Mirai (malware)
| Original author(s) | "Anna-senpai" (online pseudonym) |
|---|---|
| Repository | |
| Written in | C (agent), Go (controller) |
| Operating system | Linux |
| Type | Botnet |
| Website | github |
Mirai (Japanese for "the future") is malware that turns computer systems running Linux into remotely controlled "bots", that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as remote cameras and home routers.[1] The Mirai botnet has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks, including an attack on 20 September 2016 on computer security journalist Brian Krebs's web site, an attack on French web host OVH[2] and the October 2016 Dyn cyberattack.[3][4][5] There is speculation that the attacks are related.
The source code for Mirai has recently been published in hacker forums as open-source.[6] Since the source code was published, the techniques have been adapted in other malware projects.[7]
Malware
Devices infected by Mirai continuously scan the internet for the IP address of Internet of things (IoT) devices. Mirai includes a table of subnet masks that it will not infect, including private networks and addresses allocated to the United States Postal Service and Department of Defense.[8]
Mirai then identifies vulnerable IoT devices using a table of common factory default usernames and passwords, and logs into them to infect them with the Mirai malware.[9][2][10] Infected devices will continue to function normally, except for occasional sluggishness,[9] and an increased use of bandwidth. A device remains infected until it is rebooted, which may involve simply turning the device off and after a short wait turning it back on. After a reboot, unless the login password is changed immediately, the device will be reinfected within minutes.[9]
There are hundreds of thousands of IoT devices which use default settings, making them vulnerable to infection. Once infected, the device will monitor a command and control server which indicates the target of an attack.[9] The reason for the use of the large number of IoT devices is to bypass some anti-DoS software which monitors the IP address of incoming requests and filters or sets up a block if it identifies an abnormal traffic pattern, for example, if too many requests come from a particular IP address. Other reasons include to be able to marshall more bandwidth than the perpetrator can assemble alone, and to avoid being traced.
Use in DDoS attacks
Mirai was used in the DDoS attack on 20 September 2016 on the Krebs on Security site which reached 620 Gbps.[11] Ars Technica also reported a 1 Tbps attack on French web host OVH.[2]
On 21 October 2016 multiple major DDoS attacks in DNS services of DNS service provider Dyn occurred using Mirai malware installed on a large number of IoT devices, resulting in the inaccessibility of several high profile websites such as GitHub, Twitter, Reddit, Netflix, Airbnb and many others.[12] The attribution of the attack to the Mirai botnet was originally reported by BackConnect, a security firm.[13]
Staff at Deep Learning Security observed the steady growth of Mirai botnets before and after the 21 October attack.[14]
See also
- Denial-of-service attack
- BASHLITE – another notable IoT malware
References
- ^ Biggs, John (Oct 10, 2016). "Hackers release source code for a powerful DDoS app called Mirai". TechCrunch. Retrieved 19 October 2016.
- ^ a b c Bonderud, Douglas (October 4, 2016). "Leaked Mirai Malware Boosts IoT Insecurity Threat Level". securityintelligence.com. Retrieved 20 October 2016.
- ^ Hackett, Robert (October 3, 2016). "Why a Hacker Dumped Code Behind Colossal Website-Trampling Botnet". Fortune.com. Retrieved 19 October 2016.
- ^ Newman, Lily Hay. "What We Know About Friday's Massive East Coast Internet Outage". WIRED. Retrieved 2016-10-21.
- ^ "Dyn | crunchbase". www.crunchbase.com. Retrieved 2016-10-23.
- ^ Statt, Nick (October 21, 2016). "How an army of vulnerable gadgets took down the web today". The Verge. Retrieved October 21, 2016.
- ^ Kan, Michael (October 18, 2016). "Hackers create more IoT botnets with Mirai source code". ITWORLD. Retrieved 20 October 2016.
- ^ Zeifman, Igal; Bekerman, Dima; Herzberg, Ben (October 10, 2016). "Breaking Down Mirai: An IoT DDoS Botnet Analysis". Incapsula. Retrieved 20 October 2016.
- ^ a b c d Moffitt, Tyler (October 10, 2016). "Source Code for Mirai IoT Malware Released". Webroot. Retrieved 20 October 2016.
- ^ Osborne, Charlie (October 17, 2016). "Mirai DDoS botnet powers up, infects Sierra Wireless gateways". ZDNet. Retrieved 20 October 2016.
- ^ The Economist, 8 October 2016, The internet of stings
- ^ "Today the web was broken by countless hacked devices". theregister.co.uk. 21 October 2016. Retrieved 24 October 2016.
- ^ "Blame the Internet of Things for Destroying the Internet Today". Motherboard. VICE. Retrieved 27 October 2016.
- ^ "Think Mirai DDoS is over? It ain’t!!"