Mirai

Question 1

What is Mirai?

Answer 1

• IoT botnet which first appeared in 2016
• Actively scans the network and propagates to any vulnerable devices it finds

Question 2

Why is Mirai possible?

Answer 2

• Vulnerabilities
• Weak credentials
• Poor network management
• Always online

Question 3

Process Mirai

Answer 3

1. Scan
2. Report IP + credentials to Listener Server
3. Add new device to Loader Server
4. Load
5. Recruited
6. Send command to C&C server
7. Dispatch command
8. Attack

Question 4

Mirai Mitigation

Answer 4

• Limit exposure to external adversaries
  -> Firewalls, NAT
  -> Close open ports not needed for functionality
• Ensure correct security configuration
• Remove device vulnerabilities
  -> Apply security patches

Question 5

Mirai Detection

Answer 5

• Signature-based intrusion detection
  -> System monitors communications or device behavior for known patterns of attack
  -> Fast and reliable, widely deployed
• Anomaly-based intrusion detection
  -> Detects deviations from normal behavior as anomalies
  -> Able to detect also previously unknown attacks

Question 6

Mirai Recovery

Answer 6

• Network isolation
  -> Traffic filtering rules used to isolate infected device from others
  -> Prevent further injections in the network
  -> Prevent device from attacking remote victims
• Reset device