Is a router a better device for a IoT botnet than something in the router's network?

Question

As some of you maybe noticed, there was a attack this weekand against routers of the german provider Telekom an their routers "W723 Typ B" and "W921".

According to the news here in Germany, they wanted to use a known exploit of the remote maintenance interface port 7547 and a slightley changed version of "Mirai" to capture the routers for their botnet, but most of the attacks failed.

I fell like 900,000 captured routers would have been a really powerful botnet but I'm not an expert. I'm curious to know if routers are the best IoT devices for a botnet or are there any better devices? Is a router able to send more packages per second than the average IoT device and lead to a more effective ddos attack?

Answer 1

When you're talking about DDoS attacks utilizing botnets on this scale, the attacker may actually benefit from actually not having each infected device send out lots of traffic. With a botnet the size of Mirai, you could have each device contribute a small enough amount of the attack traffic to remain undetected and still end up with enough bandwidth hitting the target to bring it down. The objective in this case is no longer necessarily to find the most powerful devices to add to your botnet, but a rather large number of devices with default passwords that are easily compromised, which could be something as simple as a webcam or other connected IoT device.