In the ever-evolving landscape of cybersecurity threats, one name that looms large is Mirai Malware. This insidious software has garnered a lot of notoriety recently for its ability to transform innocuous smart devices into powerful tools for orchestrating Distributed Denial of Service (DDoS) attacks. But, what exactly is Mirai and what makes it so deadly?
What is Mirai?
Mirai represents a form of malicious software that targets smart devices equipped with ARC processors, transforming them into a network of remotely controlled bots or "zombies." This network, commonly referred to as a botnet, is frequently utilized to execute Distributed Denial of Service (DDoS) attacks.
How does Mirai operate?
Mirai systematically scans the Internet for Internet of Things (IoT) devices utilizing ARC processors, which run a streamlined version of the Linux operating system. If the default username and password are left unchanged, Mirai gains access to the device, subsequently infecting it.
IoT, an abbreviation for the Internet of Things, encompasses smart devices like baby monitors, vehicles, network routers, agricultural devices, medical devices, environmental monitoring devices, home appliances, DVRs, CC cameras, headsets, and smoke detectors.
The Mirai botnet employed approximately one hundred thousand compromised IoT devices to disrupt Dyn.
Who were the architects of the Mirai botnet?
Paras Jha, aged twenty-one, and Josiah White, aged twenty, co-established Protraf Solutions, a company providing mitigation services for DDoS attacks. Their modus operandi involved offering DDoS mitigation services to the very organizations targeted by their malware.
In September 2016, the creators of Mirai orchestrated a DDoS attack on the website of a prominent security expert. Subsequently, they released the source code to the public, potentially to obscure the origins of the attack. This code was swiftly replicated by other cyber criminals and is suspected to be responsible for the significant attack that disrupted the services of domain registration provider Dyn in October 2016.
Why does the Mirai malware pose an ongoing threat?
Mirai exhibits a capacity for mutation.
Although the original creators have been apprehended, the source code persists, giving rise to variants like Okiru, Satori, Masuta, and PureMasuta. For instance, PureMasuta can exploit the HNAP bug in D-Link devices, while the OMG strain transforms IoT devices into proxies enabling cybercriminals to maintain anonymity.
A recently discovered and potent botnet, alternatively known as IoTrooper and Reaper, surpasses Mirai in infecting IoT devices at an accelerated rate. Reaper can target a broader array of device makers and exerts greater control over its bots.
Botnet - Networked Malicious Bots
The term "malware" encompasses various types of malicious software, such as computer worms, viruses, Trojan horses, rootkits, and spyware.
What are the different botnet architectures?
- Centralized Botnets
In the metaphorical play of a botnet, the Command and Control Server (C&C) serves as the director. The compromised bots, akin to actors, communicate timed signals to the C&C upon infection. This centralized approach allows direct command transmission but renders the C&C susceptible to a single point of failure.
- Tiered C&Cs
Botnet control may be organized in tiers with multiple C&Cs, and dedicated servers serving specific functions. This organizational structure enhances resilience against takedowns.
- Decentralized Botnets
Peer-to-peer (P2P) botnets represent the next evolution, eliminating the need for a centralized server. P2P bots function as both command servers and clients, mitigating the vulnerability of a single point of failure. Examples include Trojan.Peacomm and Stormnet.
How does malware convert IoT devices into bots or zombies?
In general, email phishing proves effective in infecting computers, with victims either clicking malicious links or downloading infected attachments. In the case of Mirai, the malware exploits unchanged default credentials on newly installed devices.
What is the link between Mirai and click fraud?
Click fraud involves the fraudulent manipulation of cost-per-click (CPC) data in online advertising. Mirai's original creators were convicted for leasing their botnet for both DDoS attacks and click fraud.
Why are botnets perilous?
Botnets wield the potential to impact various facets of individuals' lives, regardless of IoT or internet usage. Botnets can:
- Attack ISPs, causing denial-of-service to legitimate traffic
- Generate spam email
- Launch DDoS attacks, leading to website and API disruptions
- Execute click fraud
- Bypass weak CAPTCHA challenges on websites
- Steal credit card information
- Ransom companies with DDoS threats
Why is controlling botnet proliferation challenging?
Numerous factors contribute to the difficulty of curbing botnet proliferation:
- IoT Device Owners
Owners often neglect securing smart devices as there's no immediate cost or service interruption. Rebooting infected systems may offer a temporary solution, but the constant scanning for potential bots allows for rapid reinfection.
- ISPs
The increased traffic from infected devices is often overshadowed by media streaming, providing little incentive for ISPs to intervene.
- Device Manufacturers
Low-cost device manufacturers lack incentives to invest in security. Holding them accountable might drive change, but enforcement challenges persist.
- Magnitude
The sheer volume of ARC-processor-based devices, exceeding a billion-and-a-half annually, enhances the potential impact of malware variants.
- Simplicity
Readily available botnet kits eliminate the need for technical expertise, enabling leasing for as low as $14.99-$19.99 per month.
- Global IoT Security Standards
The absence of a global entity or consensus to define and enforce IoT security standards poses a challenge.
- Global Law Enforcement
Tracking and prosecuting botnet creators is difficult without a global organization akin to Interpol for cybercrime. DNS techniques like Fast Flux make botnets elusive.
