1

Once again for research purposes I would like to "release" the MIRAI botnet on an IoT subnetwork in my home. However I am unsure of the consequences that this may have (e.g. damage my devices). What would the safest way to try this be?

  • Yeah, it's risky because it will start scanning the internet and try to infect other hosts. – Aria Feb 16 '18 at 13:53
  • @Aria So what would the best way to try it be? Simulation? – Irene Ant Feb 16 '18 at 13:54
  • You could mitigate that by putting it in a firewalled or air-gapped network. – multithr3at3d Feb 16 '18 at 14:00
  • 3
    If you have to ask this question, you probably shouldn't do this. – Tom K. Feb 16 '18 at 14:12
  • To simulate it, you could set up a number of virtual machines connected internally. This is often how network simulations are done. – forest Feb 17 '18 at 5:05
0

It depends what you’re trying to achieve; do you want to test some IOT devices resiliency to mirai, or observe mirai’s behaviour?

Either way, I definitely suggest you consider doing this in a virtual environment.

Begin by creating a parent host VM and create a DMZ by locking down the network of the parent host vm to local only. Then, you can use that hosts virtualisation platform to spin up some IOT devices and test mirai.

A setup like this would provide you with a mitigation layer for the rest of the devices on your home network, and avoid rooting any hardware devices you might have been thinking of testing.

Assuming you have some measure for a successful test, you could then take this up a layer to your real devices once you’re familiar with mirai’s behaviour.

You may be familiar with some virtual techniques already, but this IOT Lab VM looks cool, and there is a bunch of information online about virtual arudino et al hosts.

5

Releasing known malware just doesn't seem like a good idea. A botnet's whole purpose is to engage massive numbers of devices in a coordinated attack - generally the perpetrators don't want it known that they're there and purposefully wrecking devices in the botnet keeps it small, reducing its usefulness. I'd be more worried about my screwing up and having my devices part of a public botnet than damage to them.

If you're going to insist on doing that, there are a couple things I would make sure I do:

  1. Ensure that the entire network is air-gapped, including wireless
  2. Prevent any use of USB devices on any device there
  3. If you're going to insist on using USB drives, restrict their use to your air-gapped network
  4. Turn off wireless and bluetooth on all devices to prevent their accidental connection to other devices
  5. Reimage everything when done with whatever is going on
  • Thank you! Hopefully I ll be able to simulate it, rather than using the real malware. – Irene Ant Feb 16 '18 at 14:02
  • Known Mirai variants do neither spread over USB nor bluetooth. – Tom K. Feb 16 '18 at 14:12
1

This will not strictly answer your question, but it will address your problem and I think is therefore an appropriate answer here.

There's actually no need for any simulation. The Mirai botnet has been observed and documented really well. See here for an excellent report.

For analyzing purposes researchers set up a farm of "around 500 custom telnet servers" and awaited scans of infected bots.

Imperva, an anti-DDoS-service provider and McAfee also published large analyses about the Mirai botnet.

Mirai is probably the instance of cyber crime with the most research dedicated to its creation, functionality and ending.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.