🤖 Mirai Botnet
A Powerful Worm and Botnet Targeting IoT Devices
Cybersecurity Presentation
What is Mirai?
Mirai is a powerful worm and botnet that hacks IoT devices to carry out DDoS attacks.
Key Features:
- Infects Internet of Things (IoT) devices
- Launches massive DDoS attacks
- Primary targets: Minecraft servers
- Uses brute-force password attacks
📅 History: September 2016
- Journalist Brian Krebs' website went down
- Attack launched from many countries using unusual devices
- IP cameras, smart kettles, and similar devices sent simultaneous requests
📹 Infected Devices
Mirai targeted vulnerable IoT devices including:
- 🎥 IP Security Cameras
- Smart Home Devices
- ☕ Smart Kettles
- Home Routers
- 📱 Connected Devices
These devices had weak or default passwords that users never changed.
🦠 Spreading Mechanism
Mirai is a "dumb" worm because it doesn't use exploits.
Brute-Force Method:
- Uses password brute-forcing
- Relies on people not changing default passwords
- Simple but highly effective
Despite its simplicity, as a botnet it's an elegant and powerful system. When Mirai infects a device, it cures the system of other viruses and makes the device safe (for itself).
👮 End of the Botnet (2018)
- In 2018, the FBI caught the developer of Mirai
- He was Paras Jha, a student at Rutgers University
- Brian Krebs was the central figure of this operation
Key Evidence:
Krebs linked Paras Jha's LinkedIn profile to the account "Anna-senpai", who leaked the Mirai source code.
🛑 How to Stop Mirai?
Stopping Method:
- Mirai can be stopped via the C2 (Command and Control server)
- The C2 belongs to the hacker
- If you spoof traffic on an infected device and trace route it, you can find the C2 address
- If you launch a DoS attack on the C2, you can shut down the entire botnet
📊 Aftermath
The Good News:
Fortunately, device developers have become smarter, and default passwords are now randomly generated.
Thank you for your attention!
If you want to try this out, here is the link to the repository. Enjoy! ^_^
