4

Since every IoT device uses different operating system, and has different hardware architecture, with so many possible platforms, how does Mirai infect them?

  • 2
    I doubt your claims so you might add some references which prove these. In my opinion Mirai does not infect all IoT device but only specific devices. Also not every IoT uses a different OS but most use Linux with busybox or similar and then there are some others. And there are also not too much hardware architectures to care of. – Steffen Ullrich Dec 8 '16 at 8:24
  • @william your question still makes the assumption that Mirai infects multiple different operating systems. Do you have any reference that this is the case? – schroeder Dec 8 '16 at 12:40
  • @william007 did this resolve your question? – Gavin Youker Dec 20 '16 at 5:07
8

Actually, the Mirai virus was looking for a specific vulnerability present in the Linux operating system.

The Mirai virus targeted Linux devices running telnet via busybox. If busybox is not installed on the Linux device, the exploit fails as Mirai uses busybox specific commands. If busybox is confirmed to exists, Mirai then performs a bruteforce attack on specific ports numbers that are running telnet. How is this bruteforce attack being conducted? It is simply using a dictionary of the most common default username and password combinations. Once inside the system, Mirai looks for other target machines to infect. Here is a list of the Mirai's dictionary. enter image description here

Unfortunately, many owners of IoT devices connect their devices to the Internet and never bothered to change the default login credentials. Here is a list of devices targeted by Mirai. enter image description here More information can be found on the Mirai virus here.

  • Regarding "and never bothered to change the default login credentials" -- many of the devices being targeted by Mirai have (or had) hard-coded telnet account passwords that could not be changed by the user. – Ben Dec 8 '16 at 16:03
  • Good answer, but how I know which devices have linux with busybox installed at home? – рüффп Dec 20 '16 at 22:27
  • @ruffp Simply type busybox in the command line. If this executes successfully, busybox is on the machine. However, please be aware that busybox is not the culprit here. A new flavor of Mirai could target a Linux distribution without busybox. – Gavin Youker Dec 20 '16 at 23:13
  • @GavinYouker thanks for your answer, but for example TV's, PVR's, and things like this, I have no idea if I can reach it by SSH myself (never tried); Just wanted to know if there's a list of potential hardware that uses linuxes as an internal OS. – рüффп Dec 21 '16 at 0:26
  • 2
    Additionnaly there is this site: iotscanner.bullguard.com that can help to scan your public IP. – рüффп Dec 23 '16 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.