Mirai Botnet Massive DDoS Attacks

What happened

In September 2016, the Mirai botnet launched a 620 Gbps DDoS attack against security journalist Brian Krebs' website, followed by a 1.1 Tbps attack on French web host OVH. The malware's source code was then released publicly. In October, Mirai was used to attack the DNS provider Dyn, causing widespread internet outages across the US and Europe.

Technical mechanism

Mirai continuously scanned the internet for vulnerable IoT devices (like cameras and routers) and infected them using a hardcoded list of 62 default usernames and passwords. The infected devices were then commanded to flood targets with traffic.

Why it matters

Mirai demonstrated the severe systemic risk posed by insecure Internet of Things (IoT) devices, fundamentally changing the scale of DDoS attacks and prompting calls for IoT security regulation.

Impact

Record-breaking DDoS attacks caused significant disruption to major websites and internet infrastructure. The public release of the source code spawned numerous variant botnets.

Response

CISA and other agencies issued alerts advising users to change default passwords on IoT devices. ISPs and DNS providers heavily invested in DDoS mitigation capacity.

Defensive lessons

• Manufacturers must eliminate default, hardcoded passwords in IoT devices and implement secure-by-default configurations.
• Organizations must ensure their critical infrastructure (like DNS) has robust DDoS protection and redundancy.

Evidence register

1. CISA — Heightened DDoS Threat Posed by Mirai and Other Botnets (verified)