The same backdoors that owned the devices as a botnet, should be used to brick the devices. And the courts should support that purchasers are entitled to refunds and damages. Your IoT refrigerator got bricked? You can sue for $500 worth of spoiled food. Encourage class action lawsuits and watch how fast this is fixed.

https://github.com/jgamblin/Mirai-Source-Code

You can build secure devices. All it takes is putting quality engineers in charge.

But paying quality engineers isn't fun and they won't work for idiot management. So as long as management doesn't have to pay for the cost of disasters they cause, nothing will be secure.

It's the same thing that happened at Hillary's State Department.

So I agree: Brick those refrigerators.

There are some basic "timeless" regulations that would make sense over an entire device lifespan. For example, requiring unique admin passwords, or an internet off switch.

Nor would this regulation have to come from government. The details could be delegated to a UL-like industry group.

Until some one figures out that the admin PW is some hash of the MAC address or the serial number of the device or until some authbypass vulnerability affects 500,000 wifi enabled lava lamps.

Also while this attack did involve a botnet which used default credentials there will be attacks that infect via RCE or any other unauthenticated vector or simply don't require a botnet at all like say adding a multicast IP address to some wificamera or telemetry device that would cause it to send its traffic to a victim of your choice.

At the end you want to make sure your network and services are resilient to DDoS attacks, securing the endpoint source of choice everytime isn't that good of a strategy.

I heartily agree that the best approach is "do all the things".

My point above is that there are very sane regulatory changes that we can implement immediately, as part of attacking this problem.

A 0 day vulnerability in a specific firmware from a specific vendor is an entirely different issue than having all vendors ship their devices with admin:admin as default credentials and open telnet access from the internet ;)

That would be considerably bigger than you think.

The problem with "IoT"(got I hate this term) is that it connects mass produced lowest barrier of entry devices with network stacks over pretty substantial bandwidth lines.

The difference between "residential" and "commercial" bandwidth is eroding it's no longer orders of magnitude greater even if you are pulling multiple 1gbit lines from your DC.

"IoT" are often not that purposely built they are going to share SoCs and likely firmware/software that will make 100,000's of units if not more vulnerable to compromise.

If you have say a 1M Apple HomeKit enabled light switches across Europe and the US which were built by some lowcost/OEM "insert_your_brand_name_here" manufacturer vulnerable to a single exploit you get the same problem.

And this problem will happen over and over and over again with different devices.