Internet of Things (IoT) devices can be controlled through apps and internet. We can control Xiaomi Yeelight, a light bulb that is an IoT device, by an app to change its colors and intensity of light. Similarly, cars can communicate with garage doors to open them, and by sensing the proximity of a person, a thermostat can adjust room temperature by sensing how close a person is. In nutshell, these devices can communicate with each other helping their users.

These devices are making their way to Nepal, and their popularity is gradually increasing.

IoT devices are assigned with IP addresses so that they have the ability to transfer data from one device to another over any network. But this is exactly what makes them vulnerable. A report states that over 70% of IoT devices have vulnerabilities such as Insecure Web Interface, Insecure Network services, Privacy concerns, Insecure Cloud Interface, Insecure Mobile Interface, Insecure Firmware, etc.

These vulnerabilities allow hackers and government agencies to take control of connected devices for any purpose. And given people’s dependence on IoT devices, they are slowly losing the ability to make it secure.

Brian Krebs, a reporter at Krebson Security, was a recent victim of DDoS. DDoS or Distributed Denial-Of-Service (per Urban Dictionary) is a form of an electronic attack involving multiple computers, which send repeated HTTP requests or pings to a server to load it down and make it inaccessible for a period.

That attack wasn’t just a normal DDoS attack. It was measured at 620 Gigabits per second, and Krebs said, “many orders of magnitude more traffic than is typically needed to knock most sites offline.”

What attacked Brian Krebs wasn’t just a group of hackers. It was something different. All this was done by a botnet, a different-than-other and powerful botnet. And Hundreds of thousands of devices connected to his IP address [routers, IP cameras, Digital Video Recorders (DVRs), laptops and computers, printers, etc. used for sending a huge volume of data] helped.

[Kaspersky defines botnet as: ‘an interconnected network of computers infected with malware without the user’s knowledge and controlled by cybercriminals. They’re typically used to send spam emails, transmit viruses and engage in other acts of cybercrime. Sometimes known as a zombie army, botnets are often considered one of the biggest online threats today.’]

The botnet used in this attack is “Mirai”. It can scan devices connected to the internet with default username and password. Take a Linux computer for an example. Mirai can easily login to the computer if its username and password haven’t been changed from ‘root’. Or if anyone uses an Internet Protocol camera, with username as ‘admin’ and password as ‘password’ itself, it can easily find the credentials and add the device into the botnet.

How does Mirai work?

First, Mirai scans IoT devices and then attempts to log in into these devices by using different login credentials. If it succeeds, those devices are added to the Mirai botnet. With billions of devices connected to the internet, the possibility of Mirai bypassing login credentials is significant.

Talking about Mirai, Rob Simon, a senior security consultant at Trusted Sec, said, “This is the big thing they used to create that botnet.” “There are 50 or so known types of devices, and they’re listening on telnet port 23, and they have the credentials. You just copy over the code to run on that device, it connects back to a control center, and from there it just waits for your commands. Once all connected, about 380,000 devices are connected at once. You send a command to all of them to go load a page like Brian Krebs’ and they’re generating a lot of traffic,” he added.

Consequently, once hackers take control over devices, they can be changed from sending normal amount or volume of data to and from your computer to sending an abnormal amount of data to a single place. As Technobuffalo writes, ‘Ultimately, the traffic from hundreds or thousands of these devices can exceed the throughput available to a website or a service, denying additional requests access.’

How to stay away from IoT and DDoS attacks?

There are no antivirus softwares for IoT devices.

We are really lazy when it comes to updating the software or applications in our devices. We ignore popups asking us to update firmware. When was the last time you updated the firmware of your router?

Malwares are used to include computers inside of botnets. Antivirus softwares are fighting these malwares, and Microsoft has upgraded its security in Windows 10. However, these softwares are still unable to scan malware that can our webcams. Therefore, updating firmware is really necessary.

Changing a device’s default password into something complex is a simple but an effective step. Firewalls too can be helpful.

Currently, we are witnessing an amazing progress in the field of technology but Internet of Things and Distributed Denial-Of-Service are its unanticipated consequences that show no signs of stopping. Therefore, we need to act as soon as possible before we hear the DDoS attack like the one in an episode of ‘Black Mirror’ happens in Nepal.

Ever wondered what happens to your smartphone after it reaches the end of its life cycle, is no longer usable and you dispose it? How well is e-waste managed in Nepal? Are the practices safe and hazard-free? And what the future holds for us? Gadgetbyte answers these questions that every phone user might have had at one point in time in the following article.

With newer faster phones being launched each week all over the world, people are upgrading to better devices even if their older phones has not yet reached the end of its useful period. That in turn directly means more e-waste is being generated than ever before. This is clear from the data published by EPA (Environment Protection Agency-USA) which says that 11% of the total universal electronic waste consists of mobile phone wastes.

What really happens to the various components of a phone? Almost all countries in Europe, North America and the developed part of Asia have recycling centers (e.g. www.ervifone.com, etc.) for phones. Manufacturers are also required to set up a phone disposal plant/unit that manages and salvages old phone components – similar to what Samsung is doing with its Note 7 units. Phone parts are either plastic, metal or glass. Reusable and easily salvageable plastic and metal components are segregated and melted.

As different grades of alloy metal and level of plastic types vary from one phone brand to another, it is difficult to process all sorts (brands/models) of the phone in one single recycling unit. This problem particularly shows the need for individual phone manufacturers to owe up to this responsibility and set up a channel so that old phone that they have manufactured finds its way back to them. But there is little chance of this ever happening and companies are more focused on pushing newer products into the market rather than spending operational and logistic resources on waste management. Little over than 30% of all mobile phone waste are recycled properly with the fate of the rest of the 70% still unknown.

What about the batteries then you might wonder? Well, the main challenge always is (and has been) the safe disposal of batteries. Not only do they contain carcinogen (cancer causing substances) but the harmful chemical has the potential of permanently damaging the ecosystem if not disposed or reused properly.

New devices have high powered rechargeable lithium-ion (or similar technology) batteries contain rare earth elements. These metals (nickel, cobalt, lithium-elements) have limited ores which will be used up soon if it is not handled properly. As devices are getting slimmer-bigger, this technology (battery) is being used excessively than ever before. While almost all countries have a set of Environment Protection Acts (EPAs) and rules in place to govern the safe disposal of such battery wastes, little is known or done to properly monitor the execution of battery disposals, especially in poor countries.

What happens if such metals and hazardous wastes are not disposed properly? In the case of third world countries like Nepal where the waste management system still do not segregate waste properly, an old battery or an LCD screen will end up in a landfill site; if that is it makes it to one. Lithium batteries if thrown in a landfill in a charged state, heavy equipment operating on top could crush the cases and the exposed lithium could ignite a fire. Landfill fires are difficult to extinguish and can burn for years underground. Gradually the chemicals from devices contained mercury, acids, and other active metals seep into the soil or are washed off the surface of the soil and make their way into water aquifers. The geology of land mass anywhere is such that liquid finds its way through the soil to some sort of water source- whether it be a water aquifer pocket few feet below the ground or a catchment area sooner or later.

Contaminated water source means any living organism subjected to it will develop cancer cells. An entire ecosystem of the catchment area that has a high concentration of such metals will stop yielding any life form at all. Soil will lose its ability to support growth and after a few years, the entire area will turn barren and hazardous. In the case of low concentration dosage over a long period, an entire demographic region can be affected with health issues and unsafe living conditions.

So what needs to be done? Someone that has an old phone that they need to get rid of, has no option but to sell it to a phone shop at a salvage price or just throw it off at a dumpster not knowing where it will end up. E-waste management in Nepal is something that either the government has to do at a policy making level or phone companies need to step up to stop this potential environment hazard. As an informed user, one can properly read the instruction on the battery or the phone manual and follow the instruction as to how to dispose of the battery. In the long run, managing phone waste will turn out to be a major headache if it is not properly dealt with in time.

[Content Contributor: Pratik Karki, Environmental Engineering Graduate, K.U.]