StatewardStateward
← Toutes les vulnérabilités
HIGHInfracurated

INFRA-MIRAI-2016

IoT · IoT devices (Mirai botnet)

Résumé

In 2016 the Mirai botnet showed what happens when millions of insecure IoT devices get weaponized. Mirai scanned the internet for cameras, DVRs, and routers exposed over Telnet and logged in using a table of about 61 default and hardcoded credential pairs that owners never changed (and sometimes could not change). The conscripted devices launched record-breaking DDoS attacks: roughly 620 Gbps against the security site Krebs on Security, around 1.1 Tbps against the host OVH, and, after Mirai's source code was leaked, an assault on the DNS provider Dyn on 21 October 2016 that knocked Twitter, Netflix, Reddit, GitHub, and Spotify offline for much of the US. That public code release spawned countless variants that still operate today. It is the defining lesson in default-credential and IoT hygiene.

How it happened

Mirai was almost embarrassingly simple, which was the point. It scanned the internet for devices with the Telnet remote-login port open, the cheap cameras, DVRs, and home routers that flood the market, and tried to log in using a built-in list of about 61 default username-and-password pairs (admin/admin, root/xc3511, and the like) that manufacturers had baked in and most owners never changed. Many devices could not change them at all. When a login worked, Mirai loaded itself into the device's memory, and that device quietly became part of the botnet: waiting for orders from a command server while scanning for the next victim. The owners noticed nothing. At its peak Mirai controlled an estimated 600,000 devices.

A botnet that size is a firehose. Pointed at a target, all those devices flood it with traffic at once, a DDoS attack that no single server can absorb and that is hard to block because it comes from hundreds of thousands of ordinary IP addresses.

The damage

Mirai set records and broke the internet in slow motion. In September 2016 it hit the security journalist Brian Krebs with a 620 Gbps flood, almost twice the largest attack his provider had ever seen, so large the provider dropped him. It threw around 1.1 Tbps at the French hosting company OVH. These attacks traced to a few young men, Paras Jha, Josiah White, and Dalton Norman, who ran a racket in the Minecraft DDoS-protection market, attacking servers and rival mitigation firms to sell protection against their own floods; to muddy attribution as researchers closed in, one of them, under the handle "Anna-senpai," published Mirai's full source code on a hacker forum. That leak is why Mirai never really ended. Among the copycat botnets it spawned was the one that, on 21 October 2016, aimed at Dyn, a company that runs DNS (the internet's address book) for much of the web, and took Twitter, Netflix, Reddit, Spotify, GitHub, and PayPal offline across the US East Coast for hours; a separate attacker, then a juvenile, later pleaded guilty to that one. The three original authors pleaded guilty in 2017, and dozens of variants built on their leaked code remain among the most common internet threats years later.

Why Mirai still matters

Mirai is the case that put the "Internet of Things" security problem on the map. The lesson is brutally simple and still ignored: devices shipped with default or shared credentials, exposed to the internet, become weapons. The fixes belong partly to manufacturers (never ship a default password, force a unique one on first boot, do not hard-code credentials) and partly to everyone who runs a device (do not expose management interfaces to the internet, put IoT on its own segmented network, keep firmware patched, and filter outbound traffic so a compromised gadget cannot freely reach attack targets). And because botnets this big are now a permanent fact, any service that matters needs real DDoS resilience, redundant and anycast DNS plus a scrubbing provider, in place before it is needed.

Comment le corriger

  • Change default credentials on every device and disable Telnet and other plaintext management protocols.
  • Reboot and re-flash compromised devices with current firmware; Mirai lives in memory and returns if the exposure remains.
  • Pull device management interfaces off the public internet and behind a firewall or VPN.
  • For DDoS targets, engage upstream scrubbing and DNS redundancy to absorb and disperse the flood.

Comment l’éviter

  • Never ship or deploy devices with default or shared credentials; force a unique password on first use and forbid hardcoded ones.
  • Disable Telnet and UPnP and expose no device management to the internet; put IoT on its own segmented network.
  • Keep IoT firmware patched, and retire devices that no longer receive updates.
  • Filter egress so compromised devices cannot freely reach attack targets, and rate-limit and monitor outbound traffic.
  • Build DDoS resilience: redundant and anycast DNS plus a scrubbing provider, before you need them.

Références

Vulnérabilités liées

Tout Infra →