Nine minutes to send the file. Then the internet went quiet.
How hijacked gadgets in ordinary homes took down major websites far away, and what the CRA says about products that harm other people's services.
The facts
What happened
A Mirai botnet, built from hijacked cameras, recorders and routers, flooded Dyn with traffic. Dyn provides DNS, the address book that turns website names into internet addresses.
What it caused
Access to major sites including Twitter, Spotify and Reddit was disrupted. The harm landed on companies and users far away from the homes where the infected devices sat.
What the CRA now asks
Minimise the negative impact on the availability of services provided by other devices or networks (Annex I, Part I (2)(i)); reduce the impact of an incident (Annex I, Part I (2)(k)).
Source: Krebs on Security, "DDoS on Dyn Impacts Twitter, Spotify, Reddit", 21 October 2016
The story
Rachel had nine minutes to send the file. Her client was waiting, it was a Friday morning in October 2016, and she had promised. She dragged it onto the website and the page would not load. She opened Twitter to see if anyone else was having trouble, and Twitter would not load either. Spotify had stopped mid-song. Reddit was a blank screen. The lights on her internet box were all green, which somehow made it worse.
What Rachel could not see was a company called Dyn, which works like the internet's phone book: when you type a website's name, it looks up where that website actually lives. Dyn was being flooded with fake requests, like a phone line jammed by millions of robot calls at once. Those calls were coming from cameras, video recorders and internet boxes in ordinary homes, taken over in secret. The people who owned them were making breakfast. They had no idea.
That is the strange heart of this story: the harm landed hundreds of miles from the gadgets that caused it, on people who had never bought one. The Cyber Resilience Act was written for exactly this. A product must not harm the availability of other people's services, and it must be built so that if it is broken into, the damage stays small. Add a ban on shared factory passwords and a duty to keep fixing weak spots, and that army never gets recruited. Rachel sends her file with eight minutes to spare.
The people and scenes are illustrative. The incident and its facts are real.
The system that would have caught it
Limiting the harm a hijacked product can do is a design requirement for the product itself. Deciding what the product may send, and holding the release until that is limited, needs one owner.
5. Decide and own
One named person responsible for the CRA work, with a budget and the authority to stop a release. Decisions are written down on one page.
How the system worksCould you do this today?
Do you know what your product could send to the internet if someone took it over?
If it applies, how ready are we?
Six yes-or-no questions, two minutes. Your no's come back in the order to fix them.
Not sure the CRA applies to your product? Check that first