In the first documented attack of its kind, the Internet of Things has been used as part of an attack that sent out over 750,000 spam emails.
With the rise of the Internet of Things comes a lot of convenience, such as smart fridges that let you access the internet and call for service in the case of malfunction, or devices that can monitor your energy usage and send you Twitter updates.
It also comes with a new problem: many of these internet-connected devices don't have malware protection. And it's now been documented that someone is taking advantage. Security company Proofpoint has discovered a botnet attack -- that is, a cyber attack whereby the attacker hijacks devices remotely to send spam -- incorporating over 100,000 devices between 23 December and 6 January, including routers, multimedia centres, televisions and at least one refrigerator.
The attack sent out over 750,000 spam emails, in bursts of 100,000 emails at a time, three times a day, with no more than 10 emails sent from any one IP address, making them difficult to block. Over 25 per cent of the emails were sent from devices that weren't conventional computers or mobile devices. It is the first documented case of common appliances being used in a cyber attack -- but that doesn't necessarily mean it was the first time it occurred, and it certainly won't be the last.
Most of the devices, Proofpoint found, weren't subject to a sophisticated attack. Instead, misconfiguration and the use of default passwords had left them open on public networks and therefore vulnerable to this kind of attack.
"Botnets are already a major security concern and the emergence of thingbots may make the situation much worse," said Proofpoint's David Knight. "Many of these devices are poorly protected at best and consumers have virtually no way to detect or fix infections when they do occur. Enterprises may find distributed attacks increasing as more and more of these devices come online and attackers find additional ways to exploit them."
With the International Data Corporation predicting that over 200 million devices will be connected to the internet by the year 2020, this could prove to be a significant problem, particularly since they are not routinely monitored for malicious activity.
