4

Since every IoT device uses different operating system, and has different hardware architecture, with so many possible platforms, how does Mirai infect them?

Improve this question
3
  • 2
    I doubt your claims so you might add some references which prove these. In my opinion Mirai does not infect all IoT device but only specific devices. Also not every IoT uses a different OS but most use Linux with busybox or similar and then there are some others. And there are also not too much hardware architectures to care of.
    – Steffen Ullrich
    Dec 8, 2016 at 8:24
  • @william your question still makes the assumption that Mirai infects multiple different operating systems. Do you have any reference that this is the case?
    – schroeder ♦
    Dec 8, 2016 at 12:40
  • @william007 did this resolve your question?
    – Gavin Youker
    Dec 20, 2016 at 5:07

1 Answer 1

Reset to default
8

Actually, the Mirai virus was looking for a specific vulnerability present in the Linux operating system.

The Mirai virus targeted Linux devices running telnet via busybox. If busybox is not installed on the Linux device, the exploit fails as Mirai uses busybox specific commands. If busybox is confirmed to exists, Mirai then performs a bruteforce attack on specific ports numbers that are running telnet. How is this bruteforce attack being conducted? It is simply using a dictionary of the most common default username and password combinations. Once inside the system, Mirai looks for other target machines to infect. Here is a list of the Mirai's dictionary. enter image description here

Unfortunately, many owners of IoT devices connect their devices to the Internet and never bothered to change the default login credentials. Here is a list of devices targeted by Mirai. enter image description here More information can be found on the Mirai virus here.

Improve this answer
12
  • Regarding "and never bothered to change the default login credentials" -- many of the devices being targeted by Mirai have (or had) hard-coded telnet account passwords that could not be changed by the user.
    – Ben
    Dec 8, 2016 at 16:03
  • Good answer, but how I know which devices have linux with busybox installed at home?
    – рüффп
    Dec 20, 2016 at 22:27
  • @ruffp Simply type busybox in the command line. If this executes successfully, busybox is on the machine. However, please be aware that busybox is not the culprit here. A new flavor of Mirai could target a Linux distribution without busybox.
    – Gavin Youker
    Dec 20, 2016 at 23:13
  • @GavinYouker thanks for your answer, but for example TV's, PVR's, and things like this, I have no idea if I can reach it by SSH myself (never tried); Just wanted to know if there's a list of potential hardware that uses linuxes as an internal OS.
    – рüффп
    Dec 21, 2016 at 0:26
  • 2
    Additionnaly there is this site: iotscanner.bullguard.com that can help to scan your public IP.
    – рüффп
    Dec 23, 2016 at 22:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .