Mirai

securitynetworking

A 2016 botnet that hijacked IoT devices to launch record DDoS attacks.

Mirai scanned for internet-of-things devices with default credentials and enlisted them into a botnet that took down major services through massive traffic floods. Its source code was released publicly, spawning many variants.

Mirai built a botnet from consumer devices, cameras, recorders and routers, by trying a short list of default credentials over telnet. That is the entire technique: no vulnerability, no exploit, just accounts the manufacturers shipped and the owners never changed because most did not know the accounts existed.

The attacks it enabled were among the largest denial of service events recorded, including one that disrupted a major DNS provider and took a substantial portion of the web's recognizable names offline for users in several regions. That is the consequential part: the targets were not the device owners, who noticed nothing, and the harm landed entirely on third parties.

The source code was published, which produced a long tail of variants and made the underlying lesson unavoidable. Device security is an externality: the manufacturer competes on price, the owner experiences no harm, and the cost falls on the internet at large, which is a market failure rather than a technical problem. That is why the eventual responses were regulatory, banning default passwords and requiring update mechanisms, since no participant in the transaction had an incentive to fix it.

Also known as: Mirai, Mirai botnet

← All glossary entries