Internet of Things

University Hackers Attacked 5,000 IoT Devices on Campus

• By Sri Ravipati
• 02/13/17

Ahead of its soon-to-be-published 2017 Data Breach Digest report, Verizon has released a sneak peek highlighting one of 16 new cybercrime case studies on new forms of threats capable of halting business operations. The preview focuses on an unnamed university that within the last year experienced a major hack into its network through more than 5,000 connected devices on campus.

In the case of “the botnet barrage,” as the case study dubbed the attack, senior members of the university’s IT staff had received complaints of slow and inaccessible network connectivity on campus. Upon examination, the incident commander found that name servers “were producing high-volume alerts and showed an abnormal number of sub-domains related to seafood,” according to the preview. The incident inspector contacted Verizon’s RISK Team, which conducted a firewall analysis that “identified more than 5,000 discrete systems making hundreds of DNS lookups every 15 minutes.”

“Of these, nearly all systems were found to be living on the segment of the network dedicated to our IT infrastructure,” the incident commander said in the preview. “This was a mess. Short of replacing every soda machine and lamp post, I was at a loss for how to remediate the situation. We had known repeatable processes and procedures for replacing infrastructure and application servers, but nothing for an IoT outbreak.”

The analysis uncovered that “the botnet spread from device to device by brute forcing default and weak passwords.” To regain control of its devices, the university used a full packet capture device to intercept the password for a compromised IoT device over the wire, and then used that to perform a password change before the next malware update took place.

Laurance Dine, managing principal of investigative response at Verizon, told ZDNet that distributed denial-of-service (DDoS) attacks by IoT botnets are going to remain a huge threat until both the manufacturers and organizations that deploy them figure out how to secure them.

“There’s going to be endless amounts of technology out there that the people are going to easily be able to get access to. DDoS is going to continue to be a big problem until we figure out how to create diversions,” she said.