How is the Mirai botnet directed?

Question

One of the recent malware making the rounds is the Mirai botnet, which seems to be focused in Linux-based Internet-of-Things devices. It has been used for DDos atacks on many major websites, including GitHub, Twitter, Reddit, Netflix, Airbnb, and the Dyn DNS service, and is allegedly responsible for killing business in Liberia. Many people have modified the malware to become more potent, some claiming to be its successor.

I suppose this applies to other targeting malware, but I am mainly interested in the Mirai botnet.

How does the creator "control" the botnet to focus on a specific target?

Answer 1

Mirai uses a fairly standard Command and Control structure - the only real difference being that the code for the C&C was made public early on, so it can be updated and reused easily.

This ars technica article on Mirai outlines one of the strengths of Mirai's C&C:

The simplicity of Mirai's C&C structure makes scaling it up relatively simple. "One of the things we noticed during the Dyn attack was that the C&C domain would change its address," Nixon explained. "That way, the C&C network could segment its botnet." By simply changing a DNS entry, the attacker could use the same domain to create and operate multiple separate botnets simultaneously.

When a Mirai bot is created, it sends a request to the Domain Name Service for the "A" address of a domain configured by its creator. Once it has the Internet address associated with that "A" address, it locks onto that IP address. "When one C&C server fills up, [the botnet operator] can just change the IP address associated with that 'A' name," Nixon explained. New bots will connect to the new address while older bots continue to communicate with the previously labeled server.

While this scheme can cause problems with resiliency of the botnet—if a C&C server gets identified and its traffic is shut down, the bots fail—it's not a big problem for the botnet long-term. The botnet can easily be re-established from another server by simply re-discovering vulnerable devices.

Answer 2

The answer can be fairly lengthy. However I think I shouldn't copy wholesale from what others had done.

While there are pretty good answers here to your questions. I believe the article you should be looking at is this.

Incapsula Mirai Botnet Analysis Incapsula in depth analysis breaks down the Mirai components down to the source level which gives you deeper understanding.

There is more pictorial view of Mirai too from pwnie express; a two part series.

For information:

Symantec detects Mirai as a Trojan named Linux.gafgyt