IntroductiontoMiraiLuisEspinoza

lespinoz@akamai.com

Hardcodedlistofuser/passusedbyMirai

https://krebsonsecurity.com/wp-content/uploads/2016/10/IoTbadpass-Sheet1.pdf

loader/src/headers/includes.h

loader/src/headers/binary.h

mirai/bot/ Botindevice

dlr

resolv.c

main.c

scanner.c Staticuser/pass

scanner.c IPexceptions

mirai/cnc/ Command-&-Control

admin.go

attack.go

• AttackName:“udp”,“vse”,“dns”,“syn”,“ack”,“stomp”,“greip”,“greeth”,“udpplain”,“http”• Attacktargets:“CommadelimitedlistoftargetprefixesEx:192.168.0.1Ex:10.0.0.0/8Ex:8.8.8.8,127.0.0.0/29”• AttackDuration:“Durationmustbebetween0and3600seconds”• Flags:“len”,“rand”,“tos”,“ident”,“sport”,“dport”,“domain”…

main.go

mirai/tools/scanListen.go Botscanreport

Problemofvolume• The“InternetofThings”isexploding.Itismadeupofbillionsof“smart”devices—fromminisculechipstomammothmachines—thatusewirelesstechnologytotalktoeachother(andtous).OurIoT worldisgrowingatabreathtakingpace,from2billionobjectsin2006toaprojected200billionby2020.1 Thatwillbearound26smartobjectsforeveryhumanbeingonEarth!

• 1IDC,Intel,UnitedNations.

*http://www.intel.com/content/www/us/en/internet-of-things/infographics/guide-to-iot.html

Comments?Thankyou!