Avast Blog_Security News: When big fish get caught with big bait

[harlan4096]

23.2 million potential attacks target 500 fake IoT-like devices deployed at Mobile World Congress.

On Sunday 24th February, the eve of Mobile World Congress 2019, Avast security researchers Martin Hron, Vladislav Iliushin, Libor Bakajsa, and Anna Shirokova set a project in motion: the deployment of 500 honeypots in 10 countries around the world that would run for the length of the show (four days), and beyond. The idea was to capture the number of attempted connections that potential attackers made to these honeypots in the hope that valuable data might be lurking within. The honeypots, akin to mousetraps on the internet, were purposely set up with open ports typically found in internet-connected devices to trick the attackers who scanned them into thinking they were connecting to routers, smart TVs, security cameras, or other smart appliances. The findings were better (or worse) than they expected.

As MWC drew to a close at around 4pm on Thursday, February 28th, 23.2 million attempts to connect to these honeypots were recorded by the team. In other words, among 500 fake IoT-like devices installed on the internet, 23.2 million potential attacks were performed by possible cybercriminals. That’s 11,588 attempts to connect per device per day. The three ports that were scanned most often were those usually found in Chromecast streaming devices and Google Smart Home Speakers (port 8088), Telnet port 22 and SSH port 23 that are often present in routers. This is not particularly surprising. Streaming devices are among the most widespread and vulnerable smart devices in the home, according to our latest research. Router security is also cause for concern. Of 11 million routers scanned by Avast in September 2018, 60% either had weak credentials or software vulnerabilities.

So, where did these potential attacks to our honeypots come from and who were the targets? From our data, the top three most “attacked” countries were Ireland, Germany, and the United States (details in the chart below) while the three most aggressive countries in terms of scans performed were the United States, China and France.

Continue Reading