Mirai: How Cameras and Routers Built an Internet-Crushing Botnet

On October 21, 2016, much of the Internet in the United States simply stopped working. Twitter, Netflix, Reddit, Spotify, GitHub, PayPal - one by one they became unreachable. They were not attacked directly; someone hit Dyn, the company that runs the DNS for all these sites, flooding it with traffic on an unimaginable scale. And what was most disturbing was the source of this movement. There weren’t thousands of hackers or an army of servers behind it. Behind it were surveillance cameras, video recorders, and home routers - tens of thousands of ordinary devices that their owners had in their homes, having no idea that they had become part of a weapon. The botnet was called Mirai, and its story is the story of how the most mundane neglect - the default slogan - built an army capable of bringing down the Internet.

The Internet of Things that everyone forgot about

To understand Mirai, you have to look at what was happening with technology. The world was flooded with a wave of cheap IoT (Internet of Things) devices: IP cameras, doorbells, thermostats, recorders, routers. Manufacturers were racing for price and convenience, and safety was at the bottom of the priority list. Effect? Millions of devices were delivered to homes and companies with factory default passwords such as “admin/admin” or “root/root” - the same for entire series of products, described in the instructions available on the Internet.

No one changed these passwords, because why would they - “it’s just a camera”. Yet each of these devices was a full-fledged computer connected to the network 24 hours a day. This created a gigantic, defenseless attack surface that almost no one paid any attention to. Until he returned it.

Brilliantly simple idea

Mirai was surprisingly simple technically - and that was its strength. The worm worked like this:

1. Scanned the Internet for IoT devices listening on common ports.
2. He tried to log in by going through the built-in list of several dozen default login-password pairs of the most popular manufacturers. It didn’t break any encryption, it didn’t exploit a sophisticated loophole - it just entered the password, which was still the factory one.
3. He took over the device and added it to a growing army ready to obey the order.
4. He moved on - he scanned another device from the newly captured device.

It was an attack based not on genius, but on the scale of human negligence. Any unsecured device was like an unlocked door, and Mirai simply checked the doorknobs - millions of doorknobs at once.

Three hits that shook the net

Mirai did not remain a curiosity. The army built was used to launch a series of DDoS (distributed denial of service) attacks of record strength:

• Attack on researcher’s blog First, Mirai hit the website of a well-known security journalist with a massive flood of traffic that forced his security provider to stop hosting the site.
• Attack on a French supplier. Shortly thereafter, the botnet generated traffic exceeding trillion bits per second - one of the largest DDoS attacks ever recorded at that time.
• Attack on Dyn. Finally, on October 21, the hit on the DNS company triggered a cascade: since the services could not “resolve” their addresses, they simply disappeared for users. Half of the American Internet froze for hours.

The world saw that hundreds of thousands of cheap cameras were not a toy, but a cannon aimed at the foundations of the network. This is an extension of the same logic as DDoS attacks on infrastructure - except that everyday items become ammunition.

A surprising finale: they were students

When the FBI solved the case, the motive turned out to be disappointingly mundane. Three young men, including students, stood behind Mirai. Their original goal was not to “take down the Internet”, but to gain an advantage in the market for DDoS-for-hire services and disputes between game servers. They built an enormous weapon almost by accident, for local rivalry and money.

The story has one more twist that made Mirai effectively immortal: the authors published its source code online. From then on, anyone could build a botnet based on Mirai - and many did. Dozens of variants appeared, and the Mirai family continues to attack in different forms. The creators eventually pleaded guilty and cooperated with investigators.

Why Mirai is still important

Mirai exposed the truths that define today’s IoT security and beyond:

• Default passwords are weapons of mass destruction. The entire attack was based on one thing: devices with factory credentials. This is the simplest possible vulnerability - and still one of the most common. The principle is the same as secure password myths: default = none.
• Every device on the network is a computer. Camera, printer, doorbell - if it has a processor and connection, it can be hijacked and used against others. “It’s just hardware” is a dangerous illusion.
• Scale beats sophistication. Mirai wasn’t smart. It was huge. In a world of connected devices, the number of vulnerable targets is more important than the finesse of the attack.
• Code, once published, lives forever. Source sharing turned a one-time incident into a persistent family of threats - an echo of the lesson of the Morris self-replicating code worm.

Lessons for companies

• Change default credentials - on everything. Every device, from a router to a camera to a printer, is given a unique, strong password before even connecting to the network. It’s a cliché that would stop Mirai in her tracks.
• Inventory and segment IoT. Know what you have on your network and isolate IoT devices from critical systems. The compromised camera should not be able to see your servers.
• Disable what you don’t use. Unused remote access services and ports are an invitation. Limit the attack surface to a minimum - our scanner.
• Have anti-DDoS protection. If your availability is critical, a DDoS mitigation layer (CDN/scrubbing) is a real insurance policy against volumetric attacks.
• Update firmware. IoT devices also have patches - and rarely anyone uploads them. Neglected firmware is a debt that is repaid in a crisis.

Summary

Mirai proved that it doesn’t take a brilliant exploit to rock the internet - it just needs a large enough army built from things everyone has ignored. Cameras and routers with factory passwords, multiplied by hundreds of thousands, became the weapon that shut down Twitter, Netflix and Reddit in one blow. Behind the whole thing were not masters, but students looking for an advantage in small scores - and the code they published allowed the threat to live on today. This is an enduring lesson of the Internet of Things era: every connected device is a computer, every default password is an open door, and scale can be more dangerous than finesse.

Want to see how many vulnerable devices and default credentials your network hides before a botnet finds them? Contact us - Security testing and audits also cover IoT devices and the attack surface.

Frequently asked questions (FAQ)

How did Mirai hijack devices if he didn’t break security? He didn’t have to crack them - he just logged in with factory default passwords that the owners never changed. The worm had a built-in list of several dozen common login-password pairs and tried them on mass scanned IoT devices. This is an attack based on the scale of human negligence, not technical sophistication.

What is a DDoS attack and why was Mirai so effective at it? DDoS (Distributed Denial of Service) is flooding a target with so much traffic that it becomes unresponsive. Mirai was effective because it had hundreds of thousands of compromised devices scattered around the world - each generating a little bit of traffic, and together they created a wave of record-breaking strength that was difficult to filter out.

Is Mirai still a threat? Yes, in the form of numerous variants. The authors published the source code, so anyone could build their own botnet based on it - and this is still happening today. As long as there are IoT devices with default passwords and outdated firmware on the network, the Mirai family has something to build new armies from.

How to protect your company’s IoT devices from being hijacked? First of all, change the default passwords to unique and strong ones on each device before you connect them to the network. Additionally: isolate IoT from critical systems (segmentation), disable unused services and ports, regularly update firmware and inventory what you actually have in the network. These are simple steps that close the most common attack route.