Cyxtera Reveals Research Finding IoT Devices Under Constant Attack

MIAMI, FL and SAN FRANCISCO, CA (RSA Conference Booth 5883, North Expo) – March 4, 2019 – Cyxtera Technologies, the secure infrastructure company, today released findings from an extensive research project, the “Detection of Threats to IoT Devices using Scalable VPN-forwarded Honeypots,” showing that IoT devices are under constant attack; more than 150 million connection attempts over 15 months. The report reveals the detection of new attacks on IoT devices, especially those leveraging zero-day vulnerabilities for specific devices. The research was a joint effort by Cyxtera threat researcher Martin Ochoa and researchers from the Singapore University of Technology and Design.

In tandem with the release of this research, Cyxtera announced new functionality in its flagship Zero Trust solution, AppGate SDP, that extends the benefits of network micro-segmentation and software-defined perimeter to connected IoT devices. The AppGate SDP IoT Connector enables enterprises to enforce consistent access control policies across users, servers, and devices to protect today’s complex and distributed resources.

Key report findings include:

  • Researchers detected more than 150 million connection attempts to 4,642 distinct IP addresses.
  • 64 percent of incoming connections seemed to originate in China, with another 14 percent from the United States. This was followed by the United Kingdom (nine percent), Israel (eight percent) and Slovakia (six percent). Note: It’s difficult to definitively confirm the origination of Internet traffic as it is possible to re-route traffic to other locations, frequently employed as an obfuscation technique.
  • All IoT devices saw attempted logins immediately upon coming online and the number of login attempts increased steadily over time.
  • Within days of new malware campaigns going public – such as Mirai, Satori, and Hakai – those malware families were being used to attack IoT devices from the honeypot. In many cases, the increase in activity was identifiable in the days and weeks before the malware was publicly named.
  • 54 percent of connections received by the honeypot were via Telnet port, while HTTP ports received almost all of the remaining connections.
  • IP cameras received the majority of connections in the honeypot, suggesting greater attacker interest in those IoT devices as compared to others such as printers and smart switches. Several recent, large-scale attacks on IoT devices have targeted IP cameras.


“IoT devices are an attractive target for attackers, because they are often a security after-thought and its harder to keep them patched and up-to-date — if patches are even available at all,” said Alejandro Correa Bahnsen, Vice President of Data Science at Cyxtera. “The researchers involved in this project accurately detected several large-scale attacks targeting IoT devices and demonstrated the frequency and speed with which these devices are targeted. This approach can be replicated by other threat researchers to broaden our collective knowledge about these vulnerabilities.”

New AppGate IoT Connector Extends Power of Software-Defined Perimeter

IoT devices are increasingly present in enterprise networks and are expected to grow even more with the advent of 5G networks. According to analyst firm IDC, worldwide technology spending on IoT is projected to reach $1.2 trillion in 2022. Meanwhile, security is one of the greatest barriers to IoT adoption, according to global consulting firm Bain. With the anticipated rise in IoT adoption, security issues must be addressed head-on to fully leverage the power of smart devices in a way that is safe and managed effectively.

Benefits of AppGate SDP IoT Connector include:

  • Consistent enforcement of access control policies across users, servers, and IoT devices
  • Reduced operational complexity and cost with easier management of IoT devices
  • Protection of complex, distributed resources
  • Reduced attack surface by limiting over-privileged device access
  • Decreased audit scope to lower compliance costs


“The rapid adoption of IoT devices is outpacing the ability to secure them properly,” said Ricardo Villadiego, General Manager, Security & Anti-Fraud at Cyxtera. “These devices are connected to the same network as users, servers, and sensitive data, which creates risks for the network. AppGate SDP’s IoT Connector secures unmanaged devices, restricting lateral movement and reducing an organization’s attack surfaces.”

The report “Detection of Threats to IoT Devices using Scalable VPN-forwarded Honeypots,” will be presented at the Ninth ACM Conference on Data and Application Security and Privacy (CODASPY) in Richardson, TX, USA, March 25-27, 2019. Authors: Amit Tambe, Yan Lin Aung, Ragav Sridharan, Martin Ochoa, Nils Ole Tippnehauer, Asaf Shabtai, and Yuval Elovici, 2019.

About Cyxtera

Cyxtera Technologies combines a worldwide footprint of 50+ best-in-class data centers with a portfolio of modern, cloud- and hybrid-ready security and analytics offerings – providing more than 3,500 enterprises, government agencies and service providers an integrated, secure and cyber-resilient infrastructure platform for critical applications and systems. For more information about Cyxtera visit, http://www.cyxtera.com/.