TO A layman, the phrase “Internet of Things” (IoT) probably conjures up a half-fantastic future in which refrigerators monitor their own contents and send orders direct to the grocer when the butter is running out, while tired commuters order baths to be drawn automatically using their smartphones as they approach their houses in their self-driving cars. Actually, though, a version of the IoT is already here. Wi-Fi hubs, smart televisions, digital video-recorders and the like are all part of a network of devices run by microprocessors that, just as much as desktop, laptop and tablet computers, form part of the internet—but with one crucial distinction. Unlike things immediately recognisable as computers, these devices are often designed with poor security, or even none at all. They are wide open to malicious hackers who might wish to misuse them. And there are already around 5 billion of them, according to Cisco, the world’s largest computer-networking company, with billions more to come in the years ahead.
One favourite trick of such hackers is the distributed denial of service attack, or DDoS. This temporarily enslaves a number of internet-enabled devices into an arrangement known as a botnet, and then directs this net to send simultaneous requests for attention to a single machine or cluster of machines, thus overwhelming it and making it unusable. Such attacks may be carried out by organised criminals, to hold a firm to ransom; by cyber-savvy countries, as a tool of low-level warfare—or, as in the case of one of the latest attacks, for revenge.
The victim is Brian Krebs (pictured above), an American journalist who often reports on internet criminals, including those who run DDoS-for-hire services, and also those involved in the “dark” markets that trade in stolen identities and credit-card details. In the past, some of the people he has annoyed have sent heroin to his home while alerting the police to the fact they might find the drug there. This time, the very internet itself was turned against him. On September 20th Mr Krebs’s web server became the target of one of the largest DDoS attacks ever recorded—between 600 billion and 700 billion bits per second, or almost half a percent of the internet’s entire capacity, for hours at a time.
At first, his “network mitigation provider”, a firm called Akamai that was supplying its services to him free, for the general good of the field, was able to ward off these attacks. Eventually, though, it had to surrender. On September 23rd, with his agreement, it cut him loose and he had to shut down until he could make alternative arrangements.
Though Mr Krebs’s case is extreme by current standards, there is a risk it will soon become typical. Matthew Prince, the boss of CloudFlare, a firm that helps websites manage heavy traffic and deal with assaults of this sort, says his firm has already seen a sustained ten-day trillion-bits-per-second DDoS attack—though that was launched by a country (he declined to say which) rather than by a private criminal organisation. Other firms, such as OVH, a French web-hosting service, have also reported attacks of this magnitude.
On September 17th analysts at Flashpoint, Intel’s business-security division, announced that they had found a botnet composed of 1m devices, mostly digital video-recorders. And on October 1st the source code for “Mirai”, the botnet that attacked Mr Krebs’s computer, was released to an internet hackers’ forum by a pseudonymous individual. Mirai scans the internet for devices protected by factory-default usernames and passwords (which is often the case for machines that are part of the internet of things, since their owners rarely bother to change these defaults). It then recruits them into the network.
For the perpetrators, DDoS attacks are a perfect example of asymmetical warfare—cheap to carry out and expensive to prevent. The cost to Mr Krebs’s attackers, whoever they were (he has his suspicions, but no proof), would have been negligible even before Mirai’s source code was released; a few thousand dollars at most. Now, it is, in effect, zero. Defending against such attacks, though, is by no means cheap. Mr Krebs says he has been quoted rates of $150,000 to $200,000 a year for full-time protection. That is a lot of money for a freelance to fork out.
One way around this is to sign up for Project Shield, a programme (free to those accepted for enrolment into it) run by Google and designed to keep independent news organisations online. Google says Project Shield already protects both individual journalists and editorial organisations, including Rafael Marques de Morais, who reports on corruption and politics in Angola, and El Ciudadano, a Chilean periodical that promotes social and political reform. Since September 25th it has been protecting Mr Krebs, too—though attacks on his web server continue. CloudFlare offers a similar service, Project Galileo, which protects the American Civil Liberties Union, the Committee to Protect Journalists and others.
Ultimately, however, the answer to DDoS attacks like that perpetrated by Mirai is to build better security into both devices and the networks they are attached to. Edith Ramirez, chairwoman of America’s Federal Trade Commission, said as much in January 2015 when she delivered a polite but blistering speech about privacy and security practices at one of the electronic industry’s main trade meetings, the Consumer Electronics Show, in Las Vegas. Equally politely, deaf ears were turned. Andy Ellis, Akamai’s chief security officer, says network operators could introduce filters that would prevent common illegitimate traffic from reaching its destination, but the costs and complexities involved mean they do not want to—particularly if their competitors are not forced to bear similar costs.
One answer might be government action, in the form of required security standards, to level the playing-field by making all firms bear the same burden. There is no immediate sign of that happening, but if DDoS attacks in the trillions of bits per second range proliferate, that may change. In the meantime, though, people like Mr Krebs will continue to suffer from what Bruce Schneier, an internet-security guru at IBM, aptly describes as “the democratisation of censorship”.