(This article is also featured at “IoT for All“)
Without a single shadow of a doubt, the reemergence of the notorious Mirai botnet in the IoT infrastructure presents some grave challenges for security developers as well as force us to reflect on the state of security of IoT in 2019.
While such unethical malware attacks are now widely regarded as the online version of real-life crimes, and the cybercriminals as the counterparts of their real-life partners, the scope and target of these types of attacks makes them either noticeable or unnoticeable.
In the case of Mirai botnet, the 2016-founded malware program has been continuously successful in grabbing the attention of the IoT world, and more lately, the enterprise IoT sector which altogether makes it a huge concern for IT firms. So, with such kind of recurring Mirai malware attacks in IoT infrastructure – even in 2019 – where does the state of security in IoT stand now?
This research on IoT Device Management Software Market & Emerging Trends 2019 – 2025 is a must-have for all IoT/M2M companies.
Before More, A Little Bit on Mirai & Its Turbulent Relationship with IoT
Mirai malware was written by three programmers: Paras Jha, Dalton Norman, and Josiah White. It was first discovered in 2016 by a malware research group called MalwareMustDie. In the same year, Mirai malware became a globally recognized threat when it accumulated one of the worst and most massive DDoS (denial-of-service) attacks in history; Mirai closed down a pivotal U.S. dynamic host service providing company which triggered a widespread internet outage in the USA and Europe.
Again in 2016, Mirai returned with an impactful attack on a renowned American security journalist Brian Krebs “Krebs on Security” blog site. It locked down the entire website for almost four days and costing the owners around $323, 000. Now, despite being arrested and sentenced by a U.S. Court, the authors did manage to make the source code public on a hacking forum online, and this actually triggered the creation of numerous Mirai botnet types since 2016. However, the thing which is worrisome about all those developed Mirai malware variants is this: their target was mostly consumer-level IoT devices, but recorded a serious shift towards enterprise IoT sector from 2017 and all the way into 2019.
So, the question might be lurking in the corridors of our reader’s mind: Why Mirai has mostly been targeting the IoT industry, let alone a shift towards enterprise IoT? And what an IoT service provider can possibly do to keep this online viral plague away from its IoT ecosystem? Well, to answer the first question, the growing adoption and rise of IoT technology make it an obvious target of such notorious online malware like Mirai.
The answer to the second question is not so straight forward, but simple to understand theoretically: Keep your IoT network, and every device on it, tightly encrypted with modern IoT-specific encryption techniques. This statement leads us to the second immediate concern of this narrative; what security standards are there in IoT technology in 2019 to combat severe malware and virus attacks online? Let shed a bit of light on this.
Nearly 1.35 million people die in road crashes each year, on average 3,287 deaths a day, says WHO. We can increase road safety by managing traffic with smart IoT solutions.
The State of IoT Security in 2019
Despite great advancements and breakthrough over the last decade or so, it is quite unfortunate (shameful) to admit that the problem of ideal security architecture and standards are still largely missing for the thriving IoT sector. According to the words of Joe Weiss, a consultant with Applied Control Solution and the Managing Director of ISA99:
“It’s 2019! How can we be in this place? We haven’t made much progress with security at all. We’ve made lots of progress monitoring the networks and almost nothing about what we were supposed to do in the first place.”
This statement cannot be termed as an exaggeration, and there are good reasons to say so. For instance, a sensor is one of the most widely used/deployed forms of IoT hardware. Many manufacturers globally are using cheap and low-capability processors for IoT hardware that are not capable enough to sustain additional load forced by latest encryption techniques; thus, resulting in a dangerous lack of security for an IoT ecosystem of devices. If we see this lack of concern for security in a multitude of billions and trillions of deployed IoT devices, we sure have a delicious meal ready for the hungry wild pack of viruses and malware online to strike.
The reason for this, according to Paul Bevan – Research Director of IT Infrastructure at Bloor Research – is the cost. He says that to keep the costs down and profits higher, companies that are creating small-scale IoT sensors are not using adequate hardware components and benchmarking to accommodate powerful security encryption requirements. Obviously, this has to be changed or else we will have a gigantic area of the internet, specifically the enterprise sector, which is completely open for bad players online to play their games at their own will.
Although, Transaction Processing Performance (TPC) has given a universal benchmarking standard for all kinds of IoT gateways evaluation, still the need for a succinct and truly overall undeniable pack of security standards for IoT network and devices is a must. If we take a close look at how Mirai malware successfully breaches the IoT device’ integrity, we can easily find out that we are lacking effective security protocols at the core levels.
For example, a Mirai malware works on the “command injection attack” format. A Command Injection Attack uses unsafe accessing credentials in various forms such as cookies, forms, HTTP protocol, and etc., to enter and manipulate an operating system’s “Shell” file. It then manipulates the entire OS central command directive and implements/executes attacker-supplied commends in the system. These kinds of attacks are only possible when there is an insufficient or incapable validation process existing in a system. In our case, this can be an IoT ecosystem or an IoT network.
So, if we do not build hardware/software powerful and capable enough to self-evaluate, validate, and implement complex encryptions for the command-level operating system, the data breach in the form of Mirai attack or any other else is inevitable. Considering the seriousness such a situation can create, and the current state of security in the rapidly growing IoT sector, it is about time that the “think tank” in the IoT world should sit down and join their heads to bring about an innovative and novel approach in order to combat any threats seeking to annihilate the growing IoT sector. Once we can be proud of our security standards in IoT, nothing can stop us from reaping the remarkable benefits this amazing technology has to offer, both to commercial and private users for good.