Mirai Botnet

The Mirai botnet is a network of Internet of Things (IoT) devices infected with Mirai malware, used for massive Distributed Denial of Service (DDoS) attacks. The Mirai malware was discovered in August 2016 by MalwareMustDie, and it’s first major attack was on computer security expert Brian Krebs’s personal website . The botnet gained mainstream notoriety after performing the largest DDoS attack in history against DNS provider Dyn in October 2016 . The Mirai Botnet is now being rented on dark web for performing DDoS attacks for high paying clients

Technical Notes

Mirai malware targets poorly secured IoT devices by brute-forcing into them with a list of common usernames and passwords. Mirai then infects the device with software which gives control of the its network resources to a central server. Devices will remain infected until they are rebooted. Mirai’s inventor claims that the botnet uses upwards of 380,000 devices in an attack at a rate of 620 Gbps . refInterestingly, Mirai has a list of hardcoded IP addresses in the source code to avoid attacking. The list includes Hewlett-Packard, General Electric, and the US Postal Service.

Krebs Attack

The September 20th attack on computer security blogger Brian Krebs's website, KrebsOnSecurity.com, was the first major attack of the Mirai Botnet. The attack was estimated to have been around 620 gbps, which was approximately twice as large than any prior DDoS attack on record. Content Distribution Network provider Akamai thwarted the attack