# MIRAI BOTNET 2016: A case study on IoT Security ### THE ATTACK AT A GLANCE: This is a major IoT + DDoS attack that occurred in 2016. MIRAI, a self-replicating worm, infected lakhs of IoT devices and launched a large-scale DDoS attack that affected popular sites like GitHub, Netflix, Spotify, and Twitter (now X). This mainly occurred due to weak/default credentials. Since IoT devices are all 'set and forget', they became an easy target. MIRAI was highly capable. It was able to scan vulnerabilities on IoT devices, send reports to the hackers and conduct DDoS attacks. 2 structures to keep in mind: 1. The replication module ![](https://cdn.hashnode.com/uploads/covers/69a19a20f74c7a2f10e095b4/5fc2b65d-22df-4fe3-aba3-482394e1c323.png align="center") Enslaved devices would both scan and attack vulnerable devices and send report to the Command & Control (C&C) servers which would then inject a payload allowing the hackers to exploit and control the vulnerable device. 2\. The attack module ![](https://cdn.hashnode.com/uploads/covers/69a19a20f74c7a2f10e095b4/6250d592-71be-4404-9501-b9019f933c3a.png align="center") The attackers sent the code for the DDoS attack to the devices through the C&C servers, which would then run the program on the targeted site. This code uses multiple methods like TCP flood, UDP flood, and HTTP flooding. #### ATTACK STRUCTURE: **Scan for vulnerable IoT devices**: MIRAI scanned the internet for IoT devices exposing services such as Telnet. ↓ **Guess default credentials**: It attempted known factory-default username/password combinations against discovered devices. ↓ **Recruit the device into the botnet**: The infected device connected to Mirai's C2 infrastructure, becoming part of the attacker's remotely controlled botnet. ↓ **Expand the botnet:** Compromised devices continued scanning for more vulnerable IoT devices, allowing the botnet to grow rapidly. ↓ **Launch DDoS attacks**: The attacker instructed thousands of compromised IoT devices to simultaneously send traffic toward a target, creating a large-scale distributed denial-of-service attack. ### STEP - BY - STEP ATTACK BREAKDOWN: STEP 1: Scan for vulnerable IoT devices WHAT DID THE ATTACKER (MIRAI) DO? MIRAI scanned IoT devices, compromised their integrity using their credentials, and gained remote access. WHY DID IT WORK? Sweeping IPs gave MIRAI a huge attack surface, and these were easily reachable via WAN. Most devices used the same ports (Telnet and ssh) to get remote access, which made the scan easier. Most devices lacked IDS and IPS. WHAT HAPPENED TECHNICALLY? MIRAI scanned IoT devices by sweeping a large number of IP addresses for open ports, focusing mainly on Telnet and SSH, which helped get remote access to the device. WHAT WOULD A DEFENDER OBSERVE? If there were a defender, they would observe unusual traffic at the ports of Telnet and SSH (port 22 and 23/2323). Multiple IP scans from different locations due to the IP sweeps. IDS/IPS system alerts. STEP 2: GUESSED DEVICE CREDENTIALS WHAT DID THE ATTACKER DO? Managed to guess the credentials of the devices and gain unauthorised access to them WHY DID IT WORK? Thousands of IoT devices used default usernames and passwords. Something like admin and 1234, etc. This made the credentials unreliable and easy to crack. IoT devices are mostly shipped with hardcoded credentials that user donot change, while some wouldn't allow a change. WHAT HAPPENED TECHNICALLY? MIRAI carried a fixed list of 60 passwords, which included common passwords and dictionary attack (brute-force) to help crack credentials. WHAT WOULD A DEFENDER SEE? Mass failed logins of devices that have common credentials. Attempts from multiple unexpected geographical regions. STEP 3: RECRUIT THE DEVICE INTO THE BOTNET WHAT DID THE ATTACKER DO? Once the login was successful, it deployed an agent into the system. This agent connected back to the C&C server this allowed them to use the device remotely. WHY DID IT WORK? This worked because most devices are always on, they lacked security systems, and the C2 design could coordinate hundreds of thousands of bots. WHAT HAPPENED TECHNICALLY? The agent initiated a TCP connection with the C2 servers. They would then provide updates to the servers. This allowed an easy communication path between the hacker and the device. WHAT WOULD A DEFENDER OBSERVE? Devices sending repeated connections to external IPs at suspicious geolocations. Regular data updates sent to servers. STEP 4: EXPAND THE BOTNET WHAT DID THE ATTACKER DO? MIRAI could scan other devices for vulnerabilities using IPs to expand the reach of the hacker. WHY DID IT WORK? Uniform weaknesses were found among devices; no monitoring on the devices. WHAT HAPPENED TECHNICALLY? The devices would repeat the entire process of sweeping IPs, scanning them for open ports, using brute-force to log in, and reporting them to the C2 servers. WHAT A DEFENDER WOULD OBSERVE? Failed login attempts, IP sweeping (scans), huge IoT traffic on the network. STEP 5: LAUNCH DDoS ATTACKS WHAT DID THE ATTACKER DO? The required DDoS program to be executed was sent to the device along with the target, enabling them to send requests to the targeted sites. WHY DID THIS WORK? A connection was already established with the servers due to TCP, which allowed them to conduct attacks from the devices. WHAT HAPPENED TECHNICALLY? The code was sent to the agent through the TCP connection from the servers. These programs were executed by the devices on the targeted sites. WHAT WOULD DEFENDER A OBSERVE? Massive traffic from thousands of IPs. Multiple sites going offline. TCP, HTTP and UDP flooding. Devices sending an unusual amount of requests to a single site. ### MITIGATION: 1. Using strong credentials 2. Implementing IDS and IPS systems 3. Devices must be monitored by the providers. 4. Rate-limiting the number of logins and requests that can be sent. 5. Regularly patch devices. ### TAKEAWAYS: * **IoT Security Weaknesses**: Default passwords and poor configurations. * **Botnet Mechanics**: Infection, coordination, and DDoS execution. * **DDoS Threats**: Multi-vector attacks and mitigation awareness. SOURCES: [Inside the infamous Mirai IoT Botnet: A Retrospective Analysis | Cloudflare Blog](https://blog.cloudflare.com/inside-mirai-the-infamous-iot-botnet-a-retrospective-analysis/?utm_source=chatgpt.com)  [IoT Botnet Forensics: A Comprehensive Digital Forensic Case Study on Mirai Botnet Servers - ScienceDirect](https://www.sciencedirect.com/science/article/pii/S2666281720300214?utm_source=chatgpt.com)