The Internet of Things (IoT) is changing how the world works. Machine to machine (M2M) communication simply makes for faster, more timely, and transparent connections, thereby saving us a lot of time and money.
This means that your doctor no longer has to wait a few hours to receive your heart monitor readings when it automatically transmits such information to your doctor’s computer or tablet.
It’s much easier for manufacturers and retailers to keep track of inventory when they receive real-time updates on remaining supplies.
At home, you’ll never forget to write something on your shopping list when your smart refrigerator updates that list for you.
In the hands of the right people, the IoT has great potential to improve quality of life. But some people have found a way to exploit the IoT for their own gain. They do this through the IoT botnet.
What is an IoT botnet?
To answer this, we first have to define what the IoT and botnet are.
The IoT is simply the wireless interconnection of devices (things) through the Internet. It basically means that devices such as phones, refrigerators, and heart monitors have a “switch” that lets them connect to the Internet.
On the other hand, a botnet is simply a network of computers infected with malicious software and controlled as a group without the owners’ knowledge. These computers are then used to perform tasks like sending spam emails.
Now, if we put those two together, we’ll have a network of computers and other devices (things) connected through the Internet infected with malicious software being controlled without the owners’ knowledge. An IoT botnet is, therefore, much more intrusive and dangerous than a regular botnet.
An example of IoT botnet attacks includes the large botnet network discovered when a fridge was caught spreading spam emails. Another example was Mirai botnet which was used to perform DDoS attacks on French hosting firm OVH. A final example involved the enslavement of 18,000 Huawei devices in one day!
So, how can you defend your IoT devices from an IoT botnet?
Well, I’ve got some bad news and good news for you. The bad news: IoT devices and cybersecurity aren’t necessarily a match made in heaven. This is because IoT devices are designed to be open to the Internet (and, therefore, to anyone who can access their connection).
The good news: you can improve your IoT devices’ security yourself by trying the following steps.
1. Do your research
Before you buy any IoT device for your home or company, do a little digging online. See if your prospective purchase has built-in security features. Look for any exploits and vulnerabilities that may become concerns in the future.
Don’t just rely on the product’s Official Site. Trawl through forums (like Reddit) for user reviews on the product. These reviews come with invaluable information from first-hand users.
2. Change default passwords into strong ones
Another way you can secure your IoT device is by making sure you’re the one managing and controlling it. You should retain the power to activate and deactivate your device as well as deciding when your device goes on and offline.
The manufacturer should be prevented from operating the device without your authorization. This means retaining proper user identification and authorization by changing your IoT device’s default password.
Doing this prevents just anyone (whether manufacturer or hacker) from taking over as the device administrator.
Finally, practice strong password habits. This involves not only formulating long phrases but also sprinkling in upper case letters, numbers, and symbols (if allowed). You can also use a password generator to make strong passwords for you.
Strong passwords ensure that your IoT devices are well-protected from Brute Force attacks.
Also, consider changing your IoT devices’ passwords on a regular basis to make sure no one ever gets a bead on them.
3. Separate your IoT device network
You may want to create a separate network solely for your IoT devices. This prevents attackers from gaining access to all the data-filled devices on the same network.
Use a third-party firewall or other intrusion prevention system. A firewall prevents unwanted data from entering your network if no request from any of your connected devices was made for that unwanted data.
Utilize your router’s built-in security features to gain first-line protection for all the devices in that network.
4. Disable unused features
These unused features, like Universal Plug and Play (UPnP), make it easier to connect with other players on the Internet when you game on your console.
The problem is hackers from outside your network can detect your devices by exploiting certain vulnerabilities in the protocol.
This is why you should turn off these features when not in use.
5. Use comprehensive security software
You may notice a commonality when inspecting botnet attacks — they often exploit vulnerabilities in devices relying on default software.
While your IoT devices might come with built-in security right out of the box, these default security features are often weaker compared to third-party security software.
One software your home or enterprise should never be without is a VPN. Simply put, a VPN works to protect your IoT devices from botnet in two ways:
- It hides your true IP address which makes it harder for hackers to target your IoT devices.
- It encrypts your online data thereby preventing anyone who has actually infiltrated your network reading and utilizing your data stream.
While it may be impossible to secure every single IoT device you have with a VPN (since some devices simply aren’t compatible with a VPN), there is a way around this problem: install a VPN on your router.
That way, all the devices connected to your router gains the protection offered by the VPN.
Do note that you’ll have to get the best VPN services you can afford and avoid free VPNs as some of them have been known to sell users’ spare bandwidth which resulted in these bandwidths being used for a botnet.
6. Keep your device’s software, hardware, and firmware up to date
This may be old news but there’s a reason it’s repeated.
This is because updates for a manufacturer’s product often includes security updates that they just discovered.
Hackers will often make attacks during the time between the release of these security updates and when users actually update their device.
If you don’t install updates when they become available, you’re inadvertently running the risk of having your device being targeted for an attack.
Securing your IoT devices relies mainly on your own actions
The current environment makes defending the IoT against botnet a personal task for each user in the absence of further developments on the issue.
Users have to take some time getting to know the manufacturer of the IoT devices they want to purchase.
Separating IoT devices and computers into different networks can help prevent a catastrophic compromise of the whole network in case one device is infected by botnet malware.
Disabling unused features also help prevent such devices from being found by hackers outside the network.
Built-in default settings and security features have to be changed and bolstered with third-party security software that provides added layers of protection.
And remember to immediately install updates when they become available ensures that all hardware, software, and firmware remain air-tight in their defenses.
The post How to Defend Your IoT Devices from IoT Botnets appeared first on Cybersecurity Insiders.
October 22, 2018 at 09:09PM
0 comments:
Post a Comment