My understanding of worms like Mirai is the following:
- Try to telnet/ssh into random IPs using default user/pass credentials from various router/IoT manufacturers
- If you get in, do Bad Things™.
It seems the targets are generally home/consumer devices, which would be on a home LAN. From Wikipedia:
[Mirai] primarily targets online consumer devices such as remote cameras and home routers.
So here's what I don't get. Why would a remote camera/printer/whatever ever have a public facing IP? They would only be accessible by NAT through the gateway, right? So a telnet request on port 23 would never reach it!
For example. Suppose I bought a camera with telnet credentials "root:123456". I then connect it to my wifi. Why would it matter to a Mirai worm outside the network that I have this vulnerable camera? If the worm tried to telnet to my public IP, it would only be able to try to telnet into my router, not the camera!