Skip to main content

How to keep your gadgets from being part of a botnet

black lives matter ddos attacks attack oct 21v2
Image used with permission by copyright holder
The massive DDoS attack that made it impossible for some people to access sites like Twitter, GitHub, and Spotify, was a wake-up call for many of us. Though it did no permanent damage, and no personal data was at risk (unlike recently disclosed attacks on Yahoo), it managed to disrupt wide swaths of the Internet for several hours. Much like a short-lived blackout, it was mostly an inconvenience. But it could have been much worse.

What did the DDoS attack do?

Typically, DDoS (Distributed Denial of Service) attacks are aimed at individual entities, like the one that Sony and several others suffered in 2014. When this happens, the company’s online services are disrupted, which in that case led to gamers being cut off from the Playstation Network and Xbox Live.

Friday’s attack targeted Dyn, a major provider of DNS services. Because Dyn’s DNS servers are responsible for translating domain names like www.digitaltrends.com into IP addresses, any company that was using Dyn to host their DNS became like a house on a street without its address displayed. The house was still there of course — if you already knew how to find it on your own, you could still get to it — but there was not way to look it up on Google Maps.

If a DDoS attack was aimed at all of the major DNS providers, it could bring the Internet to a stand-still.

If a DDoS attack were to be aimed at all of the major DNS providers simultaneously, from a botnet that was geographically diverse and had hundreds of millions of devices under its control, it could theoretically bring the majority of the Internet to a stand-still until the attack abated or the targeted companies could muster the resources to block it.

Since Friday, Dyn has disclosed that devices infected by the Mirai botnet were one source of traffic. According to Brian Krebs, a reporter who specializes in computer security, “Mirai scours the Web for IoT devices protected by little more than factory-default usernames and passwords, and then enlists the devices in attacks that hurl junk traffic at an online target until it can no longer accommodate legitimate visitors or users.” Krebs has also been victim of the Mirai botnet – it was used to attack his blog in September, and actually brought it down until Google’s Project Shield came to its defense.

Why should I be concerned?

Security experts believe the IoT devices used in this attack are of the consumer-facing variety. “Consumer products often have little security,” Ryan O’Leary, vice president, Threat Research Center, WhiteHat Security, tells Digital Trends via email, “and the users who set these up have little security knowledge.”

Ryan O’Leary
Ryan O’Leary Image used with permission by copyright holder

O’Leary says these two factors combine to make “a very easy attack surface.” Wi-Fi security cameras, thermostats, and even garage door openers can all potentially be turned into zombies and added to a botnet, awaiting the instructions that could have contributed to Friday’s havoc.

These devices aren’t powerful, and individually, they’re not much threat. But hundreds of millions of them exist. When bundled together, they turn into the most powerful weapon on the Internet.

If you’re beginning to wonder whether any of your IoT devices could have been involved, good — that’s exactly what we need to be asking ourselves.

OK, now what?

So what can you do, exactly? For starters, if you do not have a password on your Wi-Fi router, or you’re using the default password, change it immediately and select WPA2 as the security mode, not the older WPA or WEP.

“This is the new standard of security,” O’Leary says, and points out that while you’re at it, you should also disable WPS, or Wi-Fi Protected Setup: “This feature has significant security vulnerabilities.” Making these changes ensures that your home network isn’t welcoming intruders with open arms — a good idea even if you don’t own a single IoT device.

But it doesn’t stop there. Because your home network is connected to the Internet at large, malicious entities like the Mirai botnet can probe your connected devices remotely.

Belkin, maker of the popular WeMo brand of IoT devices, says it’s very aware of this threat. In an emailed statement, the company said, “Wemo is designed so that our devices are not discoverable from anywhere on the Internet outside the home’s Local Area Network,” and it also points out that its installation procedure doesn’t modify a user’s port settings on their Wi-Fi router (open ports are yet another avenue for attack). If you’re unsure whether your router has open ports, there are a number of free tools like yougetsignal.com that can give you a report in less than a minute.

The next step is to make sure your existing IoT devices aren’t at risk of being captured by a botnet. Krebs points out that default passwords are the most likely culprit. If you have never changed the password that came with your device, now’s the time. Before you do, you’ll need to reset the product back to its factory settings. This ought to wipe any malicious code that has found a home — changing the password without doing a factory reset simply tells the owners of the botnet your new password.

Krebs also advises that at this point, you should make sure the device is running the latest firmware, something he acknowledges can be really tricky on some of the more user-unfriendly products on the market.

Some devices have a default password that’s unknown to the user, and which can’t be changed.

With all of that said, it’s possible there’s nothing you can do — except not use the device. The potency of the Mirai botnet is due to the fact some poorly designed devices have a default password that’s unknown to the user, and not controlled by the user interface. Backdoors like this are sometimes left behind by companies to make troubleshooting a device easier, to make the device more appealing to partner businesses that might want to use it, and to have an easy way to access all devices quickly. But it’s a huge security flaw, and often, not one you can fix.

We don’t know all the devices that have this problem, but Brian Krebs did do some digging that allowed him to identify a handful.

Taking a device offline can be painful. You paid for it, after all. But the besides providing an opportunity for botnets, insecure devices can lead to personal security concerns. The backdoor used by the botnet could also, in many cases, be used to change device settings without your knowledge.

What about next time?

If your favorite website becomes the victim of a DDoS attack, there’s probably not much you can do but wait it out. But if a DNS provider like Dyn should be attacked, your best bet is to switch your DNS provider from your local ISP to a service like Google DNS or Open DNS.

“That’s a great approach,” Andrew Campbell, founder of Brickhost.com, a Canadian web hosting company, told us. “There are other benefits too. Sites will not only load faster, they’ll be more reliable.”

That’s because your local ISP’s DNS infrastructure isn’t as robust as these bigger companies, and may cache DNS information for longer periods of time. When Dyn was attacked, Campbell says it would have immediately changed the pathways to its clients’ sites, but it can take smaller DNS services up to 24 hours to reflect such a change. In the meantime, you’ll still be sent to an address that’s under siege from the attack and the site won’t respond.

Another benefit to using a third-party DNS provider is security. Occasionally DNS records can be hacked and legitimate domains can end up sending users to phishing sites or worse. There’s some evidence that these threats are better mitigated when you use DNS from Google or Open DNS.

Editors' Recommendations

Simon Cohen
Contributing Editor, A/V
Simon Cohen covers a variety of consumer technologies, but has a special interest in audio and video products, like spatial…
Save $400 on this Dell PC with an RTX 4070, 32GB of RAM, 1TB SSD
The Dell XPS desktop on a table.

If you're willing to spend on desktop computer deals for a machine that will offer flagship performance for all of your needs, it's highly recommended that you go with the Dell XPS Desktop 8960. This certain configuration that's on sale from Dell will let you enjoy savings of $400 on its original price of $2,250, so you'll have to pay $1,850 -- it's still not cheap, but it's going to be worth every single penny at this discounted price. You're going to have to be quick though -- this is a clearance sale, so there's no telling when the offer expires and when stocks will run out.

Why you should buy the Dell XPS Desktop 8960
The Dell XPS Desktop 8960 isn't just an excellent PC -- it's our top pick among the best desktop computers for its flexibility to accommodate almost any budget and purpose. This particular model of the PC features the 13th-generation Intel Core i9 processor, the Nvidia GeForce RTX 4070 graphics card, and 32GB of RAM, which will make it more than enough to tackle even the most demanding tasks, while also offering high-end gaming potential to play the best PC games for whenever you need to take a break from work.

Read more
Best color laser printers for 2024: tested and reviewed
A Brother printer on a counter in front of a brick wall.

The best color laser printers can be a great investment, saving you quite a bit of time and money. For shoppers worried about the long-term ink costs, you'll find color laser printers surprisingly affordable. Laser printers use toner, which lasts a very long time, delivering a low cost per page for monochrome documents and fast color prints. The best color laser printers offer quick performance and reliability to help keep your home office or small business productive.

If you need to scan documents for record-keeping and photo capture or want the convenience of a color copier, an all-in-one color laser printer is an essential tool for your small business or personal use. For a small added cost, you get expanded capabilities. That's why every model on this list is an all-in-one from the best printer brands.

Read more
The 5 best Wi-Fi adapters for PC in 2024
The Ugreen AC1300 Wi-Fi adapter in a desktop PC.

Whether you're designing it yourself or getting a pre-built PC, it can be easy to get a computer and realize that it doesn't have a native Wi-Fi adapter. Or, maybe it does, but you're internet speeds are getting faster, game downloads are getting bigger, you've already upgraded your router and need an adapter to match your newfound power requirements. No matter the situation, an external Wi-Fi adapter that you can add to your PC setup or even laptop setup will be worth your time. Here, we investigate the best Wi-Fi adapters for PC use. Most are incredibly affordable and just snap into a free USB port and start working.
The best Wi-Fi adapter for PC in 2024

Buy the

Read more