Largest DDoS attack in history

[Robert Maxwell]

It largely escaped mainstream attention, but over the past couple weeks we have experienced the largest distributed denial-of-service (DDoS) attack in Internet history, as a bandwidth throughput of close to 1 terabit per second was brought to bear against French hosting company OVH.

This would be noteworthy enough on its own, but the botnet used for this attack was unusual in itself. Rather than being made up of compromised server, desktop, and notebook PCs, it was instead carried out by hundreds of thousands of compromised security cameras:

This botnet with 145607 cameras/dvr (1-30Mbps per IP) is able to send >1.5Tbps DDoS. Type: tcp/ack, tcp/ack+psh, tcp/syn.

As more devices are made Internet-enabled, we'll probably see more attacks like this. IP-enabled devices are especially vulnerable because, unlike PCs, they tend not to get updates that fix security vulnerabilities. Usually, the firmware they are delivered with contains the operating system they will use for their entire lifetime. So attacks are likely to only get bigger unless and until security practices surrounding Internet-of-Things (IoT) devices are improved and refined.

 

[Random_Spock]

Holy cow. That's not good. I hope that they're able to make it so cameras and dvrs aren't affected.

 

[Santaman]

Classic greedy stupidity, blah blah buzzword, internet of things, blah blah and security comes in the last place.

 

[YellowSubmarine]

I've been wondering when this Internet of Things thing will make my socks engage in criminal activity. If I can't find them, maybe the police will.

 

[Spot261]

Mine smell criminal

 

[psCargile]

The internet is gaining consciousness. haha

 

[Dryson]

Sounds like Wiki Leaks looking for ways to breach the national security systems of nations around the world looking for above top secret intelligence. If you think about it not many hackers would think that sensitive and classified documents would ever be transmitted through the cabling of cameras networked together. But a cable that is used to transmit video data is capable of transmitting binary data just the same.

How it would work is the data would be loaded into a camera system through a USB port. The data is transmitted across the camera network to another location tied in with the camera system but is not physically tied in with the internet. At the end point of the transfer the data is downloaded into another USB and then onto wherever its next destination is.

 

[YellowSubmarine]

Wh... what?

If you think about it not many hackers would think that sensitive and classified documents would ever be transmitted through the cabling of cameras networked together.

They wouldn't think it, because it would be so ridiculous it would only work as a B-plot on NCSI: Hawaii or however that show was called. Might as well piggyback the classified information through the Enterprise that's sitting cloaked in orbit, then pass it back down through carrier pigeons using the RFC 1149 standard. Scott Bakula would chase the pigeons, but when he catches them his partner Grace Park is revealed to be an unwitting Cylon information carrier. No problem, the Flash would come along (he's an NCSI), recover the nude photographs, arrest Irene Adler and hand her over to T. J. Hooker.

Your post has nothing to do with the story, is complete fiction, and doesn't make a whole lot of sense. However, exploiting the cameras as nodes of an anonymity network isn't completely far fetched. In the future, you'd be hoping nobody decides to set up a Tor exit node on your smart window curtains.

Involving USB drives, however, totally defeats the purpose.

 

[FPAlpha]

Classic greedy stupidity, blah blah buzzword, internet of things, blah blah and security comes in the last place.

Years ago i worked for a big german IT company and was employed in their server centre (basic troubleshooting and personal rebooting of a server in one of the server rooms). Back then there was a big virus going around affecting unpatched Windows servers so when i went to work that weekend i was surprised to see the parking lot well filled.

They had the entire IT staff come in to patch all the servers as an emergency.. a complete 48 hours crash action complete with free pizza and everything else (people basically only went home to shower and get a few hours of sleep).

That was the first sniff i got what IT security means and what malware can do. Now this was a professional IT company with the staff, knowledge and experience to pull off something like this.. what do you think all other mid/small businesses could do that have maybe a staff of a few people handling their IT, if that, and something like this happens (either a big DDOS attack or some virus)?

In the future this could lead to some ugly and shady possibilities because IT security is still vastly underdeveloped and underappreciated thing but is also fast becoming a vital component to a business' operation (my current company is heavily dependent on its IT, if it crashes nearly the whole company stops until it is fixed) and still the people who make the decisions don't get it that it's not enough to just buy a service contract with an IT service provider who tells them that the automatic updates to their server software and a firewall is enough these days.

I don't know if it has happened yet but i fully expect businesses to fold if someone specifically targets their IT and disrupts their operation long enough for them to get into real problems - and to spin this further into conspiracy theory areas what's to stop an unscrupulous businessman to find and employ a good hacker to target a rival company with the intent on disabling or sabotaging their IT?

 

[Santaman]

You can never be 100% safe, the best possible thing is to get troublesome and annoying enough so its no fun to get at you.
Otherwise its, stay alert, keep fixing software, keep stuff up to date, do not trust any user and above all backup backup backup and then make another backup..
Also, educate the IT staff, they need to stay on top of the game, of course this all takes money which a lot of the time is not available.