What it actually did

Strip to its mechanism and it is almost insultingly simple. It scanned the internet for devices with telnet open. When it found one, it tried logging in from a built-in table of about sixty username and password pairs - admin/admin, root/12345, support/support, the combinations printed in manuals and burned into by manufacturers who assumed nobody would leave the device facing the internet. If a pair worked, it loaded itself, reported to a controller and started scanning for more.

There is no vulnerability in that description. No buffer overflow, no injection, no memory-safety bug, nothing for a to patch. Mirai did not break into anything. It logged in. At its peak it held as many as three hundred thousand devices - IP cameras, home routers, digital video recorders - and the traffic it could generate was more than an order of magnitude beyond what the industry had considered alarming a few months earlier. The distributed denial of service family history places it in that lineage; this article is about where it came from and what it means that the entry method was a factory default.

Minecraft

The origin, established in court, is one of the strangest in this catalogue. Paras Jha, twenty-one, of Fanwood, New Jersey and a student at Rutgers; Josiah White, twenty, of Washington, Pennsylvania; Dalton Norman, twenty-one, of Metairie, Louisiana. Court filings split the work cleanly: White built the telnet scanner and the loader, Jha wrote the command-and-control and the bot's remote-control features, Norman developed new exploits.

The motive was money, and the money was Minecraft. A popular server hosting the game earns real revenue from a few thousand simultaneous players, and the way to hurt a competitor is to knock it offline at peak. Jha and White also ran a company, ProTraf Solutions, which sold protection against exactly the kind of attack they were running - a business model Brian Krebs described as firemen getting paid to put out the fires they started.

The FBI's own characterisations, made after the pleas, are worth recording because they are not the language of people minimising a case. One supervisory agent said the three did not realise the power they were unleashing, and called it the Manhattan Project. Another said that denial of service at a certain scale poses an existential threat to the internet, and that Mirai was the first botnet he had seen reach that level.

The attack that started the investigation, and the release that followed

On 20 September 2016 Mirai turned on Brian Krebs, whose site had been reporting on the market for denial-of-service-for-hire, with an attack measured at 620 gigabits per second. Days later a French hosting provider was hit harder still, past a terabit per second.

Then the source code was published on a hacker forum by a user calling himself Anna-senpai. This is a recognised move and worth understanding as one: releasing the code creates a crowd. Once hundreds of people are running variants, attribution becomes an argument about who ran which fork rather than a search for one author. The post included a boast that is also, accidentally, a measurement of the response: with Mirai the author usually pulled a maximum of 380,000 bots from telnet alone, but after the Krebs attack the providers had been slowly cleaning up, and the maximum pull was down to about 300,000 and dropping.

The release worked as intended and also failed. It failed because Krebs investigated his own attack and, in January 2017, named Jha. It worked in the sense that mattered technically: the code is still out there. The Dyn attack of October 2016, which took a large part of the internet's name resolution with it, was carried out by other people using the published source - the Dyn entry covers what that did to DNS. Variants have been appearing ever since, retargeted at whatever new class of device ships with a default.

The sentence

All three pleaded guilty in the District of Alaska on 8 December 2017 to conspiracy under the Computer Fraud and Abuse Act, and to a separate click-fraud conspiracy; Jha additionally pleaded guilty in New Jersey to a series of denial-of-service attacks against Rutgers, where he was a student.

None of them went to prison. In September 2018 they received probation, two thousand five hundred hours of community service each and restitution, on the strength of extensive cooperation with the FBI - work on other botnet investigations that reportedly continued after sentencing. Whatever one concludes about that outcome, it belongs in the record beside the damage, and it is one of the clearest examples of a justice system deciding that the capability was worth more than the punishment.

Why this is a different kind of lesson

Every other incident in this catalogue has a patch somewhere in it. The worm era is nine years of fixes that shipped before the outbreak. EternalBlue had fifty-nine days. Mirai had nothing, because there was nothing to fix. The device was working exactly as designed.

That makes it the catalogue's clearest externality. The manufacturer who ships a camera with telnet enabled and a printed password bears none of the cost when it is recruited: the camera keeps working, the owner sees nothing, and the harm lands on a journalist, a hosting provider, or every user of a name-resolution service on the other side of the world. There is no market pressure on the manufacturer because the buyer cannot observe the defect and would not be the one to suffer it. This is the same structural problem the no-perfect-code argument describes for disclosure, and it has the same shape: the party who can fix it is not the party who pays.

Which is why the fix, when it came, was not technical. California's law on connected devices, and the United Kingdom's product security regime, prohibit shipping consumer equipment with a shared universal default password. That is regulation doing what patching structurally could not, and it took roughly five years after Mirai to arrive.

What a practitioner should take from it

Inventory by what is reachable, not by what is managed. The Mirai population was devices nobody thought of as computers, bought by facilities teams, installed by contractors, and never entered in an asset register. The worm era's first question - what is reachable? - is the same question, and cameras and controllers are where it goes unanswered.

Outbound matters as much as inbound. A compromised camera is not primarily a risk to its owner; it is a weapon pointed at someone else, and egress filtering and rate limiting are how a network stops being a contributor. Very few enterprise networks would notice.

And a default is a decision. Every device shipping with credentials, an open management protocol or a service enabled that most buyers will never use is a default someone chose, and it will be the configuration on the large majority of units forever. That is true of enterprise equipment too - which is the practical reason to read the hardening guide rather than assume the factory state is a safe one.

Sources