With attacks like Mirai and similar "script kiddie" threats giving access to so many IoT devices, how do they manage to stay online?
Suppose I have a device online which can be accessed (as root) over SSH with default credentials. Surely within a day or two some botnet will have found it, and within a few months loads will have found it.
Given so many nasties now freely accessing my IoT lightbulb (or whatever), sooner or later I would expect one of them to shut the device down or vandalise it in some way that knocks it offline.
Obviously whilst building a botnet a hacker would want to keep their bots online to use them. But I can imagine someone think "how hilarious, I will connect thousands of devices and then turn them all off at once" (even with a script that turns it off again on startup).
Or e.g. you might see a "grey hat" hacker do this to try to prevent a "black hat" from exploiting a vulnerable popular device. Or a rival company try to gain a competitive advantage by killing all their competitor's devices.
Do they only stay on and online because nobody has decided to knock them off in this way yet? Or am I misunderstanding something?