On October 21, 2016, many of the world’s most popular websites were incapacitated by a series of distributed denial of service (DDoS) attacks. Users trying to blast off a tweet or listen to their favorite track on Spotify suddenly found themselves stranded on 404-error pages or stalled by perpetual “loading” messages on their browser. The culprit? Massive denial of service attacks overwhelming servers and cutting off access. While DDoS attacks are actually quite commonplace (though not always as widespread), this time the method of was a little different. Rather than travel along traditional online pathways, the attackers commandeered all manner of unsecured Wi-Fi-enabled devices to turn the internet of things into a battering ram. By exploiting the security vulnerabilities of connected gadgets, from fridges to DVRs, the latest attack highlighted the smart home’s Achilles heel. Major DNS host Dyn told CNBC in October the attack was “well planned and executed, coming from tens of millions of IP addresses at the same time.” Taking Down Twitter Why are DDoS attacks so effective? It starts the how Domain Name Services (DNS) work. The DNS operates in many ways like a traffic controller at a busy intersection. When users click a link to a webpage, the DNS directs that user to twitter. During a DDoS attack, the webpage itself is left unscathed, but all the roads leading to it are jammed with service requests in something akin to rush hour traffic. In effect, users are left stranded on the service highway, their destination in sight but with no means to get there. As security expert Bruce Schneier explained in a recent blog post, “Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet.” “These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down.” Assessing the Damage The October 21 attack incapacitated DNS providers across the US and Europe. Almost no type of website was spared, from consumer products to real estate listings to news sites. Pinterest, Zillow, Kayak, the New York Times…all found themselves cut off from users as the DDoS ambush spread across the western hemisphere. The entire event lasted for hours, and while the damage hasn’t been fully assessed, the greatest fear is what this level of infiltration means for the future of the internet. This is because the October attack significantly differed from previous incursions by groups like hacker collective Anonymous. In the past, perhaps one individual website was incapacitated for a short amount of time, like CNN. In this case, the DDoS attack was massive, taking out “a major piece of the internet backbone for the entire morning – not once, but twice.” “This event was not your conventional DDoS attack, writes Gizmodo’s William Turton. “ Instead, it seems to be the first large-scale attack using IoT devices.” “Because of the estimated billions of available unsecured IoT devices,” he continues, “these attacks could allow for an unprecedented amount of DDoS power—enough power to take down major pieces of internet infrastructure protected by some of the best DDoS mitigation in the business. That’s exactly what we saw on [October 21].” A New Era of Threats Assessing the aftermath of the October attack, Gizmodo writer Turton warns of a bleak future full of political conspiracies and foreign hackers waging online war against their adversaries. “Details of the how the attack happened remain vague,” writes Turton, “but one thing seems certain. Our internet is frightfully fragile in the face of increasingly sophisticated hacks.” “This could be the beginning of a very bleak future,” he concludes. “If hackers are able to take down the internet at will, what happens next?” Unfortunately, it’s the smart devices intended to make our lives easier that may pose the biggest threat. A new report by Akamai,...

These days, traditional passwords are suspect in their ability to handle the safety of our valuable online data. This isn’t a new problem.  Nearly a decade ago, in 2004, Bill Gates was predicting the demise of the alpha-numeric password, calling it a weak spot in security and identity authentication. He was one of the first to propose moving security onto smartcards and biometrics. With few exceptions, most programs, websites and protected databases are still using the standard-issue username/password combination for access. But with recent high-profile hackings like that of Wired tech writer Mat Honen last summer, the issue of changing password technology is a hot one again. So what are the current options? Behavior based gestures The government’s Defense Advanced Research Projects Agency (DARPA) is on the lookout for other forms of authentication based on behaviors, like the way people type or make other hand gestures. Security researchers are investigating the way people are using their machines so that their identity can be verified at all times: “for example, how the user handles the mouse and how the user crafts written language in an e-mail or document” they say on their website. DARPA’s program manager Richard Guidorizzi explains what makes this method different from the current password format: “My house key will get you into my house, but the dog in my living room knows you’re not me. No amount of holding up my key and saying you’re me is going to convince my dog you’re who you say you are. My dog knows you don’t look like me, smell like me or act like me. What we want out of this program is to find those things that are unique to you, and not some single aspect of computer security that an adversary can use to compromise your system.” Multi-step verification This is an option Google made available a while ago, and if you haven’t activated it, now would be a good time to do it. Google offers a two-step verification – it asks for the classical password, and also sends a text message with a code to your personal cellphone. According to Honen, who has taken on the issue of online security fallacy with a vengeance since his hack, this is just the beginning. The future of passwords means a combination of different identifiers that extend far beyond the password. The more pieces required for verification, the stronger the security of a system gets. Smartcards Google researchers are experimenting with a tiny Yubico cryptographic card that works somewhat like a car key: you slid it into a USB reader and it automatically logs a web surfer into Google opening your web mail and online accounts. They have modified Google’s web browser to work with these cards, but the best part is that there is no software download and once the browser support is there, it’s quite easy to use. Biometrics Facial Recognition. This option already exists under the form of a photo-based system that needs a picture of your face as login for the computer. Basically, if your computer is stolen and someone attempts to hack it, the software takes a photo of the person who tried and failed. For websites, Silicon Republic reports that teenagers Niall Paterson and Sam Gaulfield have created Viv.ie, a facial recognition system, available through an open API that website owners can deploy to allow their users to log in without a password. The technology is quite simple, it takes a photo of your face and then analyses it against the database of registered users. There are two problems though: whoever wants to hack your computer could show a photo of your face thus opening all channels to the uninvited guest, and it hasn’t yet been finalized due to high costs and little experience in the business world for the two 17 year-olds. It is definitely a start. Voice recognition. This one...