Lizard Squad uses CCTVs to launch DDoS attacks against websites

Did you know that a security camera can be used to take down websites? Arbor Networks, a cyber-security firm has discovered that the infamous Lizard Squad collective has been using compromised IoT devices, including CCTVs, to launch DDOS attacks against websites and take them down. Lizard Squad have been around since 2014 and have primarily been known to target gaming services, particularly the PlayStation Network and Xbox Live. They’ve also claimed to be responsible for shutting down the entirety of North Korea’s internet for a day. Arbor Networks reports that Lizard Squad’s LizardStresser program—its source code is freely available by the way—has been taking over thousands of CCTVs, and possibly other IoT devices, to generate DDoS attacks exceeding 400Gbps in bandwidth. DDoS attacks are Distributed Denial of Service attacks that, in layman’s terms, flood a website or server with so much traffic that it gets overwhelmed. It’s a “distributed” attack in that the traffic comes from thousands of sources, making it difficult for any security software to reliably block it. Using CCTVs to generate DDoS attacks might seem strange, but most CCTVs and IoT devices are essentially stripped down, low-power PCs that are connected to the internet. These devices usually have full access to the internet and run stripped-down Linux operating systems, which won’t have full security features. To make matters worse, most IoT devices use shared hardware and software to minimize costs and installation complexity. Passwords are also shared “amongst entire classes of devces,” making them much easier to compromise. By themselves, these IoT devices aren’t very powerful, but LizardStresser takes over thousands of these devices to make for a more potent attack platform. If nothing else, Lizard Squad’s nefarious activities have highlighted the importance of security on the IoT platform.