Mirai botnet

Mirai botnet
Name	Mirai botnet
Created	2016
Authors	Paras Jha, Josiah White, Dalton Norman (identified)
Operating systems	Embedded Linux, BusyBox
Status	Source code released publicly

Mirai botnet Mirai botnet emerged in 2016 as a distributed denial-of-service (DDoS) malware targeting Internet of Things devices and rapidly became a major cybersecurity incident linked to high-impact outages. The botnet exploited default credentials on devices such as routers, DVRs, and IP cameras to assemble large-scale botnets used in notable attacks against major online services and infrastructure providers.

Overview and Background

Mirai’s development and discovery intersect with several notable figures and organizations in cybersecurity and internet infrastructure, including security researchers at KrebsOnSecurity, Brian Krebs, Flashpoint, Akamai, Cloudflare, Dyn, and the Internet Society. Its operators and researchers referenced technologies and standards from companies like MikroTik, Linksys, D-Link, Huawei, and TP-Link, as well as protocols and projects such as Telnet, BusyBox, uClibc, OpenWrt, and DD-WRT. Public attention linked Mirai to incidents affecting commercial platforms, content delivery networks like Fastly, and service providers such as OVH and Amazon Web Services. Law enforcement actions involved federal agencies and judicial venues tied to the Eastern District of New Jersey and the United States Department of Justice.

Technical Architecture and Operation

Mirai’s architecture combined a scanner, loader, command-and-control (C2) servers, and attack modules, leveraging concepts familiar to authors and engineers associated with Linux kernel development, BusyBox utilities, and embedded device manufacturers like Qualcomm and Broadcom. The malware performed credential-based brute force via Telnet and SSH against IoT devices, then downloaded a compact ELF binary compiled for MIPS and ARM architectures. Once a device was compromised it reported back to C2 infrastructure often hosted through bulletproof hosting services, dynamic DNS providers, and compromised cloud instances associated with providers such as DigitalOcean, Hetzner, and Google Cloud. Analysts compared Mirai’s modular components to frameworks used in operations by threat groups discussed in reports from FireEye, Symantec, ESET, and Trend Micro.

Infection Methods and Payloads

Mirai primarily propagated by scanning IPv4 address ranges and attempting login using lists of default usernames and passwords prevalent among vendors like Hikvision, Dahua, and ZyXEL. The payload included routines to disable competing malware families, harden persistence against reboots using init scripts and crontab-like mechanisms on firmware stacks, and execute volumetric DDoS vectors such as TCP SYN, UDP flood, DNS amplification, and HTTP GET floods. Researchers from Carnegie Mellon University CERT, University of Maryland, and the SANS Institute documented how Mirai variants incorporated exploits affecting products from Netgear, Arris, and Siemens, and how modifications introduced by copycat actors referenced exploits cataloged by MITRE and recorded in CVE entries.

Major Incidents and Impact

Mirai was implicated in high-profile outages, notably a DDoS campaign against Dyn that disrupted platforms like Twitter, Netflix, Reddit, GitHub, Spotify, and PayPal by affecting Domain Name System infrastructure. Other significant incidents included attacks on KrebsOnSecurity that drew involvement from Akamai, and campaigns targeting service providers such as OVH and Deutsche Telekom. The disruption influenced policy discussions involving the Federal Communications Commission, the European Union Agency for Cybersecurity, and standards bodies including the Internet Engineering Task Force. Economic and reputational impacts touched companies such as Amazon, Microsoft, Cloudflare, Cisco, Juniper Networks, and Palo Alto Networks, while academic studies at institutions like MIT, Stanford, and Princeton quantified traffic volumes and reflectivity abuse.

Attribution, Prosecution, and Legal Responses

Attribution efforts by law enforcement and private researchers linked original Mirai authors to individuals identified in court filings, with prosecutions brought by the United States Department of Justice and plea agreements adjudicated in federal courts. The case involved coordination with international partners and notices to manufacturers including Huawei, ZTE, Belkin, and Samsung, and implicated intermediary jurisdictions referenced in Mutual Legal Assistance Treaties and Europol collaborations. Legal responses spurred discussions in legislative bodies such as the United States Congress and the European Parliament about device security standards, liability, and potential regulatory frameworks referencing FTC enforcement actions and consumer protection statutes.

Mitigation, Detection, and Defense Measures

Mitigation recommendations by cybersecurity vendors and organizations such as NIST, ENISA, CISA, and the Open Web Application Security Project emphasized firmware updates, unique credential management, network segmentation, and device inventory auditing for vendors like Netgear, Asus, and TP-Link. Detection techniques included network-based anomaly detection deployed by Arbor Networks, Radware, and Fortinet, signature analysis by Sophos and McAfee, and behavioral analytics implemented by Splunk, Elastic, and IBM QRadar. Defensive measures also involved ecosystem responses from Certificate Authorities, registrars, and content delivery networks to throttle malicious traffic, and coordinated vulnerability disclosure practices advocated by groups including CERT Coordination Center and the Responsible Disclosure community.

Category:Computer security