7

I've recently been reading about Mirai, malware whose source has been revealed which is designed to infect IoT devices. It is appears to be a serious threat to security compromised Internet of Things devices. According to Wikipedia:

Mirai (Japanese for "the future") is malware that turns computer systems running Linux into remotely controlled "bots", that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as remote cameras and home routers. The Mirai botnet has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks, including an attack on 20 September 2016 on computer security journalist Brian Krebs's web site, an attack on French web host OVH and the October 2016 Dyn cyberattack.

The article (and others I have read online) shows that Mirai makes the attack by grubbing the internet for devices that are using factory default usernames and passwords from a database. Is it enough, then, to simply change your username and password on an IoT device? Will that protect it from the Mirai attack, or does Mirai have other methods of making it in?

Note: I am not asking how to tell if my devices are infected: I am asking whether changing the password is adequate to prevent infection.

4

Mirai's source code has been released in public, and Jerry Gamblin has kindly created a GitHub repository so that you can easily look through the code for research/academic purposes such as this.

I think you'll get the most authoritative answer by dissecting the code to find out how Mirai finds its targets, so I had a little look around and here's what I found:

  1. There are 61 unique username/password combinations that Mirai is programmed with (these are hard-coded).

  2. The scanner searches only on a limited set of subnets to find targets. These are: 127.0.0.0/8, 0.0.0.0/8, 3.0.0.0/8, 15.0.0.0/7, 56.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/14 , 100.64.0.0/10, 169.254.0.0/16, 198.18.0.0/15, 224...*+, {6, 7, 11, 21, 22, 26, 28, 29, 30, 33, 55, 214, 215}.0.0.0/8. I've grouped the last set of blocks because these were all labelled as "Department of Defense" in the comments of the code.

  3. Mirai performs a rather primitive SYN scan to try and find if any ports are open. If you're not familiar with how SYN scans work, they essentially involve sending a TCP SYN packet, which is the normal process of starting a TCP connection. The attacker then waits in hope of receiving a SYN-ACK packet, which would confirm that the target is listening on the specified port. You can read more about the process on Wikipedia.

  4. Any targets that respond with a SYN-ACK are added to a list of potential victims.

  5. Mirai selects a password to try semi-randomly, using some sort of weighting system and attempts to connect using that.

  6. Mirai then monitors to check if its connection was successful

  7. If the connection times out or something goes wrong, Mirai retries for a maximum of 10 attempts.

  8. If all of this succeeds, tough luck. Your device is now infected until it restarts!

So, in summary, to answer your question, yes, the version of Mirai known publicly will be defeated if you change the username and password. Anyone who modified their copy of Mirai could have added additional attack vectors though, although you might not class that as the same malware type any more.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.