Default-Credential Botnet Sweep

Most consumer IoT devices — cameras, routers, smart plugs — leave the factory with one of a small handful of well-known username/password pairs, and most owners never change them. An automated scanner doesn't need to break any cryptography to compromise these devices: it just tries that short list of defaults against every IP it finds. This simulator sweeps a scanner front across a field of IoT devices left to right. Devices still on factory-default credentials fall the instant the sweep reaches them and join a growing botnet around the command-and-control hub; devices that were forced to set a unique password on first boot reject the exact same attempts every single time, no matter how many passes the scanner makes. Drag the hardening-rate slider to see the eventual botnet size collapse.