IoT Botnet Attacks Own Network

The attack caused widespread connectivity issues for many students. The devices responsible for causing the demand in traffic comprised of vending machines and campus lampposts, amongst other devices.

Root cause was discovered to be an external threat comprised of malware. However, the infrastructure configuration allowed the malware to infect over five thousand IoT devices belonging to the university.

Once the malware successfully compromised a device, it would attempt to brute force administrator credentials to gain control of it. The password would then be changed, blocking the university from accessing their own device and preventing them from being able to shut it down.

The affected devices were then used to carry out DNS lookups every fifteen minutes and with five thousand + devices doing this in unison, the network suffered widespread performance issues throughout the campus.

This highlights how certain devices, especially IoT devices can be overlooked during a security assessment and also how these devices can be used for malicious purposes.