These attacks point to the pervasiveness of these devices, which are projected to be over 7 billion by the end of this year.  As these scans indicate, there has been little attempt to secure these devices, let alone change the default password—despite a large number of high profile denial of service attacks and worryingsecurity vulnerabilities. As has been pointed out by many experts, changing the default password on these devices can often prevent them from being infected by malicious software.

 

How can you ensure that you can quickly identify these devices on your networks?   There are two possibilities. A passive solution relies on constant examination of traffic in and out of your networks using software such as the Bro IDS.  The downside to this technique is that Bro will only detect insecure devices once they have been compromised.  An active solution relies on scanning all parts of your network and testing whether the devices are actually vulnerable. SSH-auditor is an example of software that can do this efficiently and can be found at NCSA’s github repository collection.  Seeding this software with the most common user/password combinations and scheduling frequent scans of your network can very quickly identify vulnerable devices.