The Mirai malware has become notorious for recruiting Internet of Things devices to form botnets that have launched some of the largest distributed denial-of-service (DDoS) attacks recorded to date. Mirai came onto the scene in late 2016 as the malware behind very large DDoS attacks, including a 650 Mbps attack on the Krebs on Security site. It’s also purported to have been the basis of the attack in October 2016 that brought down sites including Twitter, Netflix, Airbnb and many others. Since then, Mirai has morphed into an even more aggressive and effective botnet tool.
When the research team at Imperva accessed the Incapsula logs after the Krebs attacks last fall, they found that, indeed, the Mirai botnet had been active well before the notorious September attack. Imperva discovered a botnet of nearly 50,000 Mirai-infected devices spread throughout 164 countries, with the top-infected countries identified as Vietnam, Brazil and the United States. But even before Mirai became public, the Imperva team saw vulnerable IoT devices as a problem in the making.
Back in 2014, Imperva started seeing a massive increase in the number of weekly unique DDoS bot sessions and identified closed-circuit television (CCTV) surveillance devices as a contributing factor, most of which were open to easily guessable default passwords. In 2015, Imperva discovered a botnet executing HTTP GET flood DDoS attacks peaked around 20,000 requests per second from 900 CCTV cameras throughout the globe. The Imperva research foreshadowed the targeting of IoT devices as a new and plentiful source of botnets.
It wasn’t until Mirai was publically announced on Hack Forums in October that Imperva’s IoT prediction gained energy. Like legitimate source code, Mirai has seen a number of improvements since its release. Mirai’s focus on effectiveness at aggressively recruiting some of the most vulnerable IoT devices has made it a popular choice for hackers who want to create very large botnets.
Only weeks after the release of the original Mirai source code, Imperva documented a new variant that was found to be responsible for exploiting a newly discovered TR-069 vulnerability on wireless routers. To make the malware even more effective, the authors added the ability to close the vulnerability after the router was infected, making it more difficult to update the devices remotely until they could be rebooted.
In March, Imperva Incapsula mitigated a Mirai-based attack that indicated the malware had mutated yet again. Before this attack, it appeared as though the Mirai botnet DDoS attacks focused on launching network-layer DDoS attacks—attacks that try to flood the network pipes, forcing Web traffic to slow to a crawl. These new attacks saw a Mirai botnet launch an application layer attack on a U.S. college website that lasted for more than 54 hours. In total, the attack generated more than 2.8 billion requests. What’s interesting about Mirai’s ability to launch application-layer attacks is that it takes far fewer bots to bring a website down through an application attack. In this case, it took fewer than 10,000 infected IP cameras, DVRs and routers to launch a sizeable attack.
This brings us to Persirai, the newest version of Mirai that was discovered last month by researchers at Trend Micro and comes equipped with even more advanced features. Previous versions of Mirai used to rely on guessing default passwords, so any IoT devices that had default passwords changed were considered protected. Researchers discovered that Persirai became even more aggressive by exploiting a zero-day vulnerability to steal the password file from an IP camera, regardless of password strength. Persirai’s ability to leverage the previous features, plus its password-stealing capability, has led to a substantial increase in the number of infected devices.
Persirai is on an aggressive recruitment push. Within a month after being released, Persirai has come to dominate the Mirai-variant infected devices with more than 64 percent of all infections. Particularly alarming is the password-stealing feature of the new Persirai variant, which renders previous recommendations about simply updating passwords outdated. While a Persirai-infected device is not likely to malfunction, no organization wants to host a battalion of DDoS foot-soldiers.
Additional measures to ensure that IoT devices do not become unwitting members of a Persirai botnet include blocking Internet access to admin ports and disabling universal plug-and-play (UPnP) on the router or firewall. Also consider isolating IoT devices on your network using segmentation or firewall policies, and only let IoT devices communicate with IP addresses that are approved. To avoid becoming the victim of a DDoS attack regardless of the botnet, consider subscribing to a DDoS mitigation service.
Robert Hamilton is the director of product marketing for the Incapsula service at Imperva. Incapsula is a cloud-based application delivery service that protects websites and increases their performance, improving end-user experiences and safeguarding Web applications and their data from attack.