6 ms·

KrebsOnSecurity hit by same IoT botnet that hit a record DDoS on Cloudflare

90 points by ilamont 5y ago

albert_e 5y ago
Can someone point to explanation on IoT botnets / what happened with Cloudflare / how they differ from regular DDoS
- jgrahamc 5y ago
  Some details are here: https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddos-attack-the-largest-ever-reported/ https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddo...
  - LeifCarrotson 5y ago
    TLDR: Botnets composed of compromised IoT devices with low processing power like routers (are routers really IoT devices?) and security cameras, mostly compromised by their use of default baked-in credentials, instead of conventional botnets made up of conventional Windows desktops.
    - beckler 5y ago
      I think it's safe to consider routers IoT devices, but I would suggest that basically any independent embedded device is an IoT device. Literally any "smart home" device can get silently taken over and become part of a DDOS network.
      - luckylion 5y ago
        They typically need exposure to the internet though, right? Or are they taking over e.g. update-delivery servers for IoT stuff and delivering their software that way?
        beckler 5y ago
        That is one way. Generally there are several vectors when it comes to exploits. Like, is the git repo secure? Can we add code that allows a backdoor or reaches out to a command-and-control server? Or how are their packages secured? Can we upload a malicious one to their package repo? Is the distribution server secure? Are the devices exposed directly to a WAN? Can we sell knock-off devices or modify legit devices before we resell them? Can we design them from the beginning to be exploitable? Were the engineers lazy and implement zero security controls? etc, etc... This is why defensive security is rather difficult. You have to get everything right, but attackers only have to be right one time. Then when you get consumers involved, it becomes significantly more complicated and difficult. Some of these devices can stay active for years, and the owners realize no difference as long as it still works as expected.
  - toomuchtodo 5y ago
    Does Cloudflare provide any reporting or notification to AS' or ISPs (abuse@ emails or webhook subscriptions, for example) where rouge devices are connected for triage and handling with their customers?
- beckler 5y ago
  high-level IoT botnet explanation: Imagine you discovered a massive flaw in a robot vacuum/video doorbell/smart fridge/wi-fi connected blender/router/etc, where it would accept and execute any command you sent it. Next you come up with some way to discover and exploit as many of these devices as you can. It could be by finding all IP addresses of exposed devices via something like Shodan, or exploiting and taking over a centralized server that all these devices communicate with, or some other novel way. Anyways, once your in control of all these devices, you pick a target URL and send a command to all your devices to start CURLing a specific address over and over and over. Boom, you have a IoT botnet for DDoS attacks.
2OEH8eoCRo0 5y ago
IoT device manufacturers should be sued for negligence.
- gruez 5y ago
  You mean the manufacturers based in china that have little in the way of assets, and might disappear before the issues become apparent?
  - east2west 5y ago
    If it is Chinese companies, then presumably a lot of those devices are in China as well. Wondering whether they might be used to bring down the Great FireWall of China. At least any attempt might force the Chinese government to crack down on the manufacturers to improve device security.
  - sam_lowry_ 5y ago
    AFAICS, this attack is running on Microtik routers. Mikrotik is a Latvian company. They are successfully competing with Cisco and Juniper in feature-set and performance at a fraction of a price. The thing is, they provided a large, under-educated user base with powerful, complex and utterly sophisticated tools. That the attacker targeted those and not less numerous and better guarded mainstream manufacturers only pays tribute to the success of Mikrotik.
    - Y_Y 5y ago
      You forgot to include your affiliate link.
      - sam_lowry_ 5y ago
        I am unaffiliated irregular customer They have great hardware, but I prefer rinning OpenWRT on their hardware.
    - donmcronald 5y ago
      > The thing is, they provided a large, under-educated user base with powerful, complex and utterly sophisticated tools. Do you think the expensive manufacturers don’t do that? I’ve seen un-configured, un-updated, EoL Cisco equipment. Small businesses get sold it because it’s “the best”, but they don’t actually need anything nearly that complicated and don’t want to pay the ongoing costs so you end up with things like managed switches being used like you’d use a dumb switch that’s 1/10th of the price.
bombcar 5y ago
Are there any traffic pattern you can watch for on a router/firewall to detect these coming from your network?
- _jal 5y ago
  Disabling outbound connections from things that have no business talking to the outside is a great coarse-grained approach. I have a stereo component and a couple other things that I'll periodically allow to check for updates and then re-enable the blocks. If you have things like surveillance speakers that require a mothership to function, exceptions for those endpoints would of course be needed.
  - sva_ 5y ago
    Many IoT devices refuse to work if they're not allowed to "phone home". Someone recently gifted me an RGB lightbulb which demanded to be added to my WiFi network to set it up. None of the functions would work without the lightbulb being connected to the internet, even after setup (except on/off). The bulb would only take commands from the remote server! Infuriating. They also used some TLS so it wasn't straight-forward to spoof the packet. It's been collecting dust not being plugged in since then. I feel bad not using it, and didn't tell my friend who gifted it to me. But I'm not going to let that thing run in my network sending usage statistics to the company. Or worse, get exploited. The lightbulb runs a web server, for fucks sake. What a dilemma.
smartbit 5y ago
The Netherlands has the National Scrubbing Center against DDoS attacks NaWas https://www.nbip.nl/en/nawas/faq/ https://www.nbip.nl/en/nawas/faq/. It is a non-profit. > The NaWas infrastructure is designed as an on-demand service. After detecting an attack, the traffic is routed via BGP to the NaWas hardware and then the mitigation process starts. All traffic is then rerouted and the own connections can thus manage with less capacity > NaWas has a BGP session with the participants on the clean side (with IXPs) on a private VLAN. A member can redirect a specific prefix or / 24 by advertising that prefix on the NaWas BGP session. NaWas advertises the prefix on our upstreams (transits & peering). So the trigger for redirecting is done manually or automatically by the participants. They handle on average 9 attacks per day. Italy is following suite and setting up a similar organization.
- kazen44 5y ago
  nawas works really well and is easy to setup. would recommend in you are in NL.
- yoaviram 5y ago
  Can you share a link to the Italian version?
annoyingnoob 5y ago
Brian gets all the love.
dredmorbius 5y ago
https://nitter.kavin.rocks/briankrebs/status/1436309299131789326 https://nitter.kavin.rocks/briankrebs/status/143630929913178...
solarkraft 5y ago
What’s politically being done against (IoT) botnets? Are members of such forced to take their devices offline? Is there larger scale accessible research on these botnets and the devices they affect?

90 points by ilamont 5y ago

albert_e 5y ago

Can someone point to explanation on IoT botnets / what happened with Cloudflare / how they differ from regular DDoS

jgrahamc 5y ago
Some details are here: https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddos-attack-the-largest-ever-reported/ https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddo...
- LeifCarrotson 5y ago
  TLDR: Botnets composed of compromised IoT devices with low processing power like routers (are routers really IoT devices?) and security cameras, mostly compromised by their use of default baked-in credentials, instead of conventional botnets made up of conventional Windows desktops.
  - beckler 5y ago
    I think it's safe to consider routers IoT devices, but I would suggest that basically any independent embedded device is an IoT device. Literally any "smart home" device can get silently taken over and become part of a DDOS network.
    - luckylion 5y ago
      They typically need exposure to the internet though, right? Or are they taking over e.g. update-delivery servers for IoT stuff and delivering their software that way?
      - beckler 5y ago
        That is one way. Generally there are several vectors when it comes to exploits. Like, is the git repo secure? Can we add code that allows a backdoor or reaches out to a command-and-control server? Or how are their packages secured? Can we upload a malicious one to their package repo? Is the distribution server secure? Are the devices exposed directly to a WAN? Can we sell knock-off devices or modify legit devices before we resell them? Can we design them from the beginning to be exploitable? Were the engineers lazy and implement zero security controls? etc, etc... This is why defensive security is rather difficult. You have to get everything right, but attackers only have to be right one time. Then when you get consumers involved, it becomes significantly more complicated and difficult. Some of these devices can stay active for years, and the owners realize no difference as long as it still works as expected.
- toomuchtodo 5y ago
  Does Cloudflare provide any reporting or notification to AS' or ISPs (abuse@ emails or webhook subscriptions, for example) where rouge devices are connected for triage and handling with their customers?
beckler 5y ago
high-level IoT botnet explanation: Imagine you discovered a massive flaw in a robot vacuum/video doorbell/smart fridge/wi-fi connected blender/router/etc, where it would accept and execute any command you sent it. Next you come up with some way to discover and exploit as many of these devices as you can. It could be by finding all IP addresses of exposed devices via something like Shodan, or exploiting and taking over a centralized server that all these devices communicate with, or some other novel way. Anyways, once your in control of all these devices, you pick a target URL and send a command to all your devices to start CURLing a specific address over and over and over. Boom, you have a IoT botnet for DDoS attacks.

2OEH8eoCRo0 5y ago

IoT device manufacturers should be sued for negligence.

gruez 5y ago
You mean the manufacturers based in china that have little in the way of assets, and might disappear before the issues become apparent?
- east2west 5y ago
  If it is Chinese companies, then presumably a lot of those devices are in China as well. Wondering whether they might be used to bring down the Great FireWall of China. At least any attempt might force the Chinese government to crack down on the manufacturers to improve device security.
- sam_lowry_ 5y ago
  AFAICS, this attack is running on Microtik routers. Mikrotik is a Latvian company. They are successfully competing with Cisco and Juniper in feature-set and performance at a fraction of a price. The thing is, they provided a large, under-educated user base with powerful, complex and utterly sophisticated tools. That the attacker targeted those and not less numerous and better guarded mainstream manufacturers only pays tribute to the success of Mikrotik.
  - Y_Y 5y ago
    You forgot to include your affiliate link.
    - sam_lowry_ 5y ago
      I am unaffiliated irregular customer They have great hardware, but I prefer rinning OpenWRT on their hardware.
  - donmcronald 5y ago
    > The thing is, they provided a large, under-educated user base with powerful, complex and utterly sophisticated tools. Do you think the expensive manufacturers don’t do that? I’ve seen un-configured, un-updated, EoL Cisco equipment. Small businesses get sold it because it’s “the best”, but they don’t actually need anything nearly that complicated and don’t want to pay the ongoing costs so you end up with things like managed switches being used like you’d use a dumb switch that’s 1/10th of the price.

bombcar 5y ago

Are there any traffic pattern you can watch for on a router/firewall to detect these coming from your network?

_jal 5y ago
Disabling outbound connections from things that have no business talking to the outside is a great coarse-grained approach. I have a stereo component and a couple other things that I'll periodically allow to check for updates and then re-enable the blocks. If you have things like surveillance speakers that require a mothership to function, exceptions for those endpoints would of course be needed.
- sva_ 5y ago
  Many IoT devices refuse to work if they're not allowed to "phone home". Someone recently gifted me an RGB lightbulb which demanded to be added to my WiFi network to set it up. None of the functions would work without the lightbulb being connected to the internet, even after setup (except on/off). The bulb would only take commands from the remote server! Infuriating. They also used some TLS so it wasn't straight-forward to spoof the packet. It's been collecting dust not being plugged in since then. I feel bad not using it, and didn't tell my friend who gifted it to me. But I'm not going to let that thing run in my network sending usage statistics to the company. Or worse, get exploited. The lightbulb runs a web server, for fucks sake. What a dilemma.

smartbit 5y ago

The Netherlands has the National Scrubbing Center against DDoS attacks NaWas https://www.nbip.nl/en/nawas/faq/ https://www.nbip.nl/en/nawas/faq/. It is a non-profit. > The NaWas infrastructure is designed as an on-demand service. After detecting an attack, the traffic is routed via BGP to the NaWas hardware and then the mitigation process starts. All traffic is then rerouted and the own connections can thus manage with less capacity > NaWas has a BGP session with the participants on the clean side (with IXPs) on a private VLAN. A member can redirect a specific prefix or / 24 by advertising that prefix on the NaWas BGP session. NaWas advertises the prefix on our upstreams (transits & peering). So the trigger for redirecting is done manually or automatically by the participants. They handle on average 9 attacks per day. Italy is following suite and setting up a similar organization.

kazen44 5y ago
nawas works really well and is easy to setup. would recommend in you are in NL.
yoaviram 5y ago
Can you share a link to the Italian version?

annoyingnoob 5y ago

Brian gets all the love.

dredmorbius 5y ago

https://nitter.kavin.rocks/briankrebs/status/1436309299131789326 https://nitter.kavin.rocks/briankrebs/status/143630929913178...

solarkraft 5y ago

What’s politically being done against (IoT) botnets? Are members of such forced to take their devices offline? Is there larger scale accessible research on these botnets and the devices they affect?