# data[].attributes.headline
A) A brief overview of IoT and B) An explanation of IoT's impact on cybersecurity and inherent risks and vulnerabilities that it brings to the forefront.

# data[].attributes.subject
A) A brief overview of IoT and B) An explanation of IoT's impact on cybersecurity and inherent risks and vulnerabilities that it brings to the forefront.

# data[].attributes.body
A) IoT is a term known  as the Internet of Things. These "things" within the internet are capable of collecting and transferring  data over a network without the requirement of human-interaction.

B) One of the biggest concerns we face with IoT is data security. Not only securing but also how to keep up with the security of the billions of data that IoT is collecting and sharing. Keep in mind that since these devices can communicate with other related or connected devices, they can act on the information they receive from another devices. This lacks human intervention and could make it difficult for humans to override the system if needed to be. One of the biggest questions we need to consider is how much of the CIA triad is compromised. There is a bigger need to evaluate the policies behind who has control and access to the data and what the data can be used for.

# data[].attributes.headline
Resources example #1 of IoT cybersecurity attacks - The Apache Log4j Vulnerability  

# data[].attributes.subject
Resources example #1 of IoT cybersecurity attacks - The Apache Log4j Vulnerability  

# data[].attributes.body
Target: Apache Log4j, a java software library used by a variety of consumers.
Attack Type: Remote code execution vulnerability. An attack that allows an attacker to drop malware or ransomware on a target system.
Attack Process: Attack fed messages to Log4j, instructing the system to download and execute malware from a remote server. This attack thus grants greater accessibility to the victim’s system.
Possible Aftermath: 1) Complete compromise of the network, 2) theft of sensitive information, and 3) possibility of sabotage.

# data[].attributes.attachment_link.title
Critical Apache Log4j Exploit Demonstrated in Minecraft

# data[].attributes.attachment_link.description
We explore a far-reaching, real-world exploit with damaging implications in this edition of SecurityWatch.

# data[].attributes.headline
Resources example #2 of IoT cybersecurity attacks - Ring Home – Security Camera Breach

# data[].attributes.subject
Resources example #2 of IoT cybersecurity attacks - Ring Home – Security Camera Breach

# data[].attributes.body
Target: Amazon Ring
Attack Type: Basic hacking by using a variety of weak, recycled and default credentials.
Attack Process: Hackers gained access to live feeds from the cameras that were around customers’ homes. Some of he hackers were even able to communicate remotely using the devices integrated microphones and speakers.
Possible Aftermath: Over 30 people in 15 families reported verbal harassment from the hackers.

# data[].attributes.attachment_link.readable_text
Dozens of people who say they were subjected to death threats, racial slurs, and blackmail after their in-home Ring smart cameras were hacked are suing the company over "horrific" invasions of privacy.

A new class action lawsuit, which combines a number of cases filed in recent years,alleges that lax security measures at Ring, which is owned by Amazon, allowed hackers to take over their devices. Ring provides home security in the form of smart cameras that are often installed on doorbells or inside people's homes.

The suit against Ring builds on previous cases, joining together complaints filed by more than 30 people in 15 families who say their devices were hacked and used to harass them. In response to these attacks, Ring "blamed the victims, and offered inadequate responses and spurious explanations", the suit alleges. The plaintiffs also claim the company has also failed to adequately update its security measures in the aftermath of such hacks.

A plaintiff was watching TV with his teenage son when a voice through the camera allegedly asked them what they were watching. Photograph: Plaintiffs' complaint

People who could benefit from the lawsuit include the families named in the case, as well as any other Ring users who have been hacked. The class also covers the tens of thousands of customers who purchased a Ring doorbell between 2015 and 2019, even if they were not hacked.

"I would imagine that there are a whole lot more people out there who have been hacked," said Hassan Zavareei, the lead attorney on the case. "This is probably just the tip of the iceberg."

The suit outlines examples of hackers taking over Ring cameras, screaming obscenities, demanding ransoms, and threatening murder and sexual assault.

One Ring user says he was asked through his camera as he watched TV one night, "What are you watching?" Another alleges his children were addressed by an unknown hacker through the device, who commented on their basketball play and encouraged them to approach the camera.

In one case, an older woman at an assisted living facility was allegedly told "tonight you die" and sexually harassed through the camera. Due to the distress caused by the hack she ultimately had to move back in with her family, feeling unsafe in the facility where she once lived.

A screengrab allegedly shows a hacker threatening an older woman whose family purchased a Ring device to keep an eye on her after she entered assisted living. Photograph: Plaintiffs' complaint

In another incident, a plaintiff who had purchased a Ring device to keep an eye on her four-year-old daughter with a history of seizures alleges that music from a horror film was played through her camera. Her complaint reads:

On December 4, 2019, shortly after 8 pm, while Ms LeMay was running errands, both of the Ring devices began live-streaming. Simultaneously, the Tiny Tim cover of "Tiptoe Through the Tulips", a song that appeared in a scene from ... the horror film "Insidious", began to play through the two-way talk feature. Intrigued by the music, Ms LeMay's eight-year-old daughter, AL, went to the room she shares with two of her younger sisters to investigate. But the room was empty. As AL wandered the room, looking for the source of the music, the song abruptly stopped, and a man's voice rang out: "Hello there."

LeMay immediately changed passwords and called Ring that day to report the hack, but she didn't get a response for nearly a week. The company never told LeMay where the hack originated or how it occurred, the complaint alleges. The plaintiff eventually had to leave her job because of the emotional distress, the complaint said.

A hacker allegedly got into a Ring camera and told an eight-year-old girl he was Santa Claus and asked if she wanted to be his 'best friend'. Photograph: Plaintiffs' complaint

Ring has not said who is behind the hacks, and victims say they still do not know who accessed their homes through the devices.

Repeatedly, Ring blamed victims for not using sufficiently strong passwords, the suit claims. It says Ring should have required users to establish complicated passwords when setting up the devices and implement two-factor authentication, which adds a second layer of security using a second form of identification, such as a phone number.

However, as the lawsuit alleges, Ring was hacked in 2019 - meaning the stolen credentials from that breach may have been used to get into users' cameras. That means the hacks that Ring has allegedly blamed on customers may have been caused by Ring itself. A spokesperson said the company did not comment on ongoing litigation.

The lawsuit also cites research from the Electronic Frontier Foundation and others that Ring violates user privacy by using a number of third-party trackers on its app.

The suit said that, at present,Ring "has not sufficiently improved its security practices or responded adequately to the ongoing threats its products pose to its customers". Security and privacy experts have also criticized Ring's response.

"After a slew of terrifying headlines about their poor security practices, Ring has finally made some improvements," said Evan Greer, the deputy director of the privacy advocacy group Fight for the Future. "But implementing basic security that they should have had in the first place does nothing to change the fact that Ring cameras make communities less safe, not more safe."

In addition to hacking concerns, Ring has faced increasing criticism for its growing surveillance partnership with police forces. Ring has now created law enforcement partnerships, which allow users to send footage and photos to police, in more than 1,300 cities.

"Ring's surveillance-based business model is fundamentally incompatible with civil rights and democracy," Greer said. "These devices, and the thinking behind them, should be melted down and never spoken of again."

# data[].attributes.attachment_link.title
Dozens sue Amazon's Ring after camera hack leads to threats and racial slurs

# data[].attributes.attachment_link.description
Class action claims weak security allowed hackers to take over the smart cameras used on doorbells and in homes

# data[].attributes.headline
Resources example #3 of IoT cybersecurity attacks - Nortek Security & Control – Access Control System Breach

# data[].attributes.subject
Resources example #3 of IoT cybersecurity attacks - Nortek Security & Control – Access Control System Breach

# data[].attributes.body
Target: Nortek Linear eMerge E3 devices
Attack Type: Malware and DoS (Denial of Service)
Attack Process: 1) Hijacking of credentials, 2) control over devices (opening/locking doors), 3) install malware, and 4) launching DoS (Denial of Service) attack.

Possible Aftermath: Major delayed response by Nortek. However type of breach provides light on how vulnerable systems can be an entry point into corporate networks. Also, just how quickly hackers can use connected IoT smart devices to target multiple businesses at once.

# data[].attributes.headline
Resources example #4 of IoT cybersecurity attacks - Household Appliances – Botnet Attacks

# data[].attributes.subject
Resources example #4 of IoT cybersecurity attacks - Household Appliances – Botnet Attacks

# data[].attributes.body
Target: Smart household appliances (e.g. smart fridges,  washing machines, air conditioners, water heaters)
Attack Type: Malware and DDoS
Attack Process:  Botnets malware infect appliances and often go unnoticed by the owner. Thus having almost zero impact on the owner’s security.
Possible Aftermath: If a hacker takes control of  a botnet which had silently hacked thousands of large loT household appliances, cybercriminals could technically de-stabilize an entire power grid.

# data[].attributes.attachment_link.readable_text
The increased proliferation of IoT devices paved the way for the rise of IoT botnets that amplifies DDoS attacks today. This is a dangerous warning that the possibility of a sophisticated DDoS attack and a prolonged service outage will prevent businesses from growing.

While data breaches and ransomware are still considered among the more significant concern for businesses, the threats sometimes come from a direction we weren't expecting. Cybercriminals use botnets for various malicious purposes, most significantly for DDoS attacks against targets. The most important change is now the bot armies are increasingly made of IoT devices.

As the total installed base of IoT devices worldwide is expected to reach 30.9 billion by 2025, the IoT botnet threat and its overall power continue to expand.

Attackers seized the opportunity to create large botnets, to large complex DDoS attacks to disable or knock offline a target website. Although the IoT botnets can steal confidential data, as seen in the instance of the Torri botnet, most of the botnets have been used for DDoS attacks.

This is a dangerous warning for an online business to ensure they have effective anti-DDoS protection and bot takeover prevention.

High-Level Anatomy of IoT DDoS Attack

So, what is a botnet? - A botnet is a group of infected computers under the control of attackers used to perform various scams and cyber-attacks. Here, the attackers use malware to take control of vulnerable IoT devices to block legitimate users from accessing internet services by executing DDoS attacks.

A simple principle governs a DDoS attack: it takes down websites offline by consuming more resources or occupying all available bandwidth. Attackers with more hijacked IoT devices can consume more resources and launch a more damaging attack. The three main goals of attackers include:

To cause consumption of limited resources

To cause destructive changes to network devices

To change or destroy configuration information

Why Are IoT Devices Easy Prey for Botnet Malware?

The increased proliferation of IoT devices has become an attractive target for attackers. Further, most IoT devices include serious security issues like weak passwords, open access to management systems, default administrative credentials, or weak security configurations. As millions of IoT devices and their numbers continue to increase, they are not constantly updated to patch against security vulnerabilities.

Botnet attacks seize the opportunity of IoT vulnerabilities to take control of the devices and lead to disruptions in online services. They're most placed on networks that are not monitored for the attack, making it easy for attackers to access them. Further, in most cases, the network where they reside offers a high-speed connection that enables a large amount of DDoS attack traffic.

Major IoT Botnet DDoS Attack Trends

IoT botnet DDoS attacks are not new; Mirai was the most prevalent and has continued to target IoT devices since 2016. Mirai made its debut on September 20, 2016, with a DDoS attack against cybersecurity expert Krebs's blog. The next notable IoT botnet DDoS attack was in October 2016 against Dyn, a major DNS (Domain Name Service). The Mirai botnet assaulted the victim with one terabit traffic per second, which made a new record in a DDoS attack.

According to the ENISA threat landscape report, in 2019, the Mirai variants increased by 57%. The Verizon data breach investigations report recorded 103 699 botnet incidents primarily targeting professional, financial, and information services industry verticals.

A new variant of Mirai called Mozi accounted for the most observed flooded traffic in late 2019 through 2020. The Mirai and its variant continue to pose a threat in 2021; they broadened their attack with its significant new capabilities.

Attackers use multiple botnets based on Mirai and Mozi botnets like Echobot, BotenaGo, Moonet, and Loli to target devices. According to Sam's report on the IoT security landscape, more than 1 billion IoT security attacks took place in 2021, nearly 62 million of which were IoT-related DDoS attacks.

How Can You Protect Against IoT Botnet DDoS Attacks Today?

As the botnet landscape expands and highly sophisticated threats become inevitable, enterprises must move beyond legacy security solutions.

The first step to addressing these ongoing security challenges is moving to comprehensive risk-based security solutions. In addition, advanced, automated endpoint detection and protection solutions must offer complete visibility into IoT devices and their security state.

As always, prevention steps should be implemented to stay protected from such attacks:

Monitor incoming and outgoing traffic on your network for malicious activities with a web application firewall. Next-gen WAF like Indusface AppTrana can block bad bots from specific IPs while ensuring a smooth transfer of legitimate bot traffics.

Monitor login attempts and create a lookout for spikes

Keep IoT devices on protected networks

Perform continuous security testing on IoT devices

The Closure

DDoS attacks are the standard intent of an IoT botnet. DDoS may be an unavoidable part of the new reality, but you don't need to take it as the new norm. Architect robust security solutions to properly secure your businesses.

# data[].attributes.attachment_link.title
IoT Botnets Fuels DDoS Attacks - Are You Prepared?

# data[].attributes.attachment_link.description
The increased proliferation of IoT devices paved the way for the rise of IoT botnets that amplifies DDoS attacks today. This is a dangerous warning that the possibility of a sophisticated DDoS attack and a prolonged service outage will prevent businesses from growing.

# data[].attributes.headline
Resources example #5 of IoT cybersecurity attacks - St. Jude Medical – IoT Security Breaches In Healthcare

# data[].attributes.subject
Resources example #5 of IoT cybersecurity attacks - St. Jude Medical – IoT Security Breaches In Healthcare

# data[].attributes.body
Target: St. Jude Medical's Merlin@home Cardiac IoT Devices
Attack Type: IoT device malfunction or failure in encryption of the radio frequency protocol used by St. Jude Medical, allowing a relatively easy backdoor access to the devices.
Attack Process: By altering the Merlin@home Transmitter, hackers can remotely access a patient's RF-enabled implanted cardiac device.
Possible Aftermath: By having access to medical IoT device, hackers could use the device to manipulate information and transmit false signals. For example, cardiac devices, if a hacker were able to gain access to this, they major harm to the patient such as  deplete the battery or administer incorrect pacing/shocks.

# data[].attributes.attachment_link.readable_text
The U.S. Food and Drug Administration is urging all heart transplant patients who have received a St. Jude pacemaker to contact their healthcare provider and receive a software update to protect their device from being hacked.

The firmware update will take just three minutes in-person with the patient's provider. The FDA stressed this update cannot be done from home. The device will run on backup mode during the process, but all life-sustaining features will still be available.

After the update, the device will return to normal settings.
[Join Your Peers at HIMSS' Healthcare Security Forum! Register Today]
The implantable cardiac devices from Abbott -- which acquired St. Jude Medical in early 2017 -- have been under fire since August 2016.

A report from investment firm Muddy Waters Capital and security researcher MedSec found St. Jude's pacemakers and other heart devices are vulnerable to hacking and other cybersecurity threats. The lawsuit that followed came with another report of even more flaws.
[Also: St. Jude admits security vulnerabilities in cardiac devices]
While St. Jude built patches for these flaws, this newest FDA alert provides the framework to fix the vulnerabilities. The flaws in St. Jude Medical's RF-enabled implantable cardiac pacemakers could allow a hacker access to the patient's device to modify programming commands remotely.

The result of which would drain battery power or the administration of inappropriate pacing.
[Also: Pacemaker device security audit finds 8,600 flaws, some potentially deadly]
There is a low risk of an update malfunction. However, officials warned that there is always a potential issue with reloading previous version if the update is incomplete, a loss of programmed settings, loss of diagnostic data and a complete loss of device functionality.

The FDA is instructing providers to evaluate the risks and benefits, considering the needs of each patient.
[Also: Device maker was hush on defibrillator defect that killed patients, FDA says]
"For pacing dependent patients, consider performing the cybersecurity firmware update in a facility where temporary pacing and pacemaker generator can be readily provided," according to the alert.

The FDA plans to continue to monitor these devices and inform the public if other issues arise and is also working with manufacturers, providers, security researchers and the government to develop and implement tools to improve cybersecurity on all devices throughout the lifecycle.

"FDA reminds patients, patient caregivers and healthcare providers any medical device connected to a communications network may have cybersecurity vulnerabilities that could be exploited by unauthorized users," officials said. "However, the increased use of wireless technology and software in medical devices can also often offer safer, more efficient, convenient, and timely healthcare delivery."
Twitter: @JessieFDavis
Email the writer:jessica.davis@himssmedia.com

# data[].attributes.attachment_link.title
FDA to patients with St. Jude pacemakers: Update needed to keep hackers out of devices

# data[].attributes.attachment_link.description
The U.S. Food and Drug Administration is urging all heart transplant patients who have received a St. Jude pacemaker to contact their healthcare provider and receive a software update to protect their device from being hacked. The firmware update will take just three minutes in-person with the patient's provider.