One of the world’s leading antivirus companies, Kaspersky has revealed that 105 million smart devices were attacked in the first six months of 2019. The company’s honeypots noted that this figure is around nine times more than the number found in H1 2018 when only around 12 million attacks were spotted originating from 69,000 IP addresses
The attacks, according to Kaspersky are mainly on IoT devices coming from 276,000 unique IP addresses that are capitalising on weak security of IoT products, where cybercriminals are intensifying their attempts to create and monetise IoT botnets.
“Cyberattacks on IoT devices are booming, as even though more and more people and organisations are purchasing ‘smart’ network-connected and interactive devices, such as routers or DVR security cameras, not everybody considers them worth protecting,” said Dan Demeter, a security researcher at Kaspersky.
He stated that Cybercriminals, however, are seeing more and more financial opportunities in exploiting such gadgets. They use networks of infected smart devices to conduct DDoS attacks or as a proxy for other types of malicious actions. To learn more about how such attacks work and how to prevent them, Kaspersky experts set up honeypots – decoy devices used to attract the attention of cybercriminals and analyse their activities.
Based on data analysis collected from honeypots, attacks on IoT devices are usually not sophisticated, but stealth-like, as users might not even notice their devices are being exploited. The malware family behind 39% of attacks – Mirai – is capable of using exploits, meaning that these botnets can slip through old, unpatched vulnerabilities to the device and control it. Another technique is password brute-forcing, which is the chosen method of the second most widespread malware family in the list – Nyadrop. Nyadrop was seen in 38.57% of attacks and often serves as a Mirai downloader. This family has been trending as one of the most active threats for a couple of years now.
In addition, the researchers were able to locate the regions that became sources of infection most often in H1 2019. These are China, with 30% of all attacks taking place in this country, Brazil saw 19% and this is followed by Egypt (12%). A year ago, in H1 2018 the situation was different, with Brazil leading with 28%, China being second with 14% and Japan following with 11%.