Cyber Round Up: Double-Dip Internet of Things botnet attack felt across the internet; Cyberattacks disrupts Access to Facebook, Twitter, Netflix; WikiLeaks claims its supporters are behind the massive DDoS cyberattack

• Double-Dip Internet of Things (IoT) botnet attack felt across the internet (ARSTechnica): In this article, Sean Gallagher states that distributed denial of service (DDoS) attacks against dynamic domain name service provider (DDNS) Dyn have been occurring for the past couple of days.  According to the article, part of this attack seems to have arisen from the code for the Marai botnet that was released earlier this month.  Apparently, the Marai botnet code had been used to leverage IoT devices in order to help launch this DDoS attack, according to the article.  This raises some serious concerns for IoT devices which often lack robust security as interoperability and ease-of-use are some of the primary market factors in adoption of IoT devices.  This will be an area to watch, no pun intended. The full text of the article can be found here.
• Cyberattacks disrupt access to Facebook, Twitter, Netflix (ABC7News): Some of the direct effects of the DDoS attack described above were that users were unable to properly resolve the IP addresses of Twitter, Facebook, and Netflix (among others, of course), according to this report.  The article quotes Intel Security Chief Technology Officer Steve Grobman as saying “… anything that’s smart and connected that has vulnerability or a weakness could be compromised and then become part of the attack.”
• WikiLeaks claims its supporters are behind the massive DDoS cyberattack (WA Today): according to the article, the massive DDoS attack which mainly affected US and European users was claimed to have been conducted by supporters of WikiLeaks.  This apparently came on the heels of remarks by Ms. Clinton that the email hacks and dumps of data filtered through WikiLeaks was undermining the US election process, according to the article.  The article indicates that WikiLeaks later tweeted that “Mr. Assange is still alive and WikiLeaks is still publishing. We ask supporters to stop taking down the US internet.  You proved your point.”  Apparently the latest email hack and dump which revealed the contents of some of Clinton’s Wall Street speeches precipitated the Ecuadorian government’s disruption of internet services at the London embassy where Assange is rumored to be hiding, according to the article.  The full text of the article is here.

Opinion: So all of these IoT devices which are exploding in worldwide adoption and have weak or nonexistent security controls (think the security through obscurity model) are now being used to wreak havoc on our daily lives?   Yet another reason why security needs to be baked in, not an afterthought and why a rush to market and ease of use are foolish reasons to flood the marketplace with products.  It will be interesting to see how the cost models hold up once liability begins to attach to manufacturers that put IoT devices in the marketplace knowing full well that they lacked even the most rudimentary accoutrement of security features. See the post: Input to the Commission on Enhancing National Cybersecurity, for a discussion of taking a “baked-in” approach to security with IoT devices.