Recent DDoS attack against DNS provider Dyn that brought down a large chunk of the Internet came from hacked and vulnerable IoT devices such as DVRs, security cameras, and smart home appliances.
This DDoS was the biggest cyber attack the world has ever seen.
Now, in the latest incident, at least five Russian banks have been subject to a swathe of DDoS attacks for two days, said the Russian banking regulator.
The state-owned Sberbank was one of the five targets of the attacks that began on last Tuesday afternoon and lasted over the next two days.
According to Kaspersky Lab, the longest attack last for 12 hours and peaked at 660,000 requests per second came from a botnet of at least 24,000 hacked devices located in 30 countries.
Although the culprit appears to be using hacked and insecure IoT devices such as CCTV cameras or digital video recorders, Kaspersky Lab believes that the latest attack does not look like the work of the "Mirai IoT botnet" — the one used to disrupt the Dyn DNS service.
Mirai is a piece of nasty malware that scans for IoT devices that have weak factory default setting (hard-coded usernames and passwords), converts them into bots, and then used them to launch DDoS attack.
In a statement, Sberbank representative said the bank managed to neutralize the cyber attack without disturbing the ongoing operation of its website, adding that the latest DDoS attacks were among the largest the bank had ever seen, RT reports.
Another Russian bank, Alfabank, has also confirmed the DDoS attack, though it called the attack weak. The bank's representative told RIA Novosti that "there was an attack, but it was relatively weak. It did not affect Alfabank's business systems in any way."
Kaspersky said more than a half of the IoT botnet devices were situated in the United States, India, Taiwan, and Israel. To gain control over the devices, the hackers took advantage of smart devices that use easy to guess passwords.
Security researchers are continually pointing out serious threats from new connected devices that have been rushed to market with poor, or no, security implementations.
Just last week, the DDoS attack through hacked IoT devices led to the disruption of the heating systems for at least two apartments in the city of Lappeenranta, literally leaving their residents in subzero weather.
Keeping in mind the rise in the number of insecure IoT devices, it is entirely possible that the next round of attacks emerged from IoT-based botnet could reach orders of magnitude larger so much so that it could even take down our cities if we let it.
So the best way to protect your smart devices from being a part of DDoS botnet is to be more vigilant about the security of your internet-connected devices. Change the default settings and credentials of your devices and always protect your devices behind a firewall.
Although IoT manufacturers and Internet standard creators have a huge role to play in securing these vulnerable devices, consumers must also require taking some personal responsibility for safeguarding their own devices.
