Mirai Botnet: How Hacked Webcams Took Down Netflix and Twitter

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On October 21, 2016, Netflix, Twitter, Reddit, GitHub, and Airbnb went dark for millions of people. The weapon was an army of baby monitors, cheap webcams, and home routers infected by malware called Mirai. Its creators were three young men: Paras Jha, known online as Anna-senpai, Josiah White, and Dalton Norman. Jha ran ProTraf Solutions, a company that sold protection against the very kind of attack he was launching, and their first targets were rival Minecraft servers.

This episode explains how Mirai worked. It scanned the internet for devices with open Telnet ports and tried a hard-coded list of just over 60 factory default usernames and passwords. Then it follows the escalation, from a 620 gigabit per second attack on journalist Brian Krebs to the flood that crippled DNS provider Dyn. When the FBI closed in, the creators published the source code on Hackforums, and variants have been multiplying ever since.

• As a Rutgers undergraduate, Jha repeatedly knocked out the university's network and gloated on Reddit that he was angry about the campus bus schedule, costing Rutgers $300,000 in emergency consulting.
• Mirai deleted rival malware on devices it infected and carried a blacklist that skipped the US Postal Service and the Department of Defense.
• The malware lived only in volatile memory, so a reboot wiped it, but a device with an unchanged default password was reinfected within minutes.
• A November 2016 Mirai variant aimed at Deutsche Telekom routers failed to take control but crashed about 900,000 of them.
• All three pleaded guilty and received five years of probation after helping the FBI, while Jha was also ordered to pay $8.6 million in restitution and serve six months of home incarceration.