Among the sites targeted on Friday were Twitter, Paypal and Spotify. The massive siege on Dyn, a New Hampshire-based company that monitors and routes Internet traffic, shows those ominous predictions are now a reality. Dyn said attacks were coming from millions of internet addresses, making it one of the largest attacks ever seen. Cybersecurity analysts believe the distributed-denial-of-service attack gainst internet performance company Dyn was carried out using an "Internet of Things" made up of various internet-connected home devices including CCTV video cameras and digital video recorders. Security researchers working with Dyn to investigate the attack have linked it to a network of web-enabled CCTV cameras made by a single Chinese company, XiongMai Technologies. Allison Nixon, director of research at the security firm Flashpoint, said its web-enabled CCTV cameras and digital video recorders were forcibly networked together using the sophisticated malware program Mirai to direct the crushing number of connection requests to Dyn’s customers. “It’s remarkable that virtually an entire company’s product line has just been turned into a botnet that is now attacking the United States,” she told security researcher Brian Krebs. Krebs, whose website was targeted by a similar attack in September, said the XiongMai devices are "essentially unfixable" and will remain a danger to others unless they are totally removed from the internet. An unknown person released it to the hacker underground earlier this month, and security experts immediately warned it might come into more general use. That breadth of "attack surface," as security experts call it, is one of the things that makes Mirai so difficult to fight, said Kyle York, Dyn’s chief strategy officer.
Security analysts state that the October 21 denial-of-service attacks on Internet performance management company Dyn was perpetrated using Mirai malware-created botnets that used consumer internet of things (IoT) smart devices, such as digital video recorders, cable set-top boxes, routers, etc. Technology experts warn that the security included with IoT is weak, or sometimes even nonexistent.