The Internet of Things Old and Unmanaged

The operation of the Internet is not usually informed by details about new types of Internet hosts such as customer premise broadband routers and other Internet-connected consumer products. Detecting and monitoring their arrival and effect is challenging. In this paper, we consider a particularly illustrative incident involving this class of host. In May 2003, we found that one IP address of a public Network Time Protocol server was the destination of a large scale flood of inbound traffic. To our surprise, we determined the sources of this flooding to be hundreds of thousands of real Internet hosts throughout the world – the root cause being serious flaws in the firmware of low-cost Internet products targeted for residential use. Because this situation was discovered before its peak and a subset of the flawed devices continue to operate even today, in 2016, we offer an empirical measurement of the lifetimes of such products. Based on this incident, we also consider how Internet consumer products are introduced and operated and propose ways in which we might address the threats that such things pose.