goes by the handle Anna-Senpai released the Mirai source code earlier this month on hackforums.net, making it accessible to anyone. This means it is more difficult to track down the person who directed the operation, as any hacker could have put the code to work. 
   
   The attack was similar to recent DDoS attacks against the security blog Krebs on Security as well as OVH, a French "internet service hosting provider." Flashpoint has said similar types of attacks often originate from users of hackforums.net. 
   
   Friday's attack, though similar, involved devices that were "separate and distinct" from the devices used in the other digital assaults. 
   
   The malware used in last week's DDoS attack hijacked digital video recorders as well as cameras. Image: Soeren Stache/picture-alliance/dpa/AP Images 
   
   The investigation only matters up to a point 
   
   The size of the attack leveled at Dyn makes it unclear how useful the company's post-mortem will be, because it likely can't bolster its cyber defense quickly enough to prevent such a massive assault. 
   
   Friday's attacker hijacked millions of "Internet of Things" (IoT) devices such as DVRs and video recorders, and had those devices flood Dyn with data. Dyn doesn't control those cameras, and experts said many of those devices can't be patched, meaning someone can simply hack them again and again to launch new assaults. 
   
   "This is the internet of largely un-patchable things," Joshua Corman, the director of The Atlantic Council's Cyber Statecraft Initiative, told Mashable. "Unless you take them out of service, these [devices] can be repeat offenders for the life of the internet." 
   
   A surveillance camera outside the Landtag state parliament in Potsdam, Germany. Image: Ralf Hirschberger/picture-alliance/dpa/AP Images 
   
   Even if companies get better at mitigating large DDoS attacks, it will be difficult to scale at the rate at which the number of hackable devices increases. According to Intel, by 2020 there will be 200 billion objects connected to the internet. That's up from 2 billion in 2006. 
   
   Due to the sheer number of devices, the attackers have a significant advantage. The more devices they can use in the attack, the more powerful the attack will be. 
   
   In the coming days and weeks, investigators will no doubt explore how they were exploited, how the attack was carried out and the effectiveness of their response to the attack. Cybersecurity experts said Dyn will likely want to take stock of what vulnerabilities could be strengthened in case the company again falls victim. 
   
   Can major DDoS attacks be stopped? 
   
   CCTV cameras were among the devices hacked in last week's DDoS attack on Dyn. Image: Clive Gee/PA Wire 
   
   These kind of attacks are likely to continue as long as millions of IoT devices remain hackable. 
   
   Companies might be able to do a few things to mitigate the damage, but they can't stop manufacturers from making hackable devices, and they can't singlehandedly educate the public about enhancing the security of every device hooked up to the IoT. 
   
   "I'm not saying every user should be a security expert and figure out how to reconfigure their toaster or whatever," Zach Lanier, director of research at Cylance, a cybersecurity firm, told Mashable. "But there are some basic practices that users can do to make sure their IoT devices aren't accessible." 
   
   Krebs on Security suggests resetting IoT devices such as wireless routers and IP cameras to their factory settings, which is often just a matter of finding a reset button on the device. This wipes out any malware already on the device. 
   
   But it could be reinfected in minutes, so you'll need to quickly reset the device's default password. 
   
   Googling the device's make and model should turn up a web address and a factory default username-password combo. Typing that into a web browser should take you to the device's "administration panel," where you can reset the password, Krebs on Security reported. 
   
   Until many IoT device owners get on top of security, we should all expect some more slow days on the internet. ||||| Researchers at Flashpoint pointed a finger of blame at “script kiddies” for the huge IoT-based DDoS attack that made parts of the internet inaccessible last Friday. In fact, the primary target may have been a “a well-known video game company” that happened to use Dyn for DNS services. 
   
   The researchers wrote: 
   
   Flashpoint assesses with moderate confidence that the most recent Mirai attacks are likely connected to the English-language hacking forum community, specifically users and readers of the forum “hackforums[.]net.” 
   
   Flashpoint explained: 
   
   The infrastructure used in the attack also targeted a well-known video game company. While there does not appear to have been any disruption of service, the targeting of a video game company is less indicative of hacktivists, state-actors, or social justice communities, and aligns more with the hackers that frequent online hacking forums. These hackers exist in their own tier, sometimes called “script kiddies,” and are separate and distinct from hacktivists, organized crime, state-actors, and terrorist groups. They can be motivated by financial gain, but just as often will execute attacks such as these to show off, or to cause disruption and chaos for sport. 
   
   Although Flashpoint never named which specific video game company, it seems like the PlayStation Network may have been the real target. 
   
   As Network World's Time Greene pointed out, there is a post on hackforums[.]net which reads: “this is funny, only because they didnt actually attk DYN fun fact DYN was never intentionally attkd until later that day PSN was the target (bf1 release) they used DYN's ns: ns00.playstation.net, ns01.playstation.net, ns02.playstation.net etc.” 
   
   Flashpoint does not believe there was any political motivation behind the attacks. Allison Nixon, director of researcher at Flashpoint, shot down theories that The Jester, WikiLeaks or New World Hackers were responsible for the attacks, calling their claims of responsibility “dubious.” 
   
   Nixon added, “All the arrows point away from any sort of political motivation,” which hurts “the nation-state argument. Of course, you never know until someone’s got handcuffs on them.” 
   
   At the Council on Foreign Relations on Tuesday, National Intelligence Director James Clapper said he also believes a “non-state actor” was behind the attack. Not that everything Clapper says can be considered entirely truthful. 
   
   So far, Dyn has refused to speculate regarding motivation or the identity of the attackers. However, Dyn has said its analysis indicated the Mirai botnet was the primary source of “maliciously targeted, masked TCP and UDP traffic over port 53.” 
   
   Senator wants ISPs to ban insecure IoT devices from their networks 
   
   Senator Mark Warner, a co-chair of the Senate Cybersecurity Caucus, has grown increasingly concerned about the flood of insecure IoT devices; the massive DDoS attack on Dyn DNS, which took down large chunks of the internet on October 21, seems to have been the last straw. 
   
   On Tuesday, Warner sent a letter to the FCC, FTC and DHS, pointing out that “manufacturers today are flooding the market with cheap, insecure devices, with few market incentives to design the product with security in mind, or to provide ongoing support.” And the effectiveness of Mirai depends, “in large part, on the unacceptably low level of security inherent in a vast array of network devices.” 
   
   He added, “Because the producers of these insecure IoT devices currently are insulated from any standards requirements, market feedback, or liability concerns, I am deeply concerned that we are witnessing a ‘tragedy of the commons’ threat to the continued functioning of the internet, as the security so vital to all internet users remains the responsibility of none.” 
   
   Although “ISPs cannot prohibit the attachment of ‘non-harmful devices’ to their network,” after the release of Mirai source code and the crippling attack on Dyn DNS, Warner believes it is “entirely reasonable” for “devices with certain insecure attributes” to be “deemed harmful to the ‘network’.” In addition to wanting to know if ISPs can block “insecure” IoT devices from connecting to their networks, Warner asked for answers to another eight questions. 
   
   Dyn amends number of Mirai-controlled IoT devices used in DDoS attacks 
   
   Dyn had previously suggested there had been tens of millions of infected IoT devices used in the Oct. 21 attacks. Today, Dyn said:
target: – The distributed denial of service attack that sent Internet users into a tailspin Friday was the most powerful of its kind by far, say cybersecurity researchers, and they're especially alarmed because it looks to be the work of amateur hackers. Twitter, Netflix, Reddit, and other sites went down as the Mirai botnet took over poorly protected "Internet of things" devices like DVRs and webcams—whose owners hadn't changed the devices' default passwords—and bombarded domain host company Dyn with traffic so regular users couldn't get through. Apparently there were a lot of insecure devices out there to use. Dyn says there were "100,000 malicious endpoints" leading an attack twice as powerful as any other DDoS attack reported, per the Guardian. Researchers from cybersecurity firm Flashpoint suspect the attack was tied to the community at Hackforums.net—where the Mirai source code was published earlier this month, per Mashable—and was meant to target a video game company, perhaps the PlayStation Network, reports Computer World. If amateur hackers did so much damage, "imagine what a well-resourced state actor could do with insecure IoT devices," says a cybersecurity rep at the Council on Foreign Relations. "We have a serious problem with the cyber insecurity of IoT devices and no real strategy to combat it." Experts recommend users reset an IoT device to its factory settings to erase any existing malware, then create a new password immediately.