How do so many vulnerable IoT devices stay alive and online?

Question

With attacks like Mirai and similar "script kiddie" threats giving access to so many IoT devices, how do they manage to stay online?

Suppose I have a device online which can be accessed (as root) over SSH with default credentials. Surely within a day or two some botnet will have found it, and within a few months loads will have found it.

Given so many nasties now freely accessing my IoT lightbulb (or whatever), sooner or later I would expect one of them to shut the device down or vandalise it in some way that knocks it offline.

Obviously whilst building a botnet a hacker would want to keep their bots online to use them. But I can imagine someone think "how hilarious, I will connect thousands of devices and then turn them all off at once" (even with a script that turns it off again on startup).

Or e.g. you might see a "grey hat" hacker do this to try to prevent a "black hat" from exploiting a vulnerable popular device. Or a rival company try to gain a competitive advantage by killing all their competitor's devices.

Do they only stay on and online because nobody has decided to knock them off in this way yet? Or am I misunderstanding something?

Answer 1

While attacking systems was kind of a fun sport in the past for some it is now mainly a business. Simply destroying systems has very low return of investment while still having a risk of getting charged for criminal activity. It is much more lucrative and worth the risk instead to infiltrate a system and use it as base to attack and infiltrate more systems. Attackers even make sure that the original vulnerability gets closed so that other attackers cannot "steal" the system from them.

But there are also attacks which destroy systems. Only this is done not for fun but instead to cover the tracks and to massively harm the victim as done for example in the attack against Sony Pictures.

Answer 2

It's the hacker choice on what they decide to do with your IoT device. They have SSH access which would give them a wide range of attacks.

Yes, you could use it for a botnet.

Yes, you could turn it off.

But let's think more maliciously. The hacker could change the default credentials. So, it's only accessible by the hacker then perform a MITM attack against your network and steal all your sensitive information. So, other hacker's using the default credentials wouldn't able to shutdown your device.