Trio Admits Hijacking Home Devices

Three Americans have plead guilty to hijacking more than 100,000 internet-connected devices. The group of infected machines (known as a "botnet") was then used to attack websites using a distributed denial of service attack (DDoS) to make websites unavailable.

While most DDoS attacks are carried out on PCs, this attack in particular targeted weaknesses in smaller devices that use the Internet. This included routers, digital video recorders and wireless cameras. That's a significant point, as the tech security community has generally treated security flaws in such devices as a lower priority than those typically PCs.

The guilty pleas came from Paras Jha and Dalton Norman, both aged 21, and Josiah White, aged 20. All three admitted infecting the machines to create the botnet, known by security researchers as "Mirai." (Source: justice.gov)

Internet 'Phonebook' Rendered Useless

After testing its powers, the group made access to the botnet publicly available. It was then used by others to carry out a distributed denial of service attack on web servers until the servers were unable to cope with the demand, then becomes inaccessible.

Normally such attacks target specific websites, often for blackmail or political reasons. In this case it was used against one of the companies that operates a DNS register. That's the "Internet phonebook" which translates a website address (such as infopackets.com) into the IP address, a number that identifies the specific server or computer where the site pages are physically stored. Effectively, many websites simply wouldn't load when the attack was carried out.

DVRs Clicked On Web Ads

Following this attack, Jha and Norman created a new botnet of Internet-connected devices and used it for click fraud. In this scenario a web owner uses a botnet of infected machines to click on their own advertisements (ads which are for other companies, typically hosted by Google). Each time an ad is clicked, the web owner gets paid.

Jha also admitted to attacking the computer network of Rutgers University in his home state of New Jersey. That attack appeared to be more about knocking the network offline (which he did for several days at a time) rather than stealing data.

As part of a deal to plead guilty, Jha will be sentenced to up to 10 years in prison, while Norman and White could both get up to five years. (Source: bbc.co.uk)

What's Your Opinion?

Did you realize that devices like DVRs and wireless cameras could be used to launch such attacks? Do manufacturers need to be held to the same security standards as computer and software developers? Should the culprits in this case be held responsible for the major attacks other people carried out with their botnet?