Yesterday it was reported that both TalkTalk and Post Office broadband customers have had their online access cut by an attack targeting certain types of internet routers. A spokeswoman for the Post Office told the BBC that the problem began on Sunday and had affected about 100,000 of its customers. Talk Talk also confirmed that some of its customers had been affected, and it was working on a fix. It is not yet known who is responsible for the attack. (It would also appear that local telco KCOM in Hull suffered similar problems last Saturday.)
In the light of these developments, Andy Green, a senior technical specialist at Varonis, comments: The lessons that should be learned from these ongoing Mirai attacks is just how vulnerable we were as a result of our own IT laziness. Sure, we can excuse harried consumers for treating their home routers and IoT gadgetry like toasters and other kitchen appliances – just plug it in and forget about it. So what excuse do professional IT types have for this rookie-level behaviour?
Not much! Unfortunately, default-itis still plagues large organisations. As long ago as 2014, the Verizon DBIR specifically noted that for POS-based attacks, the hackers typically scanned for public ports and then guessed for weak passwords on the PoS server or device – either ones that were never changed or were created for convenience, “admin1234”. This is exactly the technique used in the Mirai botnet attack against the IoT cameras.
Even if hackers use other methods to get inside a corporate network (phishing, most likely) they can still take advantage of internal enterprise software in which defaults accounts were never changed. For those organisations who think that the Mirai botnet incident has nothing to with them, or have to convince their board of this, here are two points to consider.
1. The lesson of the Mirai botnet attack is that the perimeter will always have leaks. For argument’s sake, even if you overlook phishing scenarios, there will continue to be vulnerabilities and holes in routers, network devices, and other core infrastructure that allow hackers to get inside.
2. Human nature tells us that IT will also continue to experience default-itis. Enterprise software is complicated. IT is often under pressure to quickly get apps and systems to work. As a result, default accounts and weak passwords that were set for reasons of convenience – thinking that users will change the passwords later – will always be an issue for organisations.
You have to plan for attackers breaching the first line of defences, and therefore have in place security controls to monitor and detect intruders. In a way, we should be thankful for the “script kiddies” who launched the Mirai botnet DDoS attack: it’s a great lesson for showing that companies should be looking inward, not at the perimeter, in planning their data security and risk mitigation programs.
Charles Christian was an English barrister, Reuters correspondent-turned editor, author, blogger, podcaster, award-winning tech journalist, storyteller, and sometime werewolf hunter, who sadly passed away in 2022.
Prior to his sudden death he completed one of his largest works to date: The Witches Almanac, the definitive guide on the history of magic and folklore, including 359 of the most important witches and sorcerers in history.
This site also has links to Charles' books and the Weird Tales Show videos and podcasts.
Latest Video Post
Latest book: The Wold Newton Triangle
Virtual Tip Jar
You can now support Urban Fantasist, its podcasts and its new video channel through our Virtual Tip Jars on PayPal and Patreon, giving you a choice of ad hoc or regular payments.
Tel: +44(0)1986 788666
Tel/Txt: +44(0)7786 738172
WhatsApp etc: +44(0)7786 738172
"The only way to keep folklore alive is to share it" ...comment from viewer on YouTube channel
"Charles Christian... a man of paranormality" ...Howard Hughes, Talk Radio UK
"Cynicism has always been a part of your (very impressive) brand" ...Kirk Fackre
"Your storytelling set the scene for a fascinating evening of stunning music and terrifying drama" ...Chris Caswell
"I can't help myself. Yesterday, I went back to this post over and over again and it made me laugh out loud each time. So now I'm bringing it to all my followers with the recommendation to follow Charles Christian because he posts lots of stuff that brightens my day and will brighten yours, too" ...LinkedIn commentator
"A great witty intelligence in the world. We need more CC and less monkey-brained politicians" ...Julia Bohanna
"I love your posts, always something interesting to read and often funny" ...Karen Morton
"I was saddened to see you have retired your podcast. I never would have found your books without it. Well if a good story deserves rereading a good podcast demands relistening. Looking forward to your next stage with the time this change will afford you. Happy Trails, Pardner" ...Jonathan Neuhaus
"You are a great and generous host" ...Patti Negri, The Hollywood Psychic
"I host a daily morning show in Las Vegas and I like your shows very much. I love the way you pace your voice and thoughts is fantastic and you have a way of making your guest interviews sound more like conversations. Just wanted to let you know" ...Clay Baker
"The ever wonderful Charles Christian and his Weird Tales Show"...Into The Portal Podcast
"The Master of Mysteries & Folklore" ...Fantasy Radio UK
"The witty and knowledgeable Charles Christian."
"We poled our fans on their favorite podcasts and that's how I heard of Weird Tales Show. You are well loved by the geekiverse, and fans of folklore history and monsters!"
"Charles Christian is really out there cool."
"Charles Christian defiantly makes my world a brighter, funnier place."
"The legendary Charles Christian at his eclectic best..."
"Charles Christian is my inner spirit animal, thank you for making me laugh."
"You always make me laugh! Thank you for brightening my day with your dark humour."
"the funny, wonderful and slightly cantankerous Charles Christian"
Charles Christian's Books