IoT devices make ideal botnet members. They are always on, often have a decent uplink, run outdated software, and rarely have anyone watching them. An attacker scans the internet for devices with open services and default credentials, installs a small agent, and adds the device to a command-and-control network. The owner typically notices nothing beyond slightly slower Wi-Fi.
The Mirai family turned this into a mass phenomenon and used the resulting fleet for record-sized DDoS attacks. The lesson for manufacturers is that an insecure device harms third parties, not only its owner, which is the argument behind regulations such as the Cyber Resilience Act banning default passwords and requiring update mechanisms.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.