IoT DDoS Attack Code Released

The perpetrator of a massive distributed denial-of-service (DDoS) attack on the KrebsOnSecurity website last month has publicly released the code used in the assault in a move that security analysts fear could make it much easier for others to launch similar salvos.

Called Mirai, the malware is designed to search for and attack Internet-connected consumer devices that are protected only with default passwords and usernames, according to a KrebsOnSecurity blog post on Saturday.

A Hackforums user with the nickname "Anna-senpai" released the code apparently in response to the increased scrutiny of vulnerable IoT devices by ISPs following the recent DDoS attack on the site run by security blogger and researcher Brian Krebs.

Mirai is one of two malware families to have surfaced recently that is designed explicitly to create botnets from vulnerable IoT devices. The other is Bashlight, a malware that is thought to have infected over a million IoT devices and co-opted them into a botnet, according to KrebsOnSecurity, pointing to research from Level 3 Communications.

Mirai is designed to attack IoT systems running BusyBox, which is an executable file that combines multiple small versions of Unix utilities, MalwareTech said in an analysis of the malware. The malware was used to create a botnet comprised mostly of home routers and network-enabled cameras, digital video recorders and other IoT devices.

The botnet was used to launch a 620 Gbps DDoS attack on KrebsOnSecurity's website and another one last week that exceeded 1 Tbps in size against French Internet service provider OVH. Both were easily the largest-ever DDoS attacks in terms of bandwidth size seen so far.

According to MalwareTech, Mirai works by brute-forcing BusyBox systems with a list of over 60 passwords that are commonly used as default. Once on a system, the malware attempts to block others from trying to infect the same machine.

"Mirai appears to be simple and intuitive, which makes it easy to [administer]," says Thomas Pore, director of IT and services at security vendor Plixer International. Once Mirai infects a system, the malware is designed to clean up any trace of its presence in order to avoid detection and to maintain a persistent foothold on the bot, he says.

No Phishing Necessary

What makes Mirai particularly interesting is the use of IoT devices to create a botnet, he says. "The concept of running an IoT botnet is genius because there is no overhead of hiring a spam service to phish users in an attempt to compromise a PC to act as a bot," More says.

For attackers, it is easy and costs next to nothing to scan the Internet for vulnerable IoT devices to attack, he said. And with Mirai source code now publicly available, it is likely that others will begin to use the malware to create their own botnets.

The increased competition for the vulnerable devices, though, could actually result in the scale of Mirai-enabled DDoS attacks becoming smaller, Pore says.

"Perhaps the scale of the attack will lessen if the compromised devices are spread across multiple botnets serving service denials for different targets," he says.

Reiner Kappenberger, global product manager at HPE Security-Data Security, says the release of the Mirai code highlights the problems surfacing from the lack of adequate security practices in the IoT space.

"As shown by this latest development, this is a broad problem that can manifest itself on many IoT devices with extremely damaging results," he says.

Consumers buying IoT devices should make the effort to identify the security controls present in them, he says. A breach in the IoT device can easily move to other systems such as a home computer, thus allowing attackers to steal valuable personal information such as bank account information and credentials.

Related stories: