Mirai-powered bots in this way. The IoT botnet then exploited the computation power of those hacked IoT devices to make a huge number of requests to servers of Dyn, which provides service for dynamic DNS.

When a device wants to access any website or server, it makes a DNS query to resolve the server’s IP address. The DNS servers provide the IP address to the client device, using which the device can connect to the required server. Nowadays, Dynamic Host Configuration Protocol (DHCP) is usually used to configure the IP addresses of servers, and the IP addresses keep changing over time. To manage that so that DNS servers can always point to the correct IP addresses, Dynamic DNS is used.

DYN provides dynamic DNS services to websites like Amazon, Spotify, and Twitter. As a result, when the IoT botnet attacked the DYN servers, those websites went down, creating a huge internet outage. In fact, the IoT botnet was so huge that it started making tens of millions of requests simultaneously to the DYN servers and suspended its services.

There are a number of other IoT botnets that hack IoT systems and exploit them for malicious purposes. Bashlight and Aidra are two of them.

How to secure IoT devices?

We can always take a couple of simple steps to secure IoT devices.

• Always remember to change the default passwords of IoT systems while configuring it. When attackers try to hack an IoT device, the first thing they do is try a list of easily available default usernames and passwords of devices to gain access.
• Do not keep weak passwords. Here’s a simple suggestion on how to create a strong password and remember it efficiently: How to create a strong password?
• Enable 2 Factor Authentication wherever possible (What is 2 Factor Authentication?).
• Update the firmware of IoT devices regularly. The more updated the firmware is, the lesser its known security vulnerabilities.
• Enable Firewalls (What is a firewall and how does it work?) and IDPS wherever possible (What is IDS?).
• Please make sure only the necessary ports of the IoT devices are open and exposed outside.
• Please ensure network ports or services are not exposed to the internet via UPnP (What is UPnP, and why is it a security risk?).
• Use accepted encryption standards and proprietary encryption protocols to encrypt data in IoT systems.
• Please ensure the physical security of IoT devices. The data storage medium must not be easily removed, and only the necessary external ports must be used.

Security Fundamentals Practice Tests

The Security Fundamentals Practice Tests test one’s fundamental knowledge of cyber security. They are good for those preparing for various certification exams, such as the CCNA, CCNP, or CompTIA, and for students and IT/security professionals who want to improve their understanding of cybersecurity.