Mirai: when cameras and routers took down the internet

The story

Mirai was malware that searched the internet for devices like security cameras, video recorders and home routers. It tried to sign in using a short list of factory default usernames and passwords. A huge number of devices still used them.

Each device it got into became part of a botnet: a network of hijacked machines that could be told to do the same thing at once. In September 2016, the botnet flooded the website of security journalist Brian Krebs with traffic. In October, it hit Dyn, a company that runs part of the internet’s address system, known as DNS. For hours, people in the US and Europe could not reach many large websites.

Mirai was written by three young men in the US who had first used it in disputes over servers for the game Minecraft. They published the code online, and others copied it. They later pleaded guilty.

Why it mattered

Mirai showed that cheap devices nobody thinks of as computers can be turned against the internet itself. Because its code was published, others kept building new versions of it for years. A device still using its factory password can be taken over again within minutes of being restarted.

The lesson today

Nothing clever was needed: the devices were still using the passwords printed in their manuals. Any device on your network, from a printer to a doorbell, needs its default password changed, its updates applied and, ideally, its own separate network.