Kaspersky delved into the evolving threats targeting the rapidly growing Internet of Things (IoT) sector. With IoT devices, such as routers and smart home components, projected to exceed 29 billion by 2030, Kaspersky’s research offers critical insights into attack methods, dark web activities, and prevalent malware types.
Kaspersky’s research uncovered a thriving underground economy on the dark web focused on IoT-related services. Notably, Distributed Denial of Service (DDoS) attacks orchestrated through IoT botnets are in high demand among hackers. In the first half of 2023, Kaspersky’s Digital Footprint Intelligence service analysts identified over 700 ads for DDoS attack services on various dark web forums.
The cost of these services varies depending on factors like DDoS protection, CAPTCHA, and JavaScript verification on the victim’s side, ranging from $20 per day to $10,000 per month. On average, the ads offered these services at $63.5 per day or $1350 per month.
In addition, the dark web marketplace offers exploits for zero-day vulnerabilities in IoT devices, as well as IoT malware bundled with infrastructure and supporting utilities.
In the realm of IoT malware, a variety of families exist, with many originating from the 2016 Mirai one. Fierce competition among cybercriminals has driven the development of features designed to thwart rival malware. These strategies include implementing firewall rules, disabling remote device management, and terminating processes linked to competing malware.
The primary method for infecting IoT devices continues to be through brute-forcing weak passwords, followed by exploiting vulnerabilities in network services. Brute-force attacks on devices are commonly directed at Telnet, a widely used unencrypted protocol. Hackers use this method to gain unauthorized access by cracking passwords, allowing them to execute arbitrary commands and malware. Although SSH, a more secure protocol, is also susceptible, it presents a greater resource challenge for attackers.
In the first half of 2023, Kaspersky’s honeypots recorded that 97.91% of password brute-force attempts focused on Telnet, with only 2.09% directed at SSH. These attacks were primarily associated with China, India, and the United States, while China, Pakistan, and Russia were the most active attackers.
Furthermore, IoT devices face vulnerabilities due to exploits in the services they use. These attacks often involve the execution of malicious commands by exploiting vulnerabilities in IoT web interfaces, resulting in significant consequences, such as the spread of malware like Mirai.
“Kaspersky urges vendors to prioritize cybersecurity in both consumer and industrial IoT devices. We believe that they must make changing default passwords on IoT devices mandatory and consistently release patches to fix vulnerabilities. In a nutshell, the IoT world is filled with cyber dangers, including DDoS attacks, ransomware, and security issues in both smart home and industrial devices. Kaspersky’s report stresses the need for a responsible approach to IoT security, obliging vendors to enhance product security from the get-go and proactively protect users,” comments Yaroslav Shmelev, a security expert at Kaspersky.
Types of IoT malware
IoT devices are susceptible to various types of malware, each serving distinct purposes:
1. DDoS Botnets: These malicious programs take control of IoT devices to launch Distributed Denial of Service (DDoS) attacks on a wide range of services.
2. Ransomware: Targeting IoT devices, particularly those containing user data like NAS boxes, ransomware encrypts files and demands ransomware for decryption.
3. Miners: Despite their limited processing power, some cybercriminals attempt to use IoT devices for cryptocurrency mining.
4. DNS Changers: Certain malware alters DNS settings on Wi-Fi routers, redirecting users to malicious websites.
5. Proxy Bots: Infected IoT devices are employed as proxy servers to reroute malicious traffic, making it difficult to trace and mitigate such attacks.
For more detailed information, please refer to Kaspersky’s full report on the IoT threat landscape for 2023 on Securelist.
To protect industrial and customer IoT devices, Kaspersky experts recommend:
-Conduct regular security audits of OT systems to identify and eliminate possible vulnerabilities.
-Use ICS network traffic monitoring, analysis and detection solutions for better protection from attacks potentially threatening technological process and main enterprise assets.
-Make sure you protect industrial endpoints as well as corporate ones. Kaspersky Industrial CyberSecurity solution includes dedicated protection for endpoints and network monitoring to reveal any suspicious and potentially malicious activity in the industrial network.
-When implementing IoT, assess the status of a device’s security before its implementation. Preferences should be given to devices that have cybersecurity certificates and products from those manufacturers that pay more attention to information security.
-For your smart home devices, don’t forget to change the default password. Instead, use a strict and complex one and update it regularly. A reliable password manager, such as Kaspersky Password Manager, can help to generate a secure one.
-Don’t share serial numbers, IP addresses and other sensitive information regarding your smart devices on social networks
-Be aware and always check the latest information on discovered IoT vulnerabilities.
-A good option is to read reviews and research regarding devices’ security before buying. Note how the manufacturer reacts to discovered vulnerabilities. If it quickly resolves issues reported by researchers, that’s a good sign.
