How Does it Work?
An IoT botnet is built using IoT malware. Cybercriminals commonly target IoT devices when building botnets because they often have poor security. For example, large IoT botnets have been built by attempting to log in using default credentials or exploiting unpatched vulnerabilities in IoT devices’ software. These IoT security holes enable an attacker to gain access to the device and execute the botnet malware.
Once the botnet malware is installed on an IoT device, the device can be remotely controlled to do the attacker’s bidding. For example, an IoT bot may be instructed to participate in a DDoS attack against a particular address.
What Are the Threats of IoT Botnets?
IoT botnet can be used in various attacks that require computational power or network bandwidth, including:
- DDoS Attacks: DDoS attacks are one of the most common uses of an IoT botnet. All of the infected systems in the network are instructed to send requests to the target, overwhelming it.
- Credential Stuffing: A credential stuffing attack involves trying to log into users’ accounts with common or breached passwords. IoT botnets are commonly used for this since each bot can work through a list of target services, usernames, and passwords.
- Phishing: Botnets can be used to send out spam or phishing emails. This enables the attacker to achieve a higher volume and avoid IP address-based filters.
- Cryptojacking: Cryptojacking malware uses an infected computer’s computational power to mine cryptocurrency. The bots in an IoT botnet can do so using the IoT devices that they infect.
- Botnet Creation: Botnets grow by distributing the botnet malware. Bots can automatically look for and infect vulnerable devices by scanning for vulnerabilities, default credentials, and other attack vectors.
What Industries Can IoT Botnets Affect?
IoT botnets can affect companies in any industry. If a business is using IoT devices — a practice that is increasingly common in healthcare, transportation, manufacturing, energy, financial services, and other industries — its IoT devices may be conscripted into a botnet. Even if a company isn’t using IoT devices, it may be the target of DDoS or other botnet-driven attacks.
Types of Botnet Models
Botnets are designed to receive and execute commands from the botnet operator. This command and control (C2) infrastructure can be organized in a few different ways, including:
- Centralized Botnets: A single C2 server directly manages the bots in the botnet.
- Tiered C&Cs: Multiple levels of C2 servers exist with different purposes, making it more difficult to take down a botnet.
- Decentralized Botnets: Bots communicate over a peer-to-peer (P2P) network where each bot relays commands that it receives to other bots.
Examples of IoT Botnets
Numerous botnets are currently in operation. Some of the most significant include:
- Mirai: Mirai is an IoT botnet that spreads by logging into devices using default credentials. It spawned many new botnets after its source code was made public.
- Qbot: Qbot is an IoT botnet that first emerged in 2008 but is still active today. Like many other botnets, Qbot includes code to remove other botnet malware from an infected device.
- Kaiten: Kaiten’s codebase has been open-source since 2001, enabling many less-skilled criminals to operate botnets. Kaiten spreads by brute-forcing passwords to Telnet.
- Reaper: Reaper — also known as IoTroop — is a botnet that was first discovered in 2017. This botnet malware spreads by exploiting known vulnerabilities in a range of devices.
How to Protect Against IoT Botnets
IoT botnets pose a significant threat to organizations, as they are capable of launching massive attacks against an organization’s systems, overwhelming them with more traffic than they can handle.
Learn more about your organization’s vulnerability to DDoS attacks with a free DDoS Bot Analyzer Scan. Then, to find out more about protecting your organization against DDoS attacks, check out this Choosing the Right DDoS Solution e-book. Check Point also offers resources on how to manage a random denial of service (RDoS) attack.
Check Point Quantum DDoS Protector and Quantum Protector Cyber Controller offer robust protection against DDoS attacks and other malicious bot traffic. Check Point Quantum Protector has solutions sized and suited to the needs of organizations of any size.
Feedback