IoT(Internet Of things) Booming Technology is No more Safe

Source Code IoT Botnet Mirai is responsible for World's Largest DDoS Attack.

Mirai: Mirai is a piece of malware designed to target IoT devices in order to perform DDoS attacks This Botnet is used in the 620 Gbps DDoS attack on Brian Kreb’s blog and the 1.1 Tbps attack on OVH a few days before. It is responsible for the largest DDoS attack.

IoT: IoT is Internet of Things, a booming technology which used to describe the new generation of “smart” internet connected devices (fridges, toasters, CCTV)

It’s just text a message on your mobile if your fridge, CCTV any device connected to the IoT device used in questionable way.

Mirai propagates by bruteforcing telnet servers with a list of 62 horribly insecure default passwords, starting with the famous username passwd combination admin:admin. Although Mirai could technically infect any box upon successful login, it uses a busybox specific command which causes the infection to fail if busybox is not present. Once inside a box, the malware will attempt to kill and block anything running on ports 22, 23, and 80, essentially locking out the user from their own device and preventing infection by other malware. Despite Mirai killing most control panels, it is possibly to use Shodan to see which services of  the box was exposing prior to infection, giving us an idea of the type of boxes which are infected.

The source code that powers the “Internet of Things” (IoT) botnet responsible for launching the DDoS Attack against KrebsOnSecurity last month has been publicly released, virtually guaranteeing that the Internet will soon be flooded with attacks from several new botnets powered by insecure routers, IP cameras, digital video recorders and other easily targeted devices.

The leak of the source code was announced Friday on the English-language hacking community Hack Forums. The malware, dubbed “Mirai,” spreads to vulnerable devices by continuously scanning the Internet for IoT systems protected by  default username passwords or hard-coded usernames and passwords.

Brian Krebs, the popular cybersecurity researcher, reported the Unfortunate development and stated that it is the same botnet responsible for attack on his website (OVH’s). The botnet is based on the trojan malware ‘Mirai’, and utilizes vulnerable or compromised Internet of Things (IoT) devices. It continuously scans for smart home systems protected by default username and passwords or hard-coded login credentials and sends them to report to a centralized ‘control’ server.

The botnet is, thus, powered by a sum of insecure routers, IP cameras, digital video recorders and other easily targeted devices and has led to fears that it can now practically be used by anyone to flood the internet with a DDoS attack. Sources have reported to Krebs that Mirai is one of the two malware families (the other being Bashlight) being employed to quickly create IoT-based DDoS armies. Botnets based on Bashlight are currently exploiting data from about a million IoT devices to flood the attack site with gigs of traffic.

Hacker, In his post in Hack forums he says that:

When I first go in DDoS industry, I wasn’t planning on staying in it long. I made my money, there’s lots of eyes looking at IOT now, so it’s time to GTFO. So today, I have an amazing release for you. With Mirai, I usually pull max 380k bots from telnet alone. However, after the Kreb DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300k bots, and dropping.

With the release of such a powerful malware, the hackers can now access the publically available code and add it to their arsenal. And since the code is available to all, it will become extremely difficult for the govt. authorities to put a halt to the chaos that’s upon them. It will become a little difficult for them to pin-point and track the ‘master’ operator of the malware. Link for source Code:

https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be681b839eeff8ece1de8b245bcd5ffb02/mirai/bot/scanner.c#L123

It is like two faces of the same coin that is morphing with each passing day. He’s also stated that infected systems can be cleaned up by simply rebooting them as it removes the malicious data from the memory. But to protect your IoT device from repeated scanning and intrusion, you’ll need to change your default login credentials.

If you’re unaware, KrebsonSecurity website was recently hit with one of the largest DDoS attacks and kncked offline. With traffic amounting to a total of 620 Gbps, the attackers flooded his website in retaliation of him uncovering the masterminds behind some of the largest DDoS attacks in the last decade. His DDoS protection provider Akamai — who provides pro-bono services — to the website pulled support amid the attack and Krebs had to seek support from the Google Shield Project to bring back their website from the dead.

And after this, OVH, a french hosting company was attacked with the world’s largest-known DDoS attack. It was a record-breaking attack, where two simultaneous attacks hit the server and one of the two attacks alone peaked to 799 Gbps of traffic. The hackers had targeted Minecraft servers hosted on the OVH network, and the attack was carried out using a botnet made up of arround 145,000 IoT devices.