The reason DDoS attacks keep getting larger is sitting in living rooms and server racks all over the world. Consumer IoT — cameras, routers, DVRs, smart plugs — ships with a security model that is, bluntly, broken: default credentials, firmware with known holes, no reliable update path, and a design that prioritises easy setup over safety. The result is a standing population of billions of always-on, internet-facing devices that an attacker can recruit into a botnet within minutes of finding them.
How a Device Gets Recruited
- Credential scanning: attackers sweep the internet with tools like masscan or zmap for devices exposing Telnet or SSH, then try default logins.
- Exploit scanning: post-Mirai botnets use N-day CVEs — known bugs in specific firmware versions — to take devices that changed their password but never patched.
- Malware drop: once in, a small binary is fetched and the device checks in with a command-and-control server.
- Silent persistence: the device keeps working normally, so the owner has no idea it is now part of an attack army.
What Modern IoT Botnets Can Do
- Multi-vector attacks: Mirai descendants launch SYN, ACK, UDP, HTTP-flood and GRE-tunnelled attacks on command.
- Sheer scale: hundreds of thousands of bots at 100 Mbps each add up to tens of terabits.
- Geographic spread that makes source-based blocking futile — the traffic comes from everywhere at once.
- Constant churn: infected devices reboot (clearing the malware) and get reinfected, so the botnet cycles nodes continuously.
The owner is a victim too
The person whose camera is attacking a bank did nothing wrong beyond plugging in a cheap device. This is why source-IP blocking is both ineffective and unfair — the addresses in the flood belong to innocent people, not the attacker.
What You Can Do as a Device Owner
- Change default credentials on every device immediately — this alone defeats the oldest and most common recruitment method.
- Enable automatic firmware updates wherever the device supports them.
- Put IoT devices on a separate VLAN with no direct inbound internet access.
- If your router's admin panel is reachable from the WAN side, close it now.
What It Means for the Servers Under Attack
For the target, the takeaway is that you cannot block your way out of an IoT botnet by banning addresses — there are too many, they are innocent, and they cycle constantly. The defence is behavioural and upstream: filter the traffic by how it behaves, not where it comes from. Akarguard's reverse-proxy edge does exactly that for the application-layer portion — challenges that automated clients cannot pass, per-IP and per-ASN rate limits, and a hidden origin so the botnet has no direct target — while raw volumetric floods are absorbed upstream at the network. You do not identify the botnet; you make its traffic fail the moment it tries to act like an attack.