How do I protect my home from IoT devices being compromised and being used for DDoS attacks?

Question

I am trying to understand the vulnerability of my home IoT devices. From what I understand, the big DDoS last year was caused by compromised IoT devices with generic or default usernames and passwords.

All my IoT devices are behind my firewall (like my thermostats - Honeywell).

They connect to the internet, but outgoing only. I have no port forwarding setup.

If all my IoT devices are behind my router's firewall, and I do not have any port forwarding to those devices, where is the risk with having default usernames and passwords?

Answer 1

The virus you've heard about is probably Mirai.

We've had a few questions recently that might be helpful to read for context, because your question covers several aspects of those:

• How can I check if my IoT devices are infected with the Mirai worm?

• Securing small home automation setup

---

In theory, if your router prevents all incoming connections, it makes it significantly harder for Mirai to get in and infect your devices. The publicly-available source code of Mirai seems to suggest that it just sends packets to as many IPs as it can, and if there's a reply, it then randomly tries the default passwords that it knows. I wrote an answer previously about that, if you're interested.

My concern would be that if Mirai did manage to enter your home network—through just one misconfigured or insecure device—it would render all of your firewalls and security useless. One of Mirai's IP ranges to check is 192.168.0.0/16 (your router's private network), so Mirai would almost certainly spread through all your vulnerable devices.

The solution to stop Mirai from being able to attack your network is simple—change every device's password from its default, and restart the device. If you do that, Mirai can't attack even if your device is accessible through the Internet (not to say it's a good idea to make things accessible if not necessary, though!).

There is a list of vulnerable devices here, or you can run Incapsula's scanner. Note that those will only check for vulnerability to Mirai—other viruses may operate differently, and following the suggestions in 'Securing small home automation setup' is probably your best bet.

Answer 2

@Aurora0001 has already addressed the big things: undoubtedly, a Mirai attack you heard of.

As he said, change your passwords off of the defaults - and not to something obvious. Here's a list of almost 60 user names and passwords that Mirai aims to hit:

666666  666666
888888  888888
admin   (none)
admin   1111
admin   1111111
admin   1234
admin   12345
admin   123456
admin   54321
admin   7ujMko0admin
admin   admin
admin   admin1234
admin   meinsm
admin   pass
admin   password
admin   smcadmin
admin1  password
administrator   1234
Administrator   admin
guest   12345
guest   guest
root    (none)
root    00000000
root    1111
root    1234
root    12345
root    123456
root    54321
root    666666
root    7ujMko0admin
root    7ujMko0vizxv
root    888888
root    admin
root    anko
root    default
root    dreambox
root    hi3518
root    ikwb
root    juantech
root    jvbzd
root    klv123
root    klv1234
root    pass
root    password
root    realtek
root    root
root    system
root    user
root    vizxv
root    xc3511
root    xmhdipc
root    zlxx.
root    Zte521
service service
supervisor  supervisor
support support
tech    tech
ubnt    ubnt
user    user

(Source)

So absolutely, change your usernames and passwords on all your devices - to something secure!

Answer 3

The problem with IoT is that oftentimes you can't or won't get an update to the device, or can't make meaningful security changes to the device. Securing your network is a lengthy discussion with tons of options. The profession is called InfoSec (Information Security). It's a burgeoning profession, or so I hear.

Steve Gibson of GRC recommends a "3 dumb router" (PDF) approach (in episode 545 of his podcast) to securing your network. if you're not an InfoSec professional or hobbyist, then you should start with this.

If you are an InfoSec professional or hobbyist, you can look into more sophisticated measures. Here's a few random ones to get you started:

1. Disable UPnP (GRC, HowToGeek, MakeUseOf)
2. Run a pfSense (or similar) firewall
3. Put the IoT devices into a separate VLAN (similar approach to 3 dumb routers)
4. Configure your pfSense box to route all your traffic through a commercial VPN (Nord VPN, PIA, pfSense). If you use a SOHO router for this, you will run into problems with more than a couple light users.
5. Configure your firewall to disallow internet access for your IoT things. Though, that might break the "I" in "IoT".
6. Use your VPN's DNS servers. (Torrentfreak 2017 version)
7. Use OpenDNS

Answer 4

1. In addition to very nice discussion above, you can be own security expert starting with nmap, flagship tool from Insecure.Org so you can perform basic scan of target device(192.168.1.1) with simple command:

   [nmap -A -T4 192.168.1.1]

   More details, examples and hints how to scan yours network could be found on Nmap Cheat Sheet pages.

2. However, scan every single IoT device in yours network and recheck every device with suspicious port/ports opened.