4 ms·

Can someone point to explanation on IoT botnets / what happened with Cloudflare / how they differ from regular DDoS

jgrahamc 5y ago
Some details are here: https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddos-attack-the-largest-ever-reported/ https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddo...
- LeifCarrotson 5y ago
  TLDR: Botnets composed of compromised IoT devices with low processing power like routers (are routers really IoT devices?) and security cameras, mostly compromised by their use of default baked-in credentials, instead of conventional botnets made up of conventional Windows desktops.
  - beckler 5y ago
    I think it's safe to consider routers IoT devices, but I would suggest that basically any independent embedded device is an IoT device. Literally any "smart home" device can get silently taken over and become part of a DDOS network.
    - luckylion 5y ago
      They typically need exposure to the internet though, right? Or are they taking over e.g. update-delivery servers for IoT stuff and delivering their software that way?
      - beckler 5y ago
        That is one way. Generally there are several vectors when it comes to exploits. Like, is the git repo secure? Can we add code that allows a backdoor or reaches out to a command-and-control server? Or how are their packages secured? Can we upload a malicious one to their package repo? Is the distribution server secure? Are the devices exposed directly to a WAN? Can we sell knock-off devices or modify legit devices before we resell them? Can we design them from the beginning to be exploitable? Were the engineers lazy and implement zero security controls? etc, etc... This is why defensive security is rather difficult. You have to get everything right, but attackers only have to be right one time. Then when you get consumers involved, it becomes significantly more complicated and difficult. Some of these devices can stay active for years, and the owners realize no difference as long as it still works as expected.
- toomuchtodo 5y ago
  Does Cloudflare provide any reporting or notification to AS' or ISPs (abuse@ emails or webhook subscriptions, for example) where rouge devices are connected for triage and handling with their customers?
beckler 5y ago
high-level IoT botnet explanation: Imagine you discovered a massive flaw in a robot vacuum/video doorbell/smart fridge/wi-fi connected blender/router/etc, where it would accept and execute any command you sent it. Next you come up with some way to discover and exploit as many of these devices as you can. It could be by finding all IP addresses of exposed devices via something like Shodan, or exploiting and taking over a centralized server that all these devices communicate with, or some other novel way. Anyways, once your in control of all these devices, you pick a target URL and send a command to all your devices to start CURLing a specific address over and over and over. Boom, you have a IoT botnet for DDoS attacks.

Some details are here: https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddos-attack-the-largest-ever-reported/ https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddo...

LeifCarrotson 5y ago
TLDR: Botnets composed of compromised IoT devices with low processing power like routers (are routers really IoT devices?) and security cameras, mostly compromised by their use of default baked-in credentials, instead of conventional botnets made up of conventional Windows desktops.
- beckler 5y ago
  I think it's safe to consider routers IoT devices, but I would suggest that basically any independent embedded device is an IoT device. Literally any "smart home" device can get silently taken over and become part of a DDOS network.
  - luckylion 5y ago
    They typically need exposure to the internet though, right? Or are they taking over e.g. update-delivery servers for IoT stuff and delivering their software that way?
    - beckler 5y ago
      That is one way. Generally there are several vectors when it comes to exploits. Like, is the git repo secure? Can we add code that allows a backdoor or reaches out to a command-and-control server? Or how are their packages secured? Can we upload a malicious one to their package repo? Is the distribution server secure? Are the devices exposed directly to a WAN? Can we sell knock-off devices or modify legit devices before we resell them? Can we design them from the beginning to be exploitable? Were the engineers lazy and implement zero security controls? etc, etc... This is why defensive security is rather difficult. You have to get everything right, but attackers only have to be right one time. Then when you get consumers involved, it becomes significantly more complicated and difficult. Some of these devices can stay active for years, and the owners realize no difference as long as it still works as expected.
toomuchtodo 5y ago
Does Cloudflare provide any reporting or notification to AS' or ISPs (abuse@ emails or webhook subscriptions, for example) where rouge devices are connected for triage and handling with their customers?

beckler 5y ago

high-level IoT botnet explanation: Imagine you discovered a massive flaw in a robot vacuum/video doorbell/smart fridge/wi-fi connected blender/router/etc, where it would accept and execute any command you sent it. Next you come up with some way to discover and exploit as many of these devices as you can. It could be by finding all IP addresses of exposed devices via something like Shodan, or exploiting and taking over a centralized server that all these devices communicate with, or some other novel way. Anyways, once your in control of all these devices, you pick a target URL and send a command to all your devices to start CURLing a specific address over and over and over. Boom, you have a IoT botnet for DDoS attacks.