US files a lawsuit against D-Link for failing to secure its routers and security cams from hackers

Image Credit: D-Link

  06 Jan 2017 , 11:14

The U.S. Federal Trade Commission filed a lawsuit against D-Link Corp on Thursday, accusing the Taiwan-based manufacturer of failing to take reasonable steps to protect its routers and internet-linked security cameras from hackers.

The FTC brought the charges as part of a broader effort to improve security of internet-connected devices, including routers, webcams, digital video recorders and other widely used consumer electronics devices. The company said the claim is without merit.

“D-Link denies the allegations outlined in the complaint and is taking steps to defend the action,” it said in a statement. “The security of our products and protection of our customers private data is always our top priority.”

Concerns about security of internet-connected devices, which are sometimes referred to collectively as the internet of things, or IoT, have surged since last year when hackers used armies of compromised routers, webcams and other electronic devices to launch a series of increasingly powerful attacks that severed access to some of the world’s biggest websites.

Security experts blamed those attacks on lax security in large numbers of IoT devices from dozens of manufacturers. They have called on the industry to better secure their equipment, removing easy-to-exploit vulnerabilities such as the use of default passwords that give hackers the keys to remotely access machines over the web.

Allison Nixon, director of security research with cyber intelligence firm Flashpoint, said the FTC’s action could encourage IoT manufacturers to beef up security. “I think vendors are going to take it seriously,” she said. “The IoT world needs to shape up quickly because this is a big problem.”

The FTC’s complaint alleged that D-Link neglected to protect the devices from “widely known and reasonably foreseeable risks of unauthorised access,” even as it highlighted security features in communications with consumers.

The FTC asked the U.S. District Court for the Northern District of California to order D-Link to improve its security practices and to pay the agency’s legal costs. The agency filed the case after issuing guidelines on securing IoT devices in 2015. FTC commissioners voted 2-1 to approve the filing of the lawsuit. The Democratic chairwoman Edith Ramirez and commissioner Terrell McSweeny voted yes, but the lone Republican commissioner, Maureen Ohlhausen, opposed the filing of the lawsuit.

Reuters

How to secure your IoT devices from botnets and other threats

iot security

By Scott Matteson | November 25, 2016, 7:33 AM PST

There are resulting challenges ahead in IoT security arena. Gartner predicts that over the next two years more than half of IoT manufacturers won't be able to contain weak authentication methods, which can pose a data risk. They estimate that "by 2020, more than 25% of identified enterprise attacks will involve IoT, though IoT will account for only 10% of IT security budgets." Last April they projected security spending on IoT will approach $350M this year - nearly a 24% increase from last year, but this may not be enough.

Appropriate tactics will be a key element in the security battle. A recent Forbes article covered the topic of IoT security, advocating "strict regulatory standards," the need to "enhance security while simplifying compliance" and implementing "an end-to-end approach that integrates both IT and operations technology (OT)."

Let's look at some best practices to address the concepts of authentication, data privacy and botnets:

Authentication

Devices which must authenticate against other systems (generally in order to access or transmit data) should be configured to do so securely, such as with unique IDs and passwords. It may also be possible to implement encryption (SSH) keys to provide device identity to permit it to authenticate against other systems (securing the keys themselves is obviously a critical priority for this model to work). Examples of IoT devices with this capability can include closed-circuit TV (CCTV) or DVR devices and satellite antenna equipment.

In other instances, device SSL certificates can be issued during the manufacturing process or added later to establish device identity and facilitate the authentication process. The concept of building security into the device from the outset is an important concept for IoT manufacturers to consider, so that a careful consideration of possible vulnerabilities or flaws is factored into the design process. Some examples of IoT devices which can use SSL certificates are the Amazon Web Services IoT Button, smart meters and home energy management devices.

When it comes to device updates (software and firmware, for instance) authentication should be employed where possible to ensure these can retrieve code only from approved systems, such as internal servers or authorized devices.

Depending on your IoT devices, researching and implementing the capabilities above (if not already) present would be a good first step in security.

Data Privacy

IoT devices can use hardware-based trust anchors, also known as "roots of trust", which utilize a trusted boot process to ensure devices operate in a known secured state and their contents remain private. It's also possible to defend against untrusted software attacks by isolating code in different hardware locations so they cannot access secured resources.

Whether data is moving or at rest, it should be encrypted to protect the contents where possible.

IoT on-chip memories can protect data from being accessed or stolen by utilizing cryptography to encrypt or decrypt information. Communication between IoT devices and other systems should be secured via encrypted links using protocols such as TLS (Transport Layer Security), which is commonly used with web browsers such as when conducting financial transactions. TLS can prohibit "man in the middle" attacks whereby data in transit is captured and analyzed for confidential material.

It's also a good idea to isolate data so it's only available to systems which need to access it. Using firewalled networks with only the requisite systems is one such example.

Botnets

Internet of Things (IoT) devices can be at risk from botnets (also referred to as "thingbots.") A botnet is a privately-harnessed group of systems controlled via malware (which has previously infested a device). Botnets are often utilized to mount distributed denial of service (DDOS) attacks intended to incapacitate or cripple target systems, for purposes of revenge, extortion and calculated disruption.

One such example is known as the Mirai botnet, which launched large DDoS attacks earlier this year on Imperva, KrebsOnSecurity and Dyn (which affected Twitter, Spotify and other sites). Mirai source code was leaked publicly and Imperva researchers analyzed it to understand Mirai better. One of the results of the research was the development of a scanner that can check whether devices on a network are infected by or vulnerable to Mirai malware. This scanner, currently in beta mode, can be found here.

Here are some recommendations for protecting IoT devices from threats posed by botnets: For device owners: "Be careful of what you connect to the internet. Are you sure it needs to be exposed to the entire world? If not, put it behind your router, and in the settings do not do port forwarding to it, or limit its access...Change the default password that came with the device to a hard-to-guess one," said Ben Herzberg, security research manager at Imperva.

Travis Smith, senior security research engineer at Tripwire, commented that updates on IoT devices can also pose a security risk:

"Most devices are running on some variant of Linux, which can be outdated and highly vulnerable before the device is even released. Even if a vendor releases an update, there are no guidelines on how to handle the update. Some vendors automatically install the update on the devices as it is released. However, the majority of devices either never release any security updates, or fail to notify the owner of the device about the update. End-users need to be vigilant about finding out which devices they have installed and continually check for updates from the vendors."

For organizations: "Due to the increase in IoT devices, it's easier for attackers to generate massive DDoS attacks. Therefore, it is important to plan for such attacks, and make sure that the attacking traffic is mitigated in the cloud before it reaches your organization," said Herzberg.

Tim Matthews, Vice President of Imperva, stated: "Securing IoT devices will require both better education of consumers, and security by design on the part of manufacturers. Ideally, security companies and device manufacturers would work together to create standards for credentials and access akin to a UL compliance seal."

The Internet of Things Security Foundation also seeks to address these concerns by providing best practices, tips, and news updates to help companies and consumers stay abreast of security hazards. If you own or administer IoT devices, I recommend visiting their page regularly to stay informed about new developments in the IoT security landscape.

IoT Zombies are eating the Internet

  03 Nov 2016 , 13:16

By Alex deVries and Tim Skutt

Distributed denial of service (DDoS) attacks have always been a problem for popular hosted sites, but the ones from the last few weeks are different.

The first one to make the news was Brian Krebs’ krebsonsecurity.com, one of the most comprehensive security news sites today. The DDoS attack was on the order of 620Gbps, which cost Akamai too much to defend and resulted in krebsonsecurity.com going offline for a couple days. The source: hacked webcams acting as DDoS zombies.

A second one was on OVH, a French hosting provider. They survived a 1.5Tbps attack. Their claim that the attack was from 145,000 hacked cameras and DVRs is consistent with Akamai’s observations.

Besides the scale, what’s different about these attacks? IoT

The advent of IoT brings with it incredible scale of powerful low-cost devices. A botnet of 150k devices gives a great platform for an attacker. The devices are often scattered on the Internet, making them difficult to track.

Devices like cameras can be easy to hack. Devices have relatively long life spans and firmware is rarely updated, so devices often remain vulnerable to attacks long after known vulnerabilities are patched. Firmware can be reverse engineered, having either have been ripped from a purchased device or downloaded from firmware updates. Many devices also have default usernames and passwords to make this even easier.

Targets aren’t hard to find, either. Sites like shodan.io make it trivial to find certain devices on the Internet.

Securing devices

There are best practices that can be followed to secure devices. Device identity, secure default configuration, secure updates and resource protection are just some. These work well for new designs.

Let’s also be realistic: in the meantime, there’s millions of improperly secured devices on the Internet and they’ve been there for years. Fixing them is

DDoS defenses emerging from Homeland Security

By Evan Koblentz | October 31, 2016, 9:53 AM PST

Public, private, and academic researchers are working on new ways to combat distributed denial-of-service attacks. The recent large-scale attacks are making them even more determined.


Government, academic, and private-sector officials are collaborating on new ways to prevent and mitigate distributed denial-of-service (DDoS) attacks, based on research years in the making but kicked into high gear by the massive takedown this month of domain name system provider Dyn.


The largest attacks in summer 2015 were about 400 gigabits per second, but September 2016 saw an attack on security blogger Brian Krebs of more than 600Gbps, while Dyn said its own attack may have exceeded 1.2 terabits per second. Government-led research is focusing on the 1-terabit range but with systems that can scale higher, which is already needed due to the proliferation of vulnerable Internet of Things devices too easily commandeered by malicious hackers.



But it means there's a ton of job security for Dan Massey, a computer science Ph.D. serving as program manager for the U.S. Department of Homeland Security Advanced Research Projects Agency Cyber Security Division. Massey in August 2015 began evaluating and funding new anti-DDoS efforts at the National Institute of Standards and Technology (NIST), private companies, and universities, which share the goal of getting innovative techniques into commercially feasible pilot projects no later than summer 2018. Some are already underway, Massey and others said.


Funded projects include attack information sharing methods from the University of Southern California, University of California-Los Angeles, and University of Oregon; the latter implements a unique peer-to-peer method of letting networks share information about traffic patterns. Colorado State University is making a way to distribute the task of packet filtering and intelligence gathering; the University of Delaware and others including IBM are focusing on identifying new kinds of attacks; and the University of Houston is looking at on-demand network capacity for handling attacks when they hit. In addition, Waterford, Va.-based Waverley Labs and the Cloud Security Allianceare working on whitelisting methods to make a network only accept approved traffic. NIST is collaborating with the University of California-San Diego to determine whether the software for stopping DDoS attacks would hurt network performance.

Other anti-DDoS measures are already common for large companies, such as load balancing so that different parts of a network can pick up the slack if others go down, having multiple DNS providers for the same reason, and educating end users on safe internet usage, security experts at Akamai, Radware, and certification specialist (ISC)2 said. It's unclear why the

Cyber attacks hit Singapore telecom service provider StarHub

Image Credit: StarHub Facebook

  26 Oct 2016 , 14:34

Singaporean telecoms service provider StarHub Ltd said intentional cyber attacks had caused internet connection disruption for some of its home broadband customers on Oct. 22 and Oct. 24. The company said it analysed network logs of the disruptions and found that it had experienced intentional and likely malicious distributed denial-of-service (DDoS) attacks on its domain name servers (DNS).

DDoS attackers typically target sites by flooding servers with messages from multiple systems so they are unable to respond to legitimate traffic. StarHub said there was no evidence of any impact on the rest of its services, and the security of its customers’ information was not compromised. “On both occasions, we mitigated the attacks by filtering unwanted traffic and increasing our DNS capacity, and restored service within two hours,” it said in a statement late on Tuesday.

The incidents come close on the heels of attacks on Twitter Inc, PayPal Holdings Inc, Spotify AB and other customers of Dyn, a U.S. company which acts as a switchboard for internet traffic. StarHub said it was investigating the intent and source of the two attacks, which it called “unprecedented in scale, nature and complexity” for the company.

It told Reuters in an email on Wednesday that it does not use Dyn services. As of June 30, StarHub’s residential broadband subscribers totalled 473,000. Singapore authorities on Tuesday advised other telecom firms to strengthen defences to protect against similar disruptions.

Singapore Telecommunications Ltd, the city-state’s biggest telecom operator, said it did not observe any abnormal traffic trends over the weekend but will continue to monitor networks closely. Third-ranked M1 Ltd said it was aware of the cyber-attacks and was on alert.\

Reuters

Security experts urge companies to use multiple vendors to avoid major like cyber attack

Representational Image : Reuters

  24 Oct 2016 , 10:55

Companies can reduce the risk from the type of cyber attack that took out major websites on Friday by using multiple vendors for the critical internet service known as a domain name service, or DNS, companies and security experts said on Sunday. “We have advocated for years for redundancy in your infrastructure,” said Kyle York, chief strategy officer for Dyn, the New Hampshire DNS provider that was attacked on Friday. “I don’t think you can ever be safe enough or redundant enough.”

Hackers unleashed a complex attack on the internet through common devices like webcams and digital recorders and cut access to some of the world’s best known websites on Friday, a stunning breach of global internet stability. York said clients who used multiple servers “saw less of an impact.”

Using multiple DNS providers can, however, make managing traffic more complicated and costly, experts said. Friday’s cyber attack alarmed security experts because it represented a new type of threat rooted in the proliferation of simple digital devices such as webcams. Such devices often lack proper security, and hackers found a way to harness millions of them to flood a target with so much traffic that it can’t cope.

The attack on Dyn and the resulting outage started in the Eastern United States on Friday and then spread to other parts of the country and Europe, affecting companies including Twitter and Paypal. DNS providers such as Dyn act as a switchboard for internet traffic. “It’s important to implement diversity geographically, as well as architecturally,” for a defense against domain name service attacks, said Andy Ellis, chief security officer at Akamai Technologies, which helped Dyn recover on Friday.

Businesses can choose up to eight authoritative domain service providers, and some of the hardest-hit sites were customers who only picked Dyn. Eliminating the threat from the unsecured devices that make up what’s often called the Internet of Things will be a much tougher task, however. Many inexpensive webcams, connected thermostats, baby monitors and other products lack even basic security and sometimes use hard-coded passwords that are simple to break, security experts said.

Law enforcement authorities said on Friday they are investigating the attack. The tools making the new type of attack possible were released on the internet by unknown hackers last month, thus creating a long list of possible suspects. “This is the new norm, the internet wasn’t designed with these kinds of attacks in mind,” said cyber security expert and entrepreneur Barrett Lyon.

Long term solutions would likely require governments to take far more responsibility for mandating internet security, experts agreed. Chinese electronics component manufacturer Hangzhou Xiongmai Technology said on Sunday that weak default passwords on its products inadvertently played a role in the cyber attack, according to a report from IDG News Service. The company said it has patched the flaws and now is asking customers to change the default password the first time they use it.

Reuters

Massive DDoS Attack Against Dyn DNS Service Knocks Popular Sites Offline

Friday, October 21, 2016  Swati Khandelwal

UPDATE — How an army of million of hacked Internet-connected smart devices almost broke the Internettoday.

Cyber attacks are getting evil and worst nightmare for companies day-by-day, and the Distributed Denial of Service (DDoS) attack is one such attacks that cause a massive damage to any service.

Recently, the Internet witnessed a record-breaking largest DDoS attack of over 1 Tbps against France-based hosting provider OVH, and now the latest victim of the attack is none other than Dyn DNS provider.

A sudden outage of popular sites and services, including Twitter, SoundCloud, Spotify, and Shopify, for many users, is causing uproar online. It's because of a DDoS attack against the popular Domain Name System (DNS) service provider Dyn, according to a post on Ycombinator.

DNS act as the authoritative reference for mapping domain names to IP addresses. In other words, DNS is simply an Internet's phone book that resolves human-readable web addresses, like thehackernews.com, against IP addresses.

Dyn DNS is used by many websites and services as their upstream DNS provider, including Twitter, Spotify, SaneBox, Reddit, Box, Github, Zoho CRM, PayPal, Airbnb, Freshbooks, Wired.com, Pinterest, Heroku and Vox Media properties.

All of these sites and services are reportedly experiencing outages and downtime, either completely or partially.

Here's an internet outage map from Level3:

According to Dyn DNS, the DDOS started at 11:10 UTC and is mostly affecting its customers in the East Coast of the United States, specifically Managed DNS customers.

"We are aware of the ongoing service interruption of our Managed DNS network. For more information visit our status page," Dyn tweeted.

At the time, it's not clear who is behind this DDoS attack, but the company said its engineers are working on "mitigating" the issue.

Here's the statement posted by Dyn on its website:

"This attack is mainly impacting US East and is impacting Managed DNS customers in this region. Our Engineers are continuing to work on mitigating this issue.

Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time. Updates will be posted as information becomes available.

Customers with questions or concerns are encouraged to reach out to our Technical Support Team."

What websites are down for you? Let us know in the comments below.

We'll update the story as soon as we get to hear more about the attack. Stay Tuned!

Source code of DDoS botnet responsible for Krebs on Security attack posted online

By Rob Thubron on October 3, 2016, 9:30 AM




Last week, famed security researcher Brian Krebs was forced to take his website, Krebs on Security, offline after it suffered one of the largest distributed denial-of-service attacks ever recorded. Now, the source code for the botnet used in the assault has been published online.

Krebs on Security was hit with 620 gigabits per second of junk data during the DDoS attack. While this wasn’t enough to bring down the site, Krebs’ hosting provider, Akamai Technologies, was forced to order it off the network. Akamai had been offering Krebs pro bono protection from attacks for years, but the size of this DDoS meant it couldn’t keep doing so without the financial impact affecting other customers.

Krebs on Security reported Saturday that the source code of the malware, known as Mirai, was announced on hacking community Hackforums. It seeks out vulnerable IoT products by scanning for systems protected by factory default or hard-coded usernames and passwords. The software turns these devices into vast networks of bots that can be used to launch DDoS attacks.

Krebs notes that as the source code is publicly available, it “virtually guarantees” the internet will be “flooded with attacks from many new botnets powered by insecure routers, IP cameras, digital video recorders and other easily hackable devices.”


My guess is that (if it's not already happening) there will soon be