Why Friday's Massive DDoS Attack Should Be Terrifying

Re:Why Friday's Massive DDoS Attack Should Be Terrifying by user5994461 on Sunday October 23, 2016 @04:55AM (#12772651)

A 0 day vulnerability in a specific firmware from a specific vendor is an entirely different issue than having all vendors ship their devices with admin:admin as default credentials and open telnet access from the internet ;)

[ Parent | on HN ]

Re:Why Friday's Massive DDoS Attack Should Be Terrifying by dogma1138 on Sunday October 23, 2016 @06:54AM (#12772959)

That would be considerably bigger than you think.

The problem with "IoT"(got I hate this term) is that it connects mass produced lowest barrier of entry devices with network stacks over pretty substantial bandwidth lines.

The difference between "residential" and "commercial" bandwidth is eroding it's no longer orders of magnitude greater even if you are pulling multiple 1gbit lines from your DC.

"IoT" are often not that purposely built they are going to share SoCs and likely firmware/software that will make 100,000's of units if not more vulnerable to compromise.

If you have say a 1M Apple HomeKit enabled light switches across Europe and the US which were built by some lowcost/OEM "insert_your_brand_name_here" manufacturer vulnerable to a single exploit you get the same problem.

And this problem will happen over and over and over again with different devices.

[ Parent | on HN ]