Can someone point to explanation on IoT botnets / what happened with Cloudflare / how they differ from regular DDoS
Next you come up with some way to discover and exploit as many of these devices as you can. It could be by finding all IP addresses of exposed devices via something like Shodan, or exploiting and taking over a centralized server that all these devices communicate with, or some other novel way.
Anyways, once your in control of all these devices, you pick a target URL and send a command to all your devices to start CURLing a specific address over and over and over.
Boom, you have a IoT botnet for DDoS attacks.
Like, is the git repo secure? Can we add code that allows a backdoor or reaches out to a command-and-control server? Or how are their packages secured? Can we upload a malicious one to their package repo? Is the distribution server secure? Are the devices exposed directly to a WAN? Can we sell knock-off devices or modify legit devices before we resell them? Can we design them from the beginning to be exploitable? Were the engineers lazy and implement zero security controls? etc, etc...
This is why defensive security is rather difficult. You have to get everything right, but attackers only have to be right one time. Then when you get consumers involved, it becomes significantly more complicated and difficult. Some of these devices can stay active for years, and the owners realize no difference as long as it still works as expected.