There are millions of “smart,” connected devices that comprise the Internet of Things (IoT), ranging from mobile phones to computers, home thermostats, video surveillance cameras and coffeemakers. The analyst firm Gartner recently forecast that 4 billion connected things will be in use in the consumer sector in 2016, and will reach 13.5 billion in 2020.

The Internet of Things comes with advantages, as well as a host of security disadvantages. To begin with, IoT devices often do not have strong security features built into them to prevent hackers from accessing them. Aside from personal privacy and security concerns that result from these security gaps, the bigger danger is that these connected devices can be harnessed by hackers to form a botnet, which is an interconnected network of computers infected with malware without the user’s knowledge. Botnets are also known as “zombie armies” that can be deployed on thousands—if not millions—of connected devices to send a spam attack, spread malware or launch a distributed denial of service (DDoS) attack. The more Internet-connected devices there are, the greater the potential for extremely large botnets.

Many manufacturers are undoubtedly improving the security of their IoT devices, but even if manufacturers tried to keep up with the latest security best practices, hackers would probably find a security gap or figure out a work-around. In particular, DDoS attacks are common because it’s so easy to purchase and launch a DDoS toolkit. In a recent Information Age article, “Should we be afraid of big bad botnets?” Corero COO Dave Larson writes:

“A quick Google search and a PayPal account makes botnets readily available for just a few dozen dollars, with no coding experience necessary. And they are becoming increasingly popular – DDoS-for-hire botnets are now estimated to be behind as many as 40% of all network layer attacks.”

The ultimate goal of a DDoS hacker who hacks into an IoT device is not to interfere with consumer heating systems or interrupt their morning coffee ritual; rather, the goal is to harness thousands of devices to turn them into a zombie army. A DDoS attack can be large enough to bring even an otherwise “secure” corporate network to its knees, or it can be small—barely noticeable “white noise” that escapes human detection yet infiltrates and maps networks in a matter of seconds. Both are dangerous.

Larson continues:

“Looking forward, there is really no limit to the potential size and scale of future botnet-driven DDoS attacks, particularly when they harness the full range of smart devices incorporated into the Internet of Things. By using amplification techniques on the millions of very high bandwidth density devices currently accessible, such as baby video monitors and security cameras, DDoS attacks are set to become even more colossal in scale.”

It is difficult to prevent IoT devices from being recruited into a botnet, but organizations can certainly protect their networks by deploying an in-line, real-time, automated solution at the network edge, to detect and eliminate the threats from entering a network. Botnet DDoS attacks cannot be traced to their origins, so the best approach is a defensive one; build a SmartWall Threat Defense System to protect your network.

You can read the original article here.