From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected though? Is this done through manual scanning like through the C&C server? I found a couple related questions namely How Mirai scans or find targets but I am still unclear on how this would initially begin if there were no bots in the botnet in the first place.

  • The question your reference and others answer already how Mirai finds and infects its victims. They might use existing botnets to do their scanning but they don't need to. "I believe this only answers how infection is continued through infected devices" - I don't think this assumption is correct. The problem is the insecurity of the device in the first place and not that there might be some other malware on it already. Though some of them the attacks then fix the insecurity of the device so that no other malware can infect the device again and "steal" their botnet. – Steffen Ullrich Jan 22 '18 at 4:20
  • So I think me saying that it only answers how it is continued is not exactly the best way of putting it so I will edit this out, thank you. But the question I am trying to have clarified is regarding how this process begins. All the literature I've read so far imply that already registered bots that are already in the botnet scan for new potential victims. Assuming at some point there existed no botnet, how is this to be formed? Did someone buy an IoT device and just infect it on their own and start this whole thing? Please let me know if this clears things up a bit more. – dapirateking Jan 22 '18 at 4:53
  • Here is the literature I refer to: researchgate.net/publication/… – dapirateking Jan 22 '18 at 4:55
  • 3
    "...how this process begins..." - At the beginning someone created an insecure IoT device, for example one with remote access capability and a default password. Somebody bought it and connected it to the internet. And given enough of such devices on the internet somebody realized that many of these have vulnerabilities and this might be misused. And then somebody wrote some software to scan for these devices and automatically hijack these in order to repurpose these devices for their own agenda. – Steffen Ullrich Jan 22 '18 at 4:59
  • Thanks for clarifying, it makes sense that one can just write a simple script to first manually do the job to infect the first device. I was pretty caught up on the bots automating the process that I kind assumed there was some "magic" that occurred to start it all. – dapirateking Jan 22 '18 at 5:17

Browse other questions tagged or ask your own question.