Smart devices detected 105 million attacks in H1 2019

Mumbai: Smart devices detected 105 million attacks from 276,000 unique IP addresses in the first half of 2019, revealed Kaspersky.

Kaspersky honeypots are networks of virtual copies of various internet-connected devices and applications to detect attacks.

Compared to H1 2018, this year’s count is around nine times more. Around 12 million attacks were spotted originating from 69,000 IP addresses, last year.

Capitalizing on weak security of IoT products, cybercriminals are intensifying their attempts to create and monetize IoT botnets. This and other findings are a part of the ‘IoT: a malware story’ report on honeypot activity in H1 2019.

Cyberattacks on IoT devices are booming, as even though more and more people and organizations are purchasing ‘smart’ (network-connected and interactive) devices, such as routers or DVR security cameras, not everybody considers them worth protecting.

Cybercriminals, however, are seeing more and more financial opportunities in exploiting such gadgets. They use networks of infected smart devices to conduct DDoS attacks or as a proxy for other types of malicious actions.

To learn more about how such attacks work and how to prevent them, Kaspersky experts set up honeypots – decoy devices used to attract the attention of cybercriminals and analyze their activities.

IoT device attacks are usually not sophisticated but are stealth-like. Users might not even notice their devices are being exploited, revealed honeypots’ data analysis.

The malware family behind 39% of attacks – Mirai – is capable of using exploits, meaning that these botnets can slip through old, unpatched vulnerabilities to the device and control it.

Another technique is password brute-forcing, which is the chosen method of the second most widespread malware family in the list – Nyadrop.

Nyadrop was seen in 38.57% attacks and often it serves as a Mirai downloader. This family has been trending as one of the most active threats for a couple of years now. The third most common botnet threatening smart devices – Gafgyt with 2.12% – also uses brute-forcing.

In addition, the researchers were able to locate the regions that became sources of infection most often in H1 2019. With 30% attacks China was at top, followed by Brazil and Egypt with 19% and 12% respectively.

In H1 2018 the situation was different. Brazil was leading with 28%, followed by China and Japan with 14% and 11% respectively.

“As people become more and more surrounded by smart devices, we are witnessing how IoT attacks are intensifying. Judging by the enlarged number of attacks and criminals’ persistency, we can say that IoT is a fruitful area for attackers that use even the most primitive methods, like guessing password and login combinations,” said Dan Demeter, Security Researcher – Kaspersky Lab.

“This is much easier than most people think: the most common combinations by far are usually “support/support”, followed by “admin/admin”, “default/default”. It’s quite easy to change the default password, so we urge everyone to take this simple step towards securing your smart devices,” added Demeter.

To keep your devices safe, Kaspersky recommends users:

• Install updates for the firmware you use as soon as possible. Once a vulnerability is found, it can be fixed through patches within updates.
• Always change preinstalled passwords. Use complicated passwords that include both capital and lower case letters, numbers and symbols if it’s possible.
• Reboot a device as soon as you think it’s acting strangely. It might help get rid of existing malware, but this doesn’t reduce the risk of getting another infection.
• Keep access to IoT devices restricted by a local VPN, allowing you to access them from your home “network,” instead of publicly exposing them on the internet.

Kaspersky recommends companies to take the following measures:

• Use threat data feeds to block network connections originating from malicious network addresses detected by security researchers.
• Make sure all devices software is up to date. Unpatched devices should be kept in a separate network inaccessible by unauthorised users.