Understanding the Mirai Botnet Presented by John Johnson

Why this paper? Not a theoretical paper Demonstrates real world consequences Expected creation of billions of IOT devices

The Dark Arts are many, varied, ever-changing, and eternal The Dark Arts are many, varied, ever-changing, and eternal. Fighting them is like fighting a many-headed monster, which, each time a neck is severed, sprouts a head even fiercer and cleverer than before. You are fighting that which is unfixed, mutating, indestructible. - Severus Snape

How do botnets propagate? Scan a target Leverage known exploits Install the botnet software Rinse and repeat

Fighting back We must identify these devices and shut them down But there are so many devices And we have limited resources And users are clueless

Network Telescope Watch the unindexed portions of the internet for suspicious traffic Use fingerprinting to selectively ID 116 billion probes 55 million probers

Identifying infections Detect a vulnerability scan from the infected device Banner scan the device for unclosed services Only tag devices ID’d within 20 minutes of a scan

Honeypots Invaluable for analyzing malware infections Can determine attacker sophistication and behavior based on malware reverse engineering Can dissect infection process

Got Milk? Milkers are similar to honeypots Figure out what commands a C2 server will send Identify additional C2 servers 15,194 attacks identified

Mirai protected itself better than the IOT devices it infected Mirai disables all common unused services Fingerprinting can’t be done by the usual banner grabbing Still able to banner grab lesser known services

Your tired your poor, your low bandwidth DVRs, routers, and cameras are all fair game Atypically composed of devices from non-US countries More like shambling zombies than a pack of cheetahs (bandwidth limits matter)

Not your average botnet Botnet owners didn’t care for persistence This is highly unusual, but makes the botnet much harder to detect A rebooted device would simply be re-infected later

Evolution Why log in when you can steal a devices soul? (RCE variant) It is easy to tack on new infection methods We will continue to see variants of Mirai for some time

But wait! There’s more! Abuse DNS and residual trust Make reversing harder by using complex packers Add support infrastructure, command relays

Attackers suffer from the same pains as regular IOT users Slow initial growth due to the restricted capability of infected devices Infrastructure is required to manage half a million devices 1000 devices to 1 C2 servers

Scalin’ on Up

Notable achievements Knocked Liberia off the internet for a period of time Forced Cloudflare to abandon their deal with Brian Krebs Harassed DDoS mitigation companies Knocked Minecraft servers and other gaming services offline

Script kiddies do not an Advanced Persistent Threat make Mostly childish attacks on people the attackers disliked Minimal if any lasting damage We were very lucky no important services were targeted We could have done better to protect against Mirai

Not the sharpest tools in the shed When I first go in DDoS industry, I wasn't planning on staying in it long. I made my money, there's lots of eyes looking at IOT now, so it's time to GTFO. However, I know every skid and their mama, it's their wet dream to have something besides qbot. So today, I have an amazing release for you. With Mirai, I usually pull max 380k bots from telnet alone. However, after the Kreb DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300k bots, and dropping. - One of the Mirai authors

It will probably get worse Attacks get more sophisticated New attacks come out of nowhere (ransomware) Mirai was only 600k devices (imagine a billion) We don’t know how new attacks will leverage IOT

Heterogeneity makes for a juicy attack surface Easy to target cheap-on-security IOT vendors Startup vendors have less resources/experience to orchestrate patching Spending time to develop exploits for a single device can net you thousands of infected hosts It also makes it harder to compromise the entire market

How do we fix this? Basic hardening (ASLR, priv. separation etc) Teach about patching, make it easier Find a way to reliably take unsupported devices offline Identification? What about privacy?

xkcd.com

It could get better Vendors are slowly replacing hardcoded passwords with generated ones Our society is coming to terms with managing vulnerable devices in a digital age We can educate consumers about how to care for devices better

The Internet of Garbage

Questions?