I've recently been reading about Mirai, malware whose source has been revealed which is designed to infect IoT devices. It is appears to be a serious threat to security compromised Internet of Things devices. According to Wikipedia:
Mirai (Japanese for "the future") is malware that turns computer systems running Linux into remotely controlled "bots", that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as remote cameras and home routers. The Mirai botnet has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks, including an attack on 20 September 2016 on computer security journalist Brian Krebs's web site, an attack on French web host OVH and the October 2016 Dyn cyberattack.
The article (and others I have read online) shows that Mirai makes the attack by grubbing the internet for devices that are using factory default usernames and passwords from a database. Is it enough, then, to simply change your username and password on an IoT device? Will that protect it from the Mirai attack, or does Mirai have other methods of making it in?
Note: I am not asking how to tell if my devices are infected: I am asking whether changing the password is adequate to prevent infection.