The document summarizes the Mirai botnet, which infected hundreds of thousands of internet-connected devices to conduct large-scale DDoS attacks. It describes how Mirai propagated by scanning for vulnerable devices and installing malware. Researchers used network telescopes and honeypots to identify infected devices and attacks. The botnet brought down websites and services but caused no major, lasting damage. Future botnets may become more sophisticated with new infection methods and command infrastructure, leveraging the billions of devices expected to connect to the internet. Improving device security through patching and design is needed to address this growing threat.

1. Understanding the Mirai
Botnet
Presented by John Johnson

2. Why this paper?
 Not a theoretical paper
 Demonstrates real world consequences
 Expected creation of billions of IOT devices

3. The Dark Arts are many, varied, ever-changing, and eternal.
Fighting them is like fighting a many-headed monster, which,
each time a neck is severed, sprouts a head even fiercer and
cleverer than before. You are fighting that which is unfixed,
mutating, indestructible.
- Severus Snape

4. How do botnets propagate?
 Scan a target
 Leverage known exploits
 Install the botnet software
 Rinse and repeat

5. Fighting back
 We must identify these devices and shut them down
 But there are so many devices
 And we have limited resources
 And users are clueless

6. Network Telescope
 Watch the unindexed portions of the internet for suspicious
traffic
 Use fingerprinting to selectively ID
 116 billion probes
 55 million probers

7. Identifying infections
 Detect a vulnerability scan from the infected device
 Banner scan the device for unclosed services
 Only tag devices ID’d within 20 minutes of a scan

8. Honeypots
 Invaluable for analyzing malware infections
 Can determine attacker sophistication and behavior based on
malware reverse engineering
 Can dissect infection process

9. Got Milk?
 Milkers are similar to honeypots
 Figure out what commands a C2 server will send
 Identify additional C2 servers
 15,194 attacks identified

10. Mirai protected itself better than the IOT
devices it infected
 Mirai disables all common unused services
 Fingerprinting can’t be done by the usual banner grabbing
 Still able to banner grab lesser known services

11. Your tired your poor, your low bandwidth
 DVRs, routers, and cameras are all fair game
 Atypically composed of devices from non-US countries
 More like shambling zombies than a pack of cheetahs
(bandwidth limits matter)

12. Not your average botnet
 Botnet owners didn’t care for persistence
 This is highly unusual, but makes the botnet much harder to
detect
 A rebooted device would simply be re-infected later

13. Evolution
 Why log in when you can steal a devices soul? (RCE variant)
 It is easy to tack on new infection methods
 We will continue to see variants of Mirai for some time

14. But wait! There’s more!
 Abuse DNS and residual trust
 Make reversing harder by using complex packers
 Add support infrastructure, command relays

15. Attackers suffer from the same pains as
regular IOT users
 Slow initial growth due to the restricted capability of infected
devices
 Infrastructure is required to manage half a million devices
 1000 devices to 1 C2 servers

16. Scalin’ on Up

18. Notable achievements
 Knocked Liberia off the internet for a period of time
 Forced Cloudflare to abandon their deal with Brian Krebs
 Harassed DDoS mitigation companies
 Knocked Minecraft servers and other gaming services offline

19. Script kiddies do not an Advanced
Persistent Threat make
 Mostly childish attacks on people the attackers disliked
 Minimal if any lasting damage
 We were very lucky no important services were targeted
 We could have done better to protect against Mirai

20. Not the sharpest tools in the shed
When I first go in DDoS industry, I wasn't planning on staying in it
long. I made my money, there's lots of eyes looking at IOT now, so it's
time to GTFO. However, I know every skid and their mama, it's their
wet dream to have something besides qbot.
So today, I have an amazing release for you. With Mirai, I usually pull
max 380k bots from telnet alone. However, after the Kreb DDoS, ISPs
been slowly shutting down and cleaning up their act. Today, max pull
is about 300k bots, and dropping.
- One of the Mirai authors

21. It will probably get worse
 Attacks get more sophisticated
 New attacks come out of nowhere (ransomware)
 Mirai was only 600k devices (imagine a billion)
 We don’t know how new attacks will leverage IOT

22. Heterogeneity makes for a juicy attack
surface
 Easy to target cheap-on-security IOT vendors
 Startup vendors have less resources/experience to orchestrate
patching
 Spending time to develop exploits for a single device can net you
thousands of infected hosts
 It also makes it harder to compromise the entire market

23. How do we fix this?
 Basic hardening (ASLR, priv. separation etc)
 Teach about patching, make it easier
 Find a way to reliably take unsupported devices offline
 Identification? What about privacy?

24. xkcd.com

25. It could get better
 Vendors are slowly replacing hardcoded passwords with
generated ones
 Our society is coming to terms with managing vulnerable
devices in a digital age
 We can educate consumers about how to care for devices
better

27. The Internet of Garbage

28. Questions?