The Mirai botnet (2016)

What happened

In the second half of 2016, a new piece of malware called Mirai began infecting internet-connected devices such as IP cameras, digital video recorders and home routers. It turned them into a botnet: a network of hijacked machines that could be ordered to flood a target with traffic, known as a distributed denial-of-service (DDoS) attack.

Mirai produced some of the largest DDoS attacks seen up to that time:

• September 2016: the website of security journalist Brian Krebs was hit with traffic reported at around 620 gigabits per second, forcing its protection provider to drop it.
• Around the same time: the French hosting company OVH reported attacks approaching or exceeding one terabit per second.
• October 21, 2016: attacks on Dyn, a company that provided DNS services (the internet's address book) for many major sites, caused outages and slowdowns for well-known websites and services across parts of the United States and Europe for several hours.

How it worked

Mirai's method was simple, which is what made it alarming:

1. Scanning. Infected devices continually scanned the internet for other devices with remote login services such as Telnet open.
2. Default passwords. It tried a built-in list of around 60 common factory usernames and passwords, such as combinations of "admin", "root" and "1234". Many devices shipped with these and their owners never changed them; some devices did not let owners change them at all.
3. Infection and reporting. Once in, it loaded the malware and reported the new device to its control servers.
4. Attack on command. Operators could then point the whole botnet at a target.

Mirai lived only in memory, so rebooting a device removed it, but with the same default password the device was often reinfected within minutes.

In late September 2016, the source code was published on a hacking forum. Many copycat botnets followed, and Mirai variants remain active years later.

Impact

Beyond the outages, Mirai changed how people thought about the Internet of Things. Millions of cheap devices had been built without basic security, and their owners had no idea they were taking part in attacks. In 2017, three young men in the US pleaded guilty to creating and operating Mirai. They had originally been involved in attacks related to game servers, and they later helped the FBI with other cybercrime investigations as part of their sentences.

What defenders learned

• Default passwords are a design failure. Laws and standards have since moved against them. California's IoT security law, in effect from 2020, requires reasonable security features such as unique passwords, and the UK's product security regulations ban universal default passwords on consumer smart devices from 2024.
• Concentration creates fragility. The Dyn attack showed that knocking out one shared service can disrupt many unrelated websites. Large sites now often use more than one DNS provider.
• Turn off what you do not use. Remote login services had no reason to be exposed on most devices.

What it means for you

Your camera or router could be part of a botnet without any visible sign. Protect your devices:

• Change the default password on every router, camera, DVR and smart device when you set it up.
• Update firmware, and turn on automatic updates if available. See software updates.
• Disable remote access features you do not need, including UPnP on your router if your devices work without it.
• Replace devices that no longer get security updates.
• Buy from makers that publish a support period and a way to report vulnerabilities.