21 October

If the internet camera in your home still uses its factory default password and can be reached directly from the internet, others may be able to log in and use it to attack other websites. On 21 October 2016, Dyn, a provider of DNS, the service that turns web addresses into server addresses, was hit by two waves of heavy traffic, and according to Singapore's Cyber Security Agency, much of the internet on the US East Coast became inaccessible. Dyn's own analysis later confirmed that a significant share of the traffic came from devices controlled by the Mirai malware, and a security firm quoted by KrebsOnSecurity that day said most of them were video recorders and internet cameras made by China's Xiongmai or built with its parts. The same firm said some models had a password built into the firmware that users could not change, while Xiongmai said most problems came from users not changing default passwords and announced a recall of some early cameras sold in the US. Singapore's Cybersecurity Labelling Scheme now covers IP cameras and lists unique default passwords among its basic-level requirements, and if you already have a camera at home, the US government's 2016 US-CERT alert advises changing the default password and installing security patches when they are available.