Motivating a market or regulatory solution to IoT insecurity with the Mirai botnet code

Botnets compromised of IoT devices have been on the rise recently with attacks originating from compromised refrigerators, DVRs, security cameras, and other consumer networking equipment. Most owners of these devices are neither security aware or motivated to secure their IoT devices. Manufacturers of these devices are not currently motivated by market forces or regulatory requirements to improve the security of their products. At 7:00 a.m. on October 21st of 2016 the Mirai IoT botnet launched a DDoS attack against Dyn, a major DNS provider. The attacking hosts generated 1.2 terabits of malicious traffic forcing Dyn off the Internet for hours. This was the second high profile attack by the Mirai botnet. Noted security blogger Brian Krebs' site was the target of the first high profile Mirai attack on September 20, 2016. As a result of the publicity the source code for the botnet was published in early October. We have reviewed the source code and devised a tactic that will use the same compromise vector as the Mirai botnet to catalog vulnerable IoT devices and motivate operators to address their poor security practices. In this paper we discuss our approach and show experimental results that indicate feasibility.

I. Introduction

Botnets continue to be a significant source of large scale attacks on the Internet with recent increases in the volume of attack traffic [1]. A typical botnet platform is composed of command and control (C&C) servers, an infection vector to create new bots, and the bots (compromised hosts). Botnets are used for a variety of purposes including distributed denial of service (DDoS) attacks, spamming, and phishing attacks. The “owners” of the botnet, or botmasters, may be selling their attack services to the highest bidder or pursuing political or personal agendas.