Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-4602 size-medium" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2016/06/blog-computer_iStock_000027265514_Full-300x232.jpg" alt="Hard work brings rewards" width="300" height="232" />On Oct. 21, 2016, an extremely large distributed denial-of-service (DDoS) attack on <a href="http://dyn.com/">Dyn</a> prevented many internet users on the East Coast of the U.S. from accessing websites such as Netflix, PayPal, Spotify and Twitter for several hours. Dyn provides domain name system (DNS) services to other businesses. DNS services resolve web addresses into IP addresses, which is necessary for users’ web browsers to connect with web providers’ servers. The DDoS attack on Dyn was <a href="https://krebsonsecurity.com/2016/10/senator-prods-federal-agencies-on-iot-mess/">reportedly</a> similar to the <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/">620 gigabits of traffic per second</a> that targeted Brian Krebs’ website, KrebsOnSecurity, on Sept. 20, 2016. Later in September 2016, a DDoS attack against webhost provider <a href="https://www.ovh.com/us/">OVH</a> <a href="https://www.us-cert.gov/ncas/alerts/TA16-288A">broke the record for largest recorded DDoS attack</a>, with attack rates of at least 1.1 terabits per second.

These historically large DDoS attacks were made possible when <a href="http://www.warner.senate.gov/public/index.cfm/pressreleases?ContentRecord_id=CD1BBB25-83E0-494D-B7E1-1C350A7CFCCA">attackers used the “Mirai” malware</a> to capture internet of things (IoT) devices and herd them into botnet armies that attackers used to send massive amounts of traffic to targeted servers. The IoT devices used in the attacks were primarily internet-connected cameras but also included internet routers, digital video recorders and internet-connected printers. The attackers’ tasks were made easier, as Brian Krebs reported, because the devices were <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/">deployed with standard default user names and passwords</a>, which users had not changed. Even if users deployed the IoT device behind routers, which should have made them unreachable from the internet, the devices use technology known as universal plug and play (UPnP), which automatically opens ports to enable reaching the devices from the internet. If users had changed the default user names and passwords on the devices’ web interfaces, that may not have changed the default user names and passwords for telnet or SSH access to the devices, <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/">which the Mirai malware uses to communicate with the devices</a>.

The threat that additional DDoS attacks will be launched using Mirai malware and vulnerable IoT devices increased substantially when the source code for <a href="https://www.us-cert.gov/ncas/alerts/TA16-288A">the Mirai malware was posted online</a> at the end of September 2016.

According to Krebs, a Chinese company, XiongMai Technologies, <a href="https://krebsonsecurity.com/2016/10/iot-device-maker-vows-product-recall-legal-action-against-western-accusers/">admitted that it had sold networked cameras until September 2015 that were accessible</a> by attackers using Mirai malware. XiongMai said that it planned to recall the vulnerable products.

Even if XiongMai recalls and replaces its pre-2015 devices with devices that cannot be compromised by Mirai or similar malware, billions of other vulnerable IoT devices will remain. U.S. Senator Mark Warner, in a <a href="http://www.warner.senate.gov/public/index.cfm/pressreleases?ContentRecord_id=CD1BBB25-83E0-494D-B7E1-1C350A7CFCCA">letter</a> to Federal Communications Commission (FCC) Chairman Tom Wheeler, quoted a Juniper Research estimate that by the end of 2020 there will be 13.4 to 38.5 billion IoT devices. Roland Dobbins, a principal engineer at Arbor Networks is <a href="https://www.wired.com/2016/10/internet-providers-key-securing-iot-devices-already/">quoted</a> in Wired as stating, “I’m not worried about the future, I’m worried about the past, because there are all these zillions of devices out there that are ripe for exploitation.”

Given that currently deployed IoT devices can serve as a platform for DDoS attacks that can take down large internet companies, the internet itself is at risk. As Senator Warner stated in his <a href="http://www.warner.senate.gov/public/index.cfm/pressreleases?ContentRecord_id=CD1BBB25-83E0-494D-B7E1-1C350A7CFCCA">letter</a> to Chairman Wheeler, “[w]hile the internet was not designed with security in mind, its resiliency – which serves as its animating principle – is now being undermined.” Security expert Bruce Schneier was <a href="https://www.schneier.com/essays/archives/2014/01/the_internet_of_thin.html">more blunt</a> about the IoT DDoS threat: “We simply have to fix this. … This problem is only going to get worse, and more expensive.”

Senator Warner, Bruce Schneier and other experts have proposed several ways to address the IoT DDoS threat. Six proposed fixes, including their strengths and weaknesses, are discussed below.
<ol>
 	<li>Senator Warner <a href="http://www.warner.senate.gov/public/index.cfm/pressreleases?ContentRecord_id=CD1BBB25-83E0-494D-B7E1-1C350A7CFCCA">asked</a> FCC Chairman Wheeler if the FCC could require ISPs to designate vulnerable IoT devices as “insecure” and deny them connections to the ISPs’ networks. This potential fix could be implemented relatively quickly. The FCC may be able to issue such an order pursuant to the FCC’s authority to regulate broadband access ISPs as entities providing telecommunications services. See In the matter of Protecting and Promoting the Open Internet, FCC GN Docket No. 12-28 (“Open Internet Order”), ¶¶ 47, 51 (2015). Even if a “no connection” order is possible, it would be only a partial solution. As Bruce Schneier <a href="https://www.schneier.com/essays/archives/2016/10/we_need_to_save_the_.html">points out</a>, “attackers can just as easily build a botnet out of IoT devices from Asia as from the United States.” Still, a relatively quick and partially effective approach could buy time for other proposed actions to gain ground. If the FCC responds positively to Senator Warren’s suggestion, this approach could deny attackers the use of IoT devices in the U.S.</li>
 	<li>Similarly, as <a href="https://litigationconferences.com/wp-content/uploads/1955/12/Are-You-and-Your-Insurer-The-Internet-of-Things.pdf">Viktor Vitkowsky noted</a>, the Federal Trade Commission (FTC) could find that manufacturers of insecure IoT devices have violated Section 5 of the FTC. In its <a href="https://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf">January 2015 FTC Staff Report</a>, at pages 11-12, the FTC recognized that IoT devices with security vulnerabilities “could be used to launch a denial of service attack.” The successful prosecution of a Section 5 complaint by the FTC against an IoT manufacturer for inadequate security could cause other IoT manufacturers to recall and fix their devices. This approach would be limited to manufacturers over which the FTC has jurisdiction, just as the FCC’s reach regarding “no connection” orders would be limited to ISPs within the FCC’s jurisdiction. An enforcement effort by the FTC could, however, be implemented relatively quickly, could reduce the battalions of IoT devices in the attackers’ botnet armies and could incentivize other IoT manufacturers to deploy secure devices.</li>
 	<li>IoT owners could disable features exploited by the attackers. Theoretically, owners of vulnerable IoT-connected cameras and other devices could learn to disconnect their devices from the internet, reboot the devices, and change the user names and passwords in the web interfaces of the devices. Because the Mirai exists in dynamic memory, rebooting the devices clears the malware. Users may also learn that they need to disable the UPnP feature of the devices to prevent attackers from reinfecting the devices by accessing them through telnet and SSH after web application user names and passwords have been changed. Some users may also block ports 23 (telnet), 2323 (telnet for some IoT devices) and 103 (used by Mirai as a backdoor). It seems unlikely, however, that most IoT users worldwide will take these steps. If some users do make these changes, it will decrease the number of devices available for DDoS attacks, but there is no historical precedent that should make anyone optimistic about users of IoT devices correcting the security flaws in the devices through self-help.</li>
 	<li>Some <a href="http://www.techrepublic.com/article/iot-and-liability-who-pays-when-things-go-wrong/">commenters</a> have proposed that businesses damaged by IoT-based DDoS attacks could bring civil claims, <a href="https://litigationconferences.com/wp-content/uploads/1955/12/Are-You-and-Your-Insurer-The-Internet-of-Things.pdf">including product liability claims</a>, in U.S. courts. An early case that included similar claims, Cahen v. Toyota Motor Corp., 147 F. Supp. 3d 955 (N.D. Cal. 2015), app. filed, No. 16-15496 (9th Cir. Mar. 23, 2016), did not fare well. The consumer car-buyer plaintiffs in Cahen alleged, among other things, that Toyota and GM violated California law by selling cars that were susceptible to hacking. The trial court dismissed the plaintiffs’ claims for lack of standing and for failure to state a claim. Businesses damaged by DDoS attacks would presumably be able to establish standing and the damages component of their claims. It could be difficult, however, for such businesses to establish that a manufacturer of an IoT device is liable for such damages when the device user failed to take steps to secure the device and a criminal attacker exploited the security vulnerabilities. Further, even if a business were to succeed in obtaining a judgment against an IoT device manufacturer and succeed in defending the judgment on appeal, the case would take years to litigate. Although civil litigation could eventually establish precedents that would add additional incentives for IoT manufacturers to address security issues, as a remedy for the current, substantial DDoS threat, civil damages claims offer relief that would be too little and too late. If a business were to seek injunctive relief to try to stop an ongoing DDoS attack, it is unclear what companies would be proper defendants – all vulnerable IoT component suppliers, all device manufacturers and all ISPs? It also would appear challenging for a business damaged by an IoT-based DDoS attack to persuade a judge that the balance of equities favors forcing ISPs to identify and disconnect IoT devices.</li>
 	<li>Criminal actions could be brought against the IoT-based DDoS attackers, either in U.S. courts or where the attackers reside. Criminal prosecution of DDoS attackers can be effective in eliminating the defendants as threats and in encouraging similar attackers to pursue other opportunities. That was demonstrated when <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/">two Israeli DDoS “booter” providers were arrested</a> after <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/">Krebs disclosed their identities</a>. (Booter providers use servers, not IoT devices, to launch DDoS attacks.) A few days later, one of the largest forums selling DDoS booter services, Hackforums.net, <a href="https://krebsonsecurity.com/2016/10/are-the-days-of-booter-services-numbered/">announced</a> it was getting out of the DDoS business. The FBI and other law enforcement agencies are undoubtedly seeking to identify the individuals responsible for the recent, massive IoT-based DDoS attacks. It is notoriously difficult, however, to identify such individuals. The release of the Mirai source code makes the malware available to a large number of potential attackers who now do not need to write their own code to perform IoT-based DDoS attacks. Even if such attackers are identified, if they reside in Russia, the Russian government currently refuses to extradite cyber criminals. Criminal prosecution of DDoS attackers should be pursued, but there’s little evidence it will stop IoT-based DDoS attacks.</li>
 	<li><a href="http://www.warner.senate.gov/public/index.cfm/pressreleases?ContentRecord_id=CD1BBB25-83E0-494D-B7E1-1C350A7CFCCA">Senator Warner asked</a> FCC Chairman Wheeler if IoT manufacturers should be required to abide by minimum technical security standards and if such standards should be set by the U.S. National Institute of Standards and Technology. <a href="http://blogs.dlapiper.com/iptitaly/?tag=cyber-attack">Another commenter asked</a> if such manufacturers should be required to obtain certification from an “internal organization validated by public authorities” to establish that their products do not have security flaws that would make them vulnerable to being used for DDoS attacks. As with several of the other proposed solutions, these proposals would take time to implement and would not address the billions of IoT devices with exploitable vulnerabilities that have already been deployed. As with other such remedies, they should be pursued, but the need for a more immediate solution to the risk cannot be ignored.</li>
</ol>
In short, it appears that only action by the FCC or FTC can timely address the risk that attackers will continue to take down internet businesses by launching massive IoT-based DDoS attacks. Encouraging device owners to correct security flaws will probably do very little to reduce the risks of such attacks. Criminal prosecutions of the attackers are likely to remain infrequent and will therefore provide little deterrent effect. Civil claims by affected businesses and imposing security standards on IoT manufacturers could help reduce the risk over several years, but will not address the current threat. The magnitude of the IoT-based DDoS threat should cause the FCC and FTC to strongly consider taking action.

Six Proposals to Stop IoT-Based DDoS Attacks