Testing for vulnerable IoT devices

Brian Krebs has lately been writing a lot about DVRs and cameras made by XiongMai Technologies. He reports that they are terribly insecure and many have been hacked and herded into botnets where they participate in Distributed Denial of Service (DDoS) attacks such as the one that brought down his site.

Poor security is standard practice with IoT, but these devices are especially bad. Even if their web interface is used to change the default password, the devices have hard coded Telnet and SSH passwords that can not be changed. 

Part of yesterdays DDoS attack against DYN came from the Mirai botnet, composed of assorted hacked devices that were using default passwords.

To read this article in full or to leave a comment, please click here