DOS attack via IOT - boundaries of internet?

In summary: When they stopped using AOL, their computer's IP address changed. Before they stopped using AOL, their computer had an IP address that belonged to AOL. After they stopped using AOL, their computer's IP address changed.In summary, when you stop using a service like AOL, your computer's IP address changes.
  • #1
Stephen Tashi
Science Advisor
7,861
1,598
The recent news about a denial-of-service attack (DOS) that came via the internet-of-things (IOT) https://www.cnet.com/how-to/ddos-iot-connected-devices-easily-hacked-internet-outage-webcam-dvr/ brings up the question: How are the boundaries between "the internet" and other forms digital wireless communication implemented? For example, I assume that my (cheap) indoor-outdoor digital thermometer uses some form of wireless digital communication that is not part of "the internet".

We could imagine a science-fiction scenario where thousands of small physical devices are smuggled into a country and used to attack the internet via the IOT thus by-passing efforts to secure the web by securing legitimate consumer products that are on the IOT. Is that scenario based on a misunderstanding of how the boundaries of the "the internet" are implemented?
 
Physics news on Phys.org
  • #2
Thousands of IOT devices would be a drop in the bucket compared to the millions that are part of the drone network. Manufacturers need to stop allowing any form of default or weak passwords so that people won't be able to put unsecured devices on the internet.
 
  • #3
I'm not completely clear about the thrust of your question, but in order for a device to attack a website/service on the the internet, the device has to be connected to the internet. So I guess that's the "boundary" (though the word makes no sense to me in this context). Just bringing a bunch of devices into the country doesn't mean they can do anything if they aren't connected to the Internet.
 
  • #4
russ_watters said:
Just bringing a bunch of devices into the country doesn't mean they can do anything if they aren't connected to the Internet.

My question amounts to: What capability must a device have in order to be "connected to the internet" ?
 
  • #5
Borg said:
Thousands of IOT devices would be a drop in the bucket compared to the millions that are part of the drone network. Manufacturers need to stop allowing any form of default or weak passwords so that people won't be able to put unsecured devices on the internet.
Yeah, that seems like a pretty easy fix to me. Verizon's router/modem/switches, for example, have a unique/legitimate password pre-coded into the device and printed on a sticker on the side. To sell a router/modem/switch with a default "Admin" and "Password" account is just really stupid/lazy.
 
  • #6
Stephen Tashi said:
My question amounts to: What capability must a device have in order to be "connected to the internet" ?
A wire or wifi or cell phone transmitter/receiver and something to connect to that is connected to the internet and allows the connection.

I'm maybe a bit confused about your level of knowledge here: what sort of device are you using to make these posts? A computer? A cell phone? Don't you know how they connect to the internet?
 
  • #7
Borg said:
Thousands of IOT devices would be a drop in the bucket compared to the millions that are part of the drone network.

I agree, but what's an estimate for the number of devices that participated in the recent DOS attack ?
 
  • #8
Stephen Tashi said:
I agree, but what's an estimate for the number of devices that participated in the recent DOS attack ?
Hard to say but it was definitely in the millions given the amount of requests that were hammering the servers.
 
  • #9
russ_watters said:
A computer? A cell phone? Don't you know how they connect to the internet?

No, I don't know exactly.

For example, I think there is an agreement among manufacturers of ethernet devices that gives each device a unique MAC address. But I don't know that there is any enforcement in the implementation of the internet that can detect if the MAC address that a device claims to have is one assigned by a legitimate manufacturer.
 
  • #10
Stephen Tashi said:
No, I don't know exactly.
Let's start very basic: What kind of device are you using to make these posts?
 
  • #12
russ_watters said:
Let's start very basic: What kind of device are you using to make these posts?

No, Let's not start that basic !
 
  • #13
Stephen Tashi said:
No, Let's not start that basic !
We're going to have to. Because you are saying things that imply you don't have even a basic understanding of what it means for a device to be connected to the internet.

My parents had a similar problem that they seemed to get over (I'm not totally convinced though): after they stopped using AOL, they were confused by the fact that when they turned on their computer, they didn't have to start a separate program to "log on" to the internet. They didn't understand what happened when they turned on their computer to make it connect, nor the fact that their computer was always connected to the internet when on.
 
  • #15
russ_watters said:
We're going to have to. Because you are saying things that imply you don't have even a basic understanding of what it means for a device to be connected to the internet.

What things have I said about "what it means for a device to be connected to the internet"? I've hardly said anything at all about it.
 
  • #16
Stephen Tashi said:
What things have I said about "what it means for a device to be connected to the internet"? I've hardly said anything at all about it.
Most of what you have said:
-The thing about your wireless thermometer
-The "science fiction scenario"
-Bringing up MAC addresses (putting the cart before the horse and misunderstanding how the cart works).

In my previous post, I mentioned my parents' issues on the subject. I suspect yours are the opposite (judging by the thermometer issue): you are young enough that you don't remember when the internet didn't exist and devices weren't automatically connected to it, so you have never had to deal with the issue of what it means and what the difference is between devices that are and aren't connected. And that's fine.

Look, you started this thread asking for help, and now instead of helping me help you, you are arguing with me about how much help you need. So do you want help or not?
 
  • #17
russ_watters said:
Most of what you have said:
-The thing about your wireless thermometer
What "thing"? I said my cheap wireless thermometer does not communicate with the internet. Are you saying it does?

-The "science fiction scenario"
Are you implying it is infeasible?
-Bringing up MAC addresses (putting the cart before the horse and misunderstanding how the cart works).
What "cart" and what "horse" are you referring to?

Look, you started this thread asking for help, and now instead of helping me help you, you are arguing with me about how much help you need. So do you want help or not?

No, I don't need your help.
 
  • #18
Stephen Tashi said:
No, I don't need your help.
Fair enough. good luck to you!

Jeesh!
 
  • #19
russ_watters said:
Yeah, that seems like a pretty easy fix to me. Verizon's router/modem/switches, for example, have a unique/legitimate password pre-coded into the device and printed on a sticker on the side. To sell a router/modem/switch with a default "Admin" and "Password" account is just really stupid/lazy.
I'm sure the instructions state to change this information. If the user does not, well... I don't think you'll pass the (I hope, and wish there was one) computer literacy test before even buying a computer.

With regards to the DDoS attack, how does one even stop it and get the servers back to working order?
 
  • #20
StevieTNZ said:
I'm sure the instructions state to change this information. If the user does not, well... I don't think you'll pass the (I hope, and wish there was one) computer literacy test before even buying a computer.
While I agree, this isn't just about the stupidity of one (or a million individual) computer users, it's about the societal cost of a design that should be impervious to that stupidity.
 
  • Like
Likes Borg
  • #21
I'm curious to know if any of you had any problem with the allegedly affected sites that day.

According to the news, this attack had spread here to the south west coast later that day, but I'm not aware of anyone who was affected by it.
 

1. What is a DOS attack via IOT?

A DOS (Denial of Service) attack via IOT (Internet of Things) is a type of cyber attack that targets devices connected to the internet, such as smart home devices, security systems, and other internet-enabled devices. The attacker floods the device with an overwhelming amount of traffic, causing it to crash or become inaccessible.

2. How does a DOS attack via IOT work?

A DOS attack via IOT usually involves infecting a large number of devices with malware, forming a network of compromised devices known as a botnet. The attacker then uses this botnet to send a massive amount of traffic to the target device, overwhelming it and causing it to crash or become unresponsive.

3. What are the boundaries of the internet in relation to DOS attacks via IOT?

The boundaries of the internet refer to the limits of the internet infrastructure, including the physical and technical limitations of devices and networks. A DOS attack via IOT can exploit these boundaries by overwhelming devices and networks with traffic, causing them to exceed their capacity and become inaccessible.

4. How can I protect my devices from a DOS attack via IOT?

To protect your devices from a DOS attack via IOT, it is important to ensure that all of your internet-enabled devices have strong and unique passwords. You should also regularly update the firmware and software on your devices and be cautious about downloading suspicious apps or clicking on unknown links.

5. Can a DOS attack via IOT be prevented?

While it may not be possible to completely prevent a DOS attack via IOT, there are measures that can be taken to reduce the risk. This includes using a strong and secure Wi-Fi network, regularly updating devices and software, and being cautious about the apps and links you interact with online. It is also important for manufacturers to implement security measures in their devices to prevent them from being easily compromised.

Similar threads

Things I Learned from Movies
    • General Discussion
Replies
1
Views
8K
BRS: PKI Cryptosystems for SA/Ms: A Tutorial
    • Special and General Relativity
Replies
13
Views
2K

Hot Threads

Recent Insights

Back
Top