Once again for research purposes I would like to "release" the MIRAI botnet on an IoT subnetwork in my home. However I am unsure of the consequences that this may have (e.g. damage my devices). What would the safest way to try this be?
It depends what you’re trying to achieve; do you want to test some IOT devices resiliency to mirai, or observe mirai’s behaviour?
Either way, I definitely suggest you consider doing this in a virtual environment.
Begin by creating a parent host VM and create a DMZ by locking down the network of the parent host vm to local only. Then, you can use that hosts virtualisation platform to spin up some IOT devices and test mirai.
A setup like this would provide you with a mitigation layer for the rest of the devices on your home network, and avoid rooting any hardware devices you might have been thinking of testing.
Assuming you have some measure for a successful test, you could then take this up a layer to your real devices once you’re familiar with mirai’s behaviour.
You may be familiar with some virtual techniques already, but this IOT Lab VM looks cool, and there is a bunch of information online about virtual arudino et al hosts.
Releasing known malware just doesn't seem like a good idea. A botnet's whole purpose is to engage massive numbers of devices in a coordinated attack - generally the perpetrators don't want it known that they're there and purposefully wrecking devices in the botnet keeps it small, reducing its usefulness. I'd be more worried about my screwing up and having my devices part of a public botnet than damage to them.
If you're going to insist on doing that, there are a couple things I would make sure I do:
- Ensure that the entire network is air-gapped, including wireless
- Prevent any use of USB devices on any device there
- If you're going to insist on using USB drives, restrict their use to your air-gapped network
- Turn off wireless and bluetooth on all devices to prevent their accidental connection to other devices
- Reimage everything when done with whatever is going on
This will not strictly answer your question, but it will address your problem and I think is therefore an appropriate answer here.
There's actually no need for any simulation. The Mirai botnet has been observed and documented really well. See here for an excellent report.
For analyzing purposes researchers set up a farm of "around 500 custom telnet servers" and awaited scans of infected bots.
Mirai is probably the instance of cyber crime with the most research dedicated to its creation, functionality and ending.