It’s rare that hackers give you a gift, but last week that’s exactly what happened. Brian Krebs is one of the foremost security experts in the industry, and his well known web site krebsonsecurity.com was brought down due to a distributed denial of service (DDoS) attack. Attackers made use of what is said to be the largest botnet ever to attack Akamai, Kreb’s content service provider.
Why would one consider this a gift? First of all, nobody was hurt. This attack took down a web site that is not critical to anyone’s survival, not even Krebs’, and the web site was rehomed and back online in a very short period of time.
Second, the attackers revealed at least some of their capabilities by lighting up the network of hacked devices for researchers to examine and eventually take town. One aspect of this attack is the use of “IoT” devices, or non-general purpose computers that are used to control some other function. According to Krebs, the attacks made use of thermostats, web cameras, digital video recorders (DVRs) and, yes, Internet routers. The attacks themselves created an HTTP connection to the web site, retrieved a page, and closed. That’s a resource intensive attack from the defense standpoint.
Let’s ask this question: why would any of 
those systems normally talk to anything other than a small number of cloud services that are intended to support them? This is what Manufacturer Usage Descriptions (MUD) is meant to defend against. MUD works by providing a formal language and mechanism for manufacturers to specify which systems a device is designed to connect with. The converse, therefore, is that the network can prevent the device from both being attacked and attacking others. The key to all of this are manufacturer and their willingness to describe these devices. The evolving technical details of MUD can be found in an Internet Draft, and you can create a test MUD file against that draft by using MUD File Maker. I’ll go into more detail about MUD File Maker in a later post.
Would MUD eliminate all attacks? No, but MUD adds an additional helpful layer of protection to those manufacturers and networks should use.
This time it was a blog that was taken down. We are in a position to reduce attacks the next time, when they may be more serious. That’s the gift hackers gave us this time. Now we just need to act.