How to keep your gadgets from being part of a botnet

black lives matter ddos attacks attack oct 21v2
The massive DDoS attack that made it impossible for some people to access sites like Twitter, GitHub, and Spotify, was a wake-up call for many of us. Though it did no permanent damage, and no personal data was at risk (unlike recently disclosed attacks on Yahoo), it managed to disrupt wide swaths of the Internet for several hours. Much like a short-lived blackout, it was mostly an inconvenience. But it could have been much worse.

What did the DDoS attack do?

Typically, DDoS (Distributed Denial of Service) attacks are aimed at individual entities, like the one that Sony and several others suffered in 2014. When this happens, the company’s online services are disrupted, which in that case led to gamers being cut off from the Playstation Network and Xbox Live.

Friday’s attack targeted Dyn, a major provider of DNS services. Because Dyn’s DNS servers are responsible for translating domain names like into IP addresses, any company that was using Dyn to host their DNS became like a house on a street without its address displayed. The house was still there of course — if you already knew how to find it on your own, you could still get to it — but there was not way to look it up on Google Maps.

If a DDoS attack was aimed at all of the major DNS providers, it could bring the Internet to a stand-still.

If a DDoS attack were to be aimed at all of the major DNS providers simultaneously, from a botnet that was geographically diverse and had hundreds of millions of devices under its control, it could theoretically bring the majority of the Internet to a stand-still until the attack abated or the targeted companies could muster the resources to block it.

Since Friday, Dyn has disclosed that devices infected by the Mirai botnet were one source of traffic. According to Brian Krebs, a reporter who specializes in computer security, “Mirai scours the Web for IoT devices protected by little more than factory-default usernames and passwords, and then enlists the devices in attacks that hurl junk traffic at an online target until it can no longer accommodate legitimate visitors or users.” Krebs has also been victim of the Mirai botnet – it was used to attack his blog in September, and actually brought it down until Google’s Project Shield came to its defense.

Why should I be concerned?

Security experts believe the IoT devices used in this attack are of the consumer-facing variety. “Consumer products often have little security,” Ryan O’Leary, vice president, Threat Research Center, WhiteHat Security, tells Digital Trends via email, “and the users who set these up have little security knowledge.”

Ryan O’Leary
Ryan O’Leary

O’Leary says these two factors combine to make “a very easy attack surface.” Wi-Fi security cameras, thermostats, and even garage door openers can all potentially be turned into zombies and added to a botnet, awaiting the instructions that could have contributed to Friday’s havoc.

These devices aren’t powerful, and individually, they’re not much threat. But hundreds of millions of them exist. When bundled together, they turn into the most powerful weapon on the Internet.

If you’re beginning to wonder whether any of your IoT devices could have been involved, good — that’s exactly what we need to be asking ourselves.

OK, now what?

So what can you do, exactly? For starters, if you do not have a password on your Wi-Fi router, or you’re using the default password, change it immediately and select WPA2 as the security mode, not the older WPA or WEP.

“This is the new standard of security,” O’Leary says, and points out that while you’re at it, you should also disable WPS, or Wi-Fi Protected Setup: “This feature has significant security vulnerabilities.” Making these changes ensures that your home network isn’t welcoming intruders with open arms — a good idea even if you don’t own a single IoT device.

But it doesn’t stop there. Because your home network is connected to the Internet at large, malicious entities like the Mirai botnet can probe your connected devices remotely.

Belkin, maker of the popular WeMo brand of IoT devices, says it’s very aware of this threat. In an emailed statement, the company said, “Wemo is designed so that our devices are not discoverable from anywhere on the Internet outside the home’s Local Area Network,” and it also points out that its installation procedure doesn’t modify a user’s port settings on their Wi-Fi router (open ports are yet another avenue for attack). If you’re unsure whether your router has open ports, there are a number of free tools like that can give you a report in less than a minute.

The next step is to make sure your existing IoT devices aren’t at risk of being captured by a botnet. Krebs points out that default passwords are the most likely culprit. If you have never changed the password that came with your device, now’s the time. Before you do, you’ll need to reset the product back to its factory settings. This ought to wipe any malicious code that has found a home — changing the password without doing a factory reset simply tells the owners of the botnet your new password.

Krebs also advises that at this point, you should make sure the device is running the latest firmware, something he acknowledges can be really tricky on some of the more user-unfriendly products on the market.

Some devices have a default password that’s unknown to the user, and which can’t be changed.

With all of that said, it’s possible there’s nothing you can do — except not use the device. The potency of the Mirai botnet is due to the fact some poorly designed devices have a default password that’s unknown to the user, and not controlled by the user interface. Backdoors like this are sometimes left behind by companies to make troubleshooting a device easier, to make the device more appealing to partner businesses that might want to use it, and to have an easy way to access all devices quickly. But it’s a huge security flaw, and often, not one you can fix.

We don’t know all the devices that have this problem, but Brian Krebs did do some digging that allowed him to identify a handful.

Taking a device offline can be painful. You paid for it, after all. But the besides providing an opportunity for botnets, insecure devices can lead to personal security concerns. The backdoor used by the botnet could also, in many cases, be used to change device settings without your knowledge.

What about next time?

If your favorite website becomes the victim of a DDoS attack, there’s probably not much you can do but wait it out. But if a DNS provider like Dyn should be attacked, your best bet is to switch your DNS provider from your local ISP to a service like Google DNS or Open DNS.

“That’s a great approach,” Andrew Campbell, founder of, a Canadian web hosting company, told us. “There are other benefits too. Sites will not only load faster, they’ll be more reliable.”

That’s because your local ISP’s DNS infrastructure isn’t as robust as these bigger companies, and may cache DNS information for longer periods of time. When Dyn was attacked, Campbell says it would have immediately changed the pathways to its clients’ sites, but it can take smaller DNS services up to 24 hours to reflect such a change. In the meantime, you’ll still be sent to an address that’s under siege from the attack and the site won’t respond.

Another benefit to using a third-party DNS provider is security. Occasionally DNS records can be hacked and legitimate domains can end up sending users to phishing sites or worse. There’s some evidence that these threats are better mitigated when you use DNS from Google or Open DNS.

Emerging Tech

Death from above? How we’re preparing for a future filled with weaponized drones

Drones are beginning to enable everything from search & rescue, to the delivery of medicines to hard-to-reach places. But they are also being used as cheap, and deadly flying bombs. How can we defend ourselves?
Product Review

Roku’s new Premiere+ makes a strong case as the best value in streaming land

When it comes to streaming devices, the sheer volume of choices these days can be daunting. While you really can’t go wrong with any Roku, its new Premiere+ stands out for its excellent balance between affordability and performance.

How you can give your PS4 a fresh start with a factory reset

Learn the many ways you can factory reset your PS4. From reverting your settings to factory to doing a full wipe and reinstalling the latest PlayStation firmware, we cover it all here, step by step.

Need a do-over? Here's how to factory reset an iPhone, from XS on down

Resetting an iPhone can alleviate all sorts of software woes, and wipe away personal data should you sell your device or give it to someone else. Here's how to factory reset an iPhone from within iOS or iTunes.

The 'Fallout 76' beta starts tomorrow! Here's when it starts and how to join

Want to get into Bethesda's Fallout 76 beta? We don't know when the program will launch, but we provide instructions on how to get ready. The game officially launches on November 14.

Samsung’s HMD Odyssey Plus gives you a clearer view into the virtual world

Samsung's refreshed HMD Odyssey+ promises to make Windows Mixed Reality experiences better by eliminating pixelated views caused by screen doors. The $500 headset also focuses on comfort this year with ergonomic improvements.

Intel denies rumors that 10nm Cannon Lake CPUs have been canned

Intel's long-in-development and oft-delayed, Cannon Lake 10nm CPU design has reportedly been canceled. Intel is denying the rumor, but if true, it could push back the release of new Intel chips by a long time.

Not to be outdone, Samsung says it’s making a laptop with a foldable display

Samsung announced that it is also working on a dual-screen computer. But rather than using two separate display panels, Samsung said that its novel laptop will come with a large flexible display that can fold when closed.

Free your digital memories, and frame them, with the best photo printers

Printed photos are experiencing a revival at the moment, but you don’t need to go to a special lab. Here’s our favorite options for making quality prints, from pocket-sized printers to wide-format photo printers capable of spitting out…

A new bug in the Windows 10 October 2018 Update could delete your files

The Windows 10 October 2018 Update has been on a rough path and in the latest set of issues, a new bug is impacting native zip file operations, potentially leading to overwritten files in some instances. 

Antivirus software has evolved a lot recently, and we need it more than ever

Everyone says you need it, but really is antivirus software, and how does it work? It depends on who you ask as different digital security companies employ different techniques to combat the latest malware threats.

Nvidia’s new GTX 1060 6GB could counter AMD’s rumored RX 590

Nvidia's GTX 1060 is about to get more powerful for new buyers, as the green team has introduced a new version with GDDR5X memory at its disposal. This could prove competitive with AMD's rumored RX 590.

A canceled education order is increasing hopes for new Macbook model

With Apple's October 30 event fast approaching, rumors continue to surface about new Macs and iPad models. In the latest news, a canceled education order is stoking hopes for a new MacBook model.

Facebook’s reported Rift 2 cancellation caused a rift with Oculus executive

Facebook may be prioritizing virtual reality on mobile experiences, which may have led to the company canceling development of the Oculus Rift 2. That may have been the cause of Oculus co-founder Brendan Iribe quitting.