Re:The Mirai Botnet Is Proof the Security Industry Is Broken
by fortytw2 on Tuesday November 01, 2016 @11:39AM
(#12846729)
Why would anyone in their right mind attack IoT products directly (ie. disabling/destroying them), when using them as a large botnet is far, far more lucrative?
Well... Perhaps once IoT webcams are used for blackmail - but even that is a much more difficult task than "really big botnet attack really big sites" so the incentive isn't there
Re:The Mirai Botnet Is Proof the Security Industry Is Broken
by Bartweiss on Tuesday November 01, 2016 @12:00PM
(#12847001)
The same reason we got ILOVEYOU?
I know profit motivated attacks have eclipsed entertainment motivated ones, but that's partly been about the work required to get a 'strong' exploit going. Mirai used an easier access vector than Morris to get full ownership of target devices, so it wouldn't be hard for one person to copy and abuse.
I don't think this is going to become the norm - messing up a refrigerator isn't a lucrative goal - but I expect that it'll happen occasionally if systems stay this weak.
Re:The Mirai Botnet Is Proof the Security Industry Is Broken
by GrinningFool on Tuesday November 01, 2016 @01:16PM
(#12847954)
The best we can get out of direct attacks on IoT are new "security products that protect your IoT devices" in a reactive manner. Windows antivirus all over again.
If your toaster attacks Dyn, that's an indirect failure. But if your lights decide to shut off permanently because some kid thought it would be funny, you're going to throw them away and buy some dumb lightbulbs.
Short of regulation or bribery, I can only hope that we'll see progress after some IoT products are directly attacked instead of repurposed into botnets.