keep moving

Cybersecurity expert Bruce Schneier’s take and warning of the current state of the Internet, particularly IoT. While he is coming from a neutral position, some fear that people with agenda will use this to create regulations that restrict freedom and make the current situation worse.

As the chairman pointed out, there are now computers in everything. But I want to suggest another way of thinking about it in that everything is now a computer: This is not a phone. It’s a computer that makes phone calls. A refrigerator is a computer that keeps things cold. ATM machine is a computer with money inside. Your car is not a mechanical device with a computer. It’s a computer with four wheels and an engine… And this is the Internet of Things, and this is what caused the DDoS attack we’re talking about.

Source: Bruce Schneier: ‘The internet era of fun and games is over’

The IoT botnet is gaining both speed as well as volume. A security researcher had a CCTV hacked within minutes of setup. The worm was also smart enough to close the loophole to prevent other worms from infecting it.

Survival skills in the modern digital world. Someone should turn this into a mandatory course in school.

Tips, Tools and How-tos for Safer Online Communications

Source: Surveillance Self-Defense

IoT is increasingly becoming a dirty word for botnet.

Researchers have found ways to hijack a specific type of IoT device – the popular Philips Hue lamp – via ZigBee to do what they want, and make the attack spread wirelessly.

The worm spreads by jumping directly from one lamp to its neighbors, using only their built-in ZigBee wireless connectivity and their physical proximity. The attack can start by plugging in a single infected bulb anywhere in the city, and then catastrophically spread everywhere within minutes, enabling the attacker to turn all the city lights on or off, permanently brick them, or exploit them in a massive DDOS attack.

– IoT Goes Nuclear: Creating a ZigBee Chain Reaction

This is serious. Dubbed “Dirty Cow“, there are already exploit kits out there for Android and possibly others.

Lurking in the kernel for nine years, flaw gives untrusted users unfettered root access.

Source: “Most serious” Linux privilege-escalation bug ever is under active exploit (updated)

A massive DDoS attack on key DNS infrastructure happened last Friday. It appears that one of Singapore’s telco – Starhub – was also under attacked on Saturday and Monday. There was no further information whether it is from the same attackers or whether it was a copycat attack.

The company said it analysed network logs of the disruptions and found that it had experienced intentional and likely malicious distributed denial-of-service (DDoS) attacks on its domain name servers (DNS).

Source: UPDATE 1-Singapore telco StarHub says hit by cyber attacks | Reuters

Well, it didn’t take long to up the ante.
Major websites were down for a period of time due to DDoS attack. This time featuring tens of millions of IoT devices.