Cyber Security

Experiment Reveals Just How Fast Hackers Strike

"We expected the first attack to come two days later", writes Atlantic reporter Andrew McGill. Things actually went much quicker.

22 Nov. 2016 Andreas Weck

How a Virtual Toaster became a Target for Hackers

The Internet of Things presents tempting targets for hackers (illustration: The Atlantic)

The net can be a dangerous place. Hackers, bots and viruses can turn our internet-ready devices into zombies. Just this past month a huge Denial-of-Service attack brought down access to various services such as Twitter, Airbnb and Github for hours. It is suspected that some 50,000 remotely controlled devices were involved in the attack. Atlantic reporter Andrew McGill recently performed an experiment to show just how quickly hackers attack machines.

He created a honeypot, a fake device intended to lure in hackers, and waited to see who would seize control of it. The method is standard procedure for securing networks. All actions by attackers were recorded to help make the network more resistant. McGill rented a virtual Amazon server, configured it to claim it was an internet-ready toaster and opened a port frequently used by hackers to attack devices. The plan worked. The 'toaster' was found and attacked.

McGill was expecting as much. What surprised him was how fast the device became a target. "I switched on the server at 1:12 p.m. Wednesday, fully expecting to wait days—or weeks—to see a hack attempt. Wrong! The first one came at 1:53 p.m.", the journalist wrote in his report . Further attacks followed at 2:07 p.m., 2:10 p.m., 2:40 p.m. and so on. By 11:59 p.m. over 300 attacks had been registered.

It was fascinating to see how the attackers progressed. Many hackers used the password "xc3511," – one that until recently was a common factory password for web cams. Anyone clicking on his article can see live statistics on when the last attack occurred and the user name and password that were attempted. The journalist made clear however that the attacks are not being conducted by humans at a keyboard but rather by bots programmed to automatically run through a series of access codes.

Security Internet of Things CEBIT RSS Feed