Chinese electronics company, Hangzhou Xiongmai has recalled its home webcams in the US which were hijacked last week in the massive distributed denial-of-service attack which had knocked down popular websites such as Twitter, Spotify, Reddit, SoundCloud, PayPal, Netflix, Amazon, Github and several others for many users across the East coast for two hours.
All the firms are customers of a web technology provider called Dynamic Network Services Inc. or commonly known as Dyn, which they use to help users find their sites online.
Some security researchers, including security firm Flashpoint, blamed the attack on Xiongmai’s lagging security practices and use of a default username and password in its software and camera components which allowed criminals to create a large botnet or network of botnets. However, Xiongmai denied the statement, saying that its webcams didn’t make up the majority of the devices in the botnet.
It appears likely that IoT hardware from a large number of different manufacturers were involved. Still, Xiongmai has instituted a recall for webcams that use its circuit board and other components, which represents a sizeable number of devices.
The web attack enrolled thousands of devices that make up the internet of things - smart devices used to oversee homes and which can be controlled remotely.
The attack was also a result of users not changing their default passwords which is very common for people not to alter their default login credentials on these devices.
The DDoS attack relied on a malware called Mirai to compromise connected devices. Mirai’s source code was publicly released earlier this month, which researchers said would lead to higher profile attacks. So far, Mirai has infected at least 493,000 devices. Before the source code was released, only 213,000 devices had been compromised.
