Botnet of lamps and vending machines slowed down university network

A US university network experienced serious bandwidth problems as more than 5,000 infected systems performed DNS lookups. The university turned out to have connected IoT devices such as lamps and drink vending machines to the network.

The botnet came to light after reports from students that the university network was slow and sometimes inaccessible. The IT Security Team of the unnamed university noted an increased amount of DNS lookups and, in addition, the logs contained a striking number of subdomains related to fish dishes.

An analysis of the firewall logs showed that more than 5,000 systems performed DNS lookups every 15 minutes. Nearly a hundred domains and four of the fifteen IP addresses that emerged from the logs turned out to be on an indicator list for emerging Internet-of-things bot networks. The malware for this botnet managed to crack the weak client default passwords and replace them with its own variant.

The system administrators of the university network managed to intercept this password and regain control of the iot devices. They describe the incident in a pre-publication of Verizon Enterprise’s 2017 Data Breach Digest. The Verizon RISK Team helped the university disable the botnet.