Bridge WAF
The Mirai botnet: default passwords at internet scale
Mirai is malware that turns internet-connected devices such as cameras, video recorders and home routers into a botnet. In 2016 it grew quickly by trying a short list of factory default passwords on devices exposed to the internet, and its operators used it for some of the largest DDoS attacks seen up to then. Its variants are still active, because the weakness it used is still common.
Quick facts
- What it infects
- Embedded and IoT devices: cameras, video recorders, routers
- How it spread
- By logging in with factory default credentials over remote management services
- Peak size
- About 600,000 infections, per a seven-month study (USENIX Security 2017)
- Largest attack attributed
- 623 Gbps in 2016, as cited by Google
- Official warning
- CISA alert TA16-288A, October 2016
What botnets are in general is on botnets.
How Mirai spread
- Infected devices scanned the internet for others with remote login services open.
- They tried a short list of default credentials, the user names and passwords devices ship with.
- A successful login was reported to a loader, which installed the malware on the new device.
- The new bot joined the scanning. Growth fed itself.
The malware lived in memory, so a reboot removed it, and the same default password let it back in within minutes.
Mirai's attacks
In late 2016 Mirai was used against high-profile targets, including a DNS provider whose outage made many well-known sites unreachable for parts of a day. The USENIX study records how the botnet emerged, which devices it took over, and a history of its victims.
The botnet could send several kinds of flood, at the network and at the application layer. Its size, not new techniques, made the floods large: hundreds of thousands of small devices, each with a modest connection.
Mirai variants
Its source code was published in 2016, and variants multiplied. The USENIX study describes how variants evolved and competed for vulnerable hosts, adding new credentials and exploits for specific devices.
Many later IoT botnets reuse its design: scan, log in or exploit, load, repeat. When a news report names a new IoT botnet, the mechanism is often still Mirai's.
What Mirai changed
Before Mirai, large floods were expected to come from compromised computers and servers. Mirai showed that devices nobody thinks of as computers, with modest connections each, could produce floods larger than most networks could absorb. How its floods compare with the records that followed is on largest DDoS attacks.
It also moved attention to device makers. Shipping every unit with the same default password, and with remote login switched on, was revealed as a security decision with consequences for everyone else on the internet.
Protecting devices from Mirai
- Change default passwords on every device, including those installed by contractors.
- Turn off remote login services such as telnet that the device does not need.
- Keep management interfaces off the internet; reach them through a VPN or an address allowlist, as on IP blocking.
- Update firmware, and replace devices that no longer receive updates.
For sites on the receiving end, the defences are those for any botnet flood; see DDoS protection.
Questions
What is the Mirai botnet?
Mirai is malware that infects IoT devices such as cameras and routers using default passwords and joins them into a botnet used for DDoS attacks. It first appeared in 2016.
How did Mirai infect devices?
Infected devices scanned the internet for others with remote login open and tried a short list of factory default user names and passwords; successful logins were used to install the malware.
Is Mirai still active?
Its variants are. The original code circulated widely, and later IoT botnets reuse its design.
How do I protect my devices from Mirai?
Change default passwords, turn off unneeded remote login services, keep management interfaces off the internet, and update or replace device firmware.