Whether or not you work in IT security, distributed denial of service (DDoS) attacks are becoming more visible by the day. In the last three months of 2016 alone, DDoS attacks greater than 100Gbps increased by 140% year-on-year, according to a recent report. This growth isn’t expected to decelerate any time soon.
The damage inflicted by DDoS attacks in the past year has been seen across various aspects of the online world. We often hear of news sites and political campaigns being taken offline, but this is now moving towards more mission critical operations in hospitals, banks and universities.
The most significant example in recent months is the DDoS attack against Domain Name Service (DNS) provider Dyn. Let’s take a look at this case and determine the potential impact that conformance to existing standards could have had on the incident.
IoT and the DDoS dilemma
The Dyn attack in October 2016 impacted a whole host of major websites including Amazon, Netflix, Twitter, Spotify and Github, and was widely reported as the largest of its kind ever recorded. Its substantial impact was down to the huge number of connected devices used in the attack – not just laptops and PCs but routers, printers and baby monitors that make up the so-called Internet of Things (IoT). These devices were deliberately infected with the Mirai malware in order to create a botnet to carry out the momentous attack.
It’s important to be clear on the mechanisms of the Mirai malware if we’re to consider the potential impact of standards on the attack. By using known passwords, it is able to search for susceptible IoT devices before infecting them with the malware. As a result, the device becomes part of a botnet which is capable of launching DDoS attacks from all of its infected devices.
Seven out of 12 DDoS attacks in Q4 2016 were down to the Mirai botnet. In the Dyn case, it was estimated that the attack involved 100,000 malicious endpoints. The botnet sent around 1 TB of traffic per second to the company’s servers, meaning legitimate requests were denied.
Mitigating DDoS attacks
This attack was fundamentally a consequence of the devices involved still retaining their default password. There are two arguments as to where culpability lies in this instance. Some blame the users for not changing the default passwords once they were connected. Others feel more responsibility should fall on the manufacturers to ensure operators understand the importance of changing default passwords.
In fact, in some cases manufacturers were distributing products with well-known default passwords and no option to change the password without purchasing a new product. In any case, these devices were vulnerable and open to attack.
Standards: the silver bullet?
DDoS attacks are becoming far more sophisticated so it’s essential that hardware and software manufacturers start to seriously consider standards to address the potential security risks in the growing Internet of Things. One key standard is the Open Trusted Technology Provider Standard, or O-TTPS, which addresses these issues around supply chain security and product integrity. Recently approved as ISO/IEC 20243, this set of best practices can be applied from design to disposal, throughout the supply chain and the entire product life cycle.
Standards like the O-TTPS aim to reduce the risk of tainted (e.g., malware-enabled and malware-capable) and counterfeit hardware and software components from entering the supply chains and making their way into products that connect to the internet. This specific standard also has a conformance program that identifies Open Trusted Technology Providers who conform.
The vendors involved in the Dyn incident could have followed the O-TTPS’ requirements for vulnerability analysis and notification of newly discovered and exploitable product weaknesses. If they had done so from the outset, the vulnerability that allowed the Mirai botnet to grow would have been caught early. The attack vector would have subsequently been blocked and the impact on businesses and consumers significantly reduced.
Securing Information and Communication Technology (ICT) on which our business enterprises and critical infrastructures depend is a serious problem that becomes even more daunting and complex as we extend those environments to IoT devices.
ICT and IoT devices are developed, manufactured, and assembled in multiple countries around the world. They are then distributed and connected globally. Providing international standards like the O-TTPS (ISO/IEC 20243) that all IT providers and their technology partners (e.g., component suppliers, manufacturers, value-add resellers) in their supply chains can adopt, regardless of locale, is one significant way to increase cyber and supply chain security.
Standards can’t categorically prevent the inception of DDoS attacks, but what they can do is mitigate their effectiveness and limit their economic damage. The adoption of a universal product integrity and supply chain security standard is a major first step in the continued battle to secure ICT products and IoT devices and their associated end users.
Further steps need to be taken in the form of collaboration, whereby we reach a point where we can recognise which technology and technology providers can be trusted and which cannot. But adhering to global standards provides a powerful tool for technology providers and component suppliers around the world to combat current and future DDoS attacks.