10 ms·
Mirai Botnet Linked to Dyn DNS DDoS Attacks
- nodesocket 10y agoI really hope that dyn releases some graphs of queries per second for a few day range so we can see how large this DDoS attack really was.
- dmourati 10y agoI read 1.2 Tbps: http://hosted.ap.org/dynamic/stories/D/DISRUPTIVE_CYBERATTACK?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2016-10-21-17-26-28 http://hosted.ap.org/dynamic/stories/D/DISRUPTIVE_CYBERATTAC...
- tedmiston 10y agoFor reference, the earlier Krebs attack is quoted on Wikipedia as being 620 Gbps [1]. I'm not sure it's really comparing apples to apples though with this being at DNS level. ~2x the traffic sure, but at a layer with a lot more impact on everyone, so the outcome is much more than ~2x worse. [1]: https://en.wikipedia.org/wiki/Mirai_(malware) https://en.wikipedia.org/wiki/Mirai_(malware)
- sigmar 10y agoHas anyone seen any estimates of how much economic productivity was lost from today's DDoS?
- lsh123 10y agoOr gained :)
- 33degrees 10y agogithub being down was a big pain for me today, and I'm surely not the only one...
- lsh123 10y agoI was mainly referring to Twitter, Spotify, Netflix, Amazon :)
- tehlike 10y agowhy? were you trying to fork new repos or just your usual commit/push flow?
- eropple 10y agoDownvoting this post is kinda shitty, because it's just obliquely pointing out something that nearly every developer should already know--that having a single point of failure for your builds and your tests (the only reason Github being down should impact you) is a bad, bad idea. Your code should be building and deploying from git remotes you control, if you want to be using push-as-build CD. If you have dependencies, bring them in-house on your own Artifactory, gem server, npm mirror, whatever. Controlling the entirety of your deployment stack is not just a good idea, it's a requirement for safe and sane operations.
- speedplane 10y agoIn a perfect world, we would all operate our little empire, where we control every piece of infrastructure, and would not be reliant on any other provider. Alas, maintaining that infrastructure has costs... enormous costs, and to get a product to market quickly, you often can't do it on your own. Maybe industries like banking, defense, and healthcare are different, but for the majority of us, we just can't afford to build our own basic internet infrastructure and compete in the marketplace.
- eropple 10y agoYou're not building "basic internet infrastructure". You're standing up Gitolite next to your CI system and Gemcutter or Kappa or pick-a-Maven-repo-including-Wagon-over-FTP. It costs about twenty bucks a month to do both these tasks. If they're running on separate machines. Which they don't have to be. The idea that a git remote is "basic internet infrastructure" that should be out of your hands because you're shipping a product raises ignorance to worshipful levels. If you want to use Github for collaboration, that's fine! But if your deploys, etc., are being held up by something out of your control that isn't systemic failures with the provider in which you're deploying your software, you done screwed up.
- idlewords 10y agohttp://www.theonion.com/article/48-hour-internet-outage-plunges-nation-into-produc-779 http://www.theonion.com/article/48-hour-internet-outage-plun...
- deleted 10y ago[deleted]
- Animats 10y agoIt looks like it's going to be necessary to get serious about ingress filtering. See RFC 2827, which laid out the basics. Fortunately, there aren't that many ISPs left. If Comcast, AT&T, and Verizon got serious about ingress filtering, it would cut way down on the number of devices that could get through with a random IP source address. The ISPs are in a good position to tell their customers to unplug whatever is causing the trouble. (Assuming it's not the ISP's own router, which they should be able to fix remotely.) At the big-pipe level, there should be sampling. 1 in 10000 packets has been suggested, which will reveal any massive attack without hurting privacy much. If a big pipe has an excessive fraction of attack packets, that indicates the sending end isn't doing proper ingress filtering. That's a matter to be dealt with between network operators, possibly with involvement from CERT and Homeland Security if necessary. This problem is solveable, but it's going to take some ass-kicking. There are now enough big companies annoyed about this for that to happen.
- dmourati 10y agoI think you mean egress filtering. https://www.sans.org/reading-room/whitepapers/firewalls/egress-filtering-faq-1059 https://www.sans.org/reading-room/whitepapers/firewalls/egre...
- pg_is_a_butt 10y agoi think you mean pokemon go fingering. you're all idiots.
- jlgaddis 10y agoFrom the ISP perspective, it is ingress filtering -- he's saying they should be filtering their customer's traffic as it enters their network, such as leaving customer's cable modem and entering the CMTS.
- dmourati 10y agoYa, had to put on my ISP hat to see that.
- 10y ago
- dax1928 10y agoIs there a way to determine electricity used during all of this? Certainly each IoT device has low bandwidth and load draw, but each of their service requests is honored the same as any normal human request. A small signal from a device prompts more electricity in potentially multiple servers upstream until the host can satisfy the request. So are there potentially thousands of kWh being wasted even with mitigation? Or can requests from certain IP's be denied and thus electricity saved?
- astrodust 10y agoI don't think electricity here is the problem. In fact, measuring the impact is probably pointless, a lot of servers are always-on regardless of traffic.
- speedplane 10y agoYes, but of course the lost productivity of the eastern continental U.S. for just a few minutes likely dwarfs the wasted electricity by many orders of magnitude.
- dax1928 10y agoSure, the current draw per byte of information exchanged is negligible. But I'm curious as to how these millions of cheap, low-power IoT devices can essentially act as transistors in the sense that their requests can prompt more relatively higher current draw elsewhere. Once again, this draw is likely miniscule. In theory, if every internet connected device in the world could be a part of Mirai, not only would we not be able to use the internet, but wouldn't the majority of datacenters be running at full capacity?
- mastazi 10y agoIs there any established way to test my router/IOT device for Mirai vulnerability?
- archimedespi 10y agoCheck and see if the Mirai code has default credentials for it, and if so, try logging in with them.
- bsamuels 10y agotry logging in from the WAN, not the LAN. Mirai has no method of attacking lan interfaces unless a upnp rule was already set up
- jagermo 10y agoUnexpected traffic on Port 23 tcp as well as 48101 tcp is a good indicator
- qb45 10y agoI heard it resides in RAM and reboot clears it.
- pmontra 10y agoThe manufacturers of devices should be held responsible for the security of the devices they sell. This is not different from what they are required to do for the electrical and physical parts of the devices. Pass some standard tests that would prevent at least the most obvious vulnerabilities, default passwords and other bad practices. Run metaexploit against it, etc. This would raise the attention to secure software development also in other areas of the IT business. Sure, it costs more upfront but we gain as we suffer less from this kind of attacks.
- whatupmiked 10y agopeople should start thinking about consumer protection for internet services and internet connected devices. Minimum security standards for products brought to market should be just one aspect of this.
- tedmiston 10y agoIn that case, who's responsible for keeping the anti-malware software up to date... and paying for it? Or maybe that's going too far and the first step is to just have them encourage / force more secure passwords. (Assuming this is correct [1]): > Mirai functions by infecting IoT devices by trying to brute force their passwords. The tactic it uses to brute force passwords is entering commonly used and default passwords. [1]: https://en.wikipedia.org/wiki/Mirai_(malware) https://en.wikipedia.org/wiki/Mirai_(malware)
- pmontra 10y agoI suggest a gradual approach. Anyway, the manufactuter has more costs so the price is going to be higher. How higher in the long run? Maybe not much. We already experienced the same progression towards safety with materials that don't poison us and appliances that dont catch fire or interfere on the radio spectrum. Every one of those steps cost money. We still have cheap stuff to buy. The difference here is that those devices must be maintained or retired. So there could be a recurring cost. Eventually there will be ecosystems of companies taking care of the update and maintenance of devices made by their customers (the manufacturers.) We also have to educate people, to the point that they will feel ashamed to buy unsecure devices and inadvertently help the criminals behind those attacks in the news. Nobody wants to help the mob (or worse) by keeping their stuff at home, right? This is going to become a matter of national security in every country, because those attacks can be used as a weapon to incapacitate vital infrastructures.
- agnivade 10y agoCan someone ELI5 how does malware infect IOT devices ? The firmware which is there can only be upgraded from the OEM sites right ? So unless there is a way to affect the firmware from outside, how will a malware affect it ? And what can I do to secure an IOT device if I have one ?
- desdiv 10y agoThe malware hardcodes 62 common username:password pairs like root:12345 [0] and apparently there are millions of IOT devices out there where these trivial passwords will get you root. [0] https://github.com/0x27/linux.mirai/blob/6d5a3e2760852444de9d39b082b06cb7176cd2c1/mirai/bot/scanner.c#L138 https://github.com/0x27/linux.mirai/blob/6d5a3e2760852444de9...
- Pxtl 10y agoI think he's asking more about how the attackers get past the simple NAT. I mean, unless you deliberately expose the device as a webserver to the public internet, a device should be by-default hidden theoretically unless it goes looking for trouble online. Of course, considering the quality of most routers, it's not like the NAT itself is terribly safe.
- gregmac 10y ago> get past the simple NAT. UPnP Though you still have to exploit. I wonder how many are running some linux variant though, and have some remote execution vulnerability on their web UI (maybe even without logging in)..
- fulafel 10y agoThe simplest idea is to put your exploit as JS payload in some shady ad network or auto-cracked PHP website, and get to the devices by scanning & fingerprinting devices on the browser's rfc1918 network. Then use a reverse shell style connection to c&c.
- 10y ago
- braindead_in 10y agoHow difficult would it be to write a anti-mirai virus which disables the remote access on these IoT devices? Or at least warns the user in some way that this device is being used for DDoS.
- viraptor 10y agoRelatively trivial. Mirai didn't prevent future access as far as I know. But it would be illegal as well. Warning the users would be much simpler. The hosts used to report infections are known. Destination port for the infection is known and normally not exposed. I think that at this point ISPs should do the same thing with incoming port 23 as they did with outgoing 25. Disable by default, allow people to enable if they want to.
- kureikain 10y agoI don't understand how they can scan IoT devices if IoT devices are behinds a router which is usually our home network setup. So we will expose a public IP, and NAT is usually not enabling by default anyway so how the heck they can telnet/connect to the IoT devices to brute force password? It seems like somehow we
- djkrul 10y agoUPnP is enabled on lots of routers by default and enables devices and services behind NAT to forward traffic for specific ports to their internal IP address to allow direct connections from the internet.
- kureikain 10y agoI see. I just check mine and luckily DD-WRT disabled it by default.
- jagermo 10y agoJust do a quick shodan search for port 23, there are millions of devices directly attached to the web. Some are intentional, but my guess is the most are just badly configured by people not caring for security. Add all the cheap vendors for IoT devices and "I need to be able to check my lights at home while on the road" and you get an amazingly huge attack surface
- jagermo 10y agoI wonder what the goal of these guys is. Several high profile attacks with little impact, source code and attack vectors leaked, users and vendors scrambling to set up defenses. Is this some "look what could happen" scenario or is someone using it to show off the skills of his other botnet?
- viraptor 10y agoAnother speculation is that these were very specific attacks. Are there any online monitoring / logging / audit services that stopped being reported to? I know that at least the SPF checks failed for emails. Some other infrastructure could fail too.
- speedplane 10y agoTo get around the DNS attacks, one of the cloud providers I use posted their IP address to Twitter. Of course, when Twitter is down too, it doesn't help much.
- zorked 10y agoCalling for government regulation of devices is all fun and games until the government comes along and mandates closed source, irreplaceable firmware like the FCC did with Wifi access points.
- drvdevd 10y agoWhich, of course, will result in a worse security posture. Interesting technical ideas can be found in the actual research being done on embedded device security out there. This comes to mind, for example: https://lwn.net/Articles/568943/ https://lwn.net/Articles/568943/
- idlewords 10y agoGood regulation isn't impossible. For example, mandating a unique admin password for each IoT device would go a long way to helping prevent this kind of fiasco.
- marmot777 10y agoHow would a unique admin password help in cases where there's a backdoor accessed via an open port? A lot of the devices used last Friday had port 23 open. The password used in the backdoor was compeletely separate from the device admin password. Your advice is good but it wouldn't have helped last Friday.
- kuschku 10y agoUnless it doesn't. The EU version of that WiFi regulation also has a clause that while the default firmware for the router can't be allowed to be used for such purposes, users should always be able to install their own firmware. Government regulation can be done effectively.
- marmot777 10y agoThese problems need to be fixed soon or government regulation will come. I think the government would be reluctant to regulate unless it seems like an emergency. If larger attacks happen then the public will call for regulation and politicians will fall over each other to do it. There will be intended and unintended consequences. He best way to prevent regulation is to eliminate the perceived need. If another attack hits, especially larger and more costly the one last week, people will start getting outraged. Those businesses who lost money might even start lobbying. I'm not hopeful at this point as I don't even get the feeling that most people have taken the time to understand what happened last week. I see almost mantras people repeat out there outlining mitigation that, white important generally, would not have helped mirigste the attack last Frieay. The solutions offered frequently involve big lag times even if somehow set into motion immediately. It may be necessary to make some hard trade offs to show some real progress. When people don't freely make hard choices, the government will step in. That would be a preventable tragedy. I don't have much hope at this point.
- xorcist 10y agoIt's easy to call for companies to be held responsible for botnets etc. but it's important to be much more specific than that. Google has an absolutely massive bot network in all Android devices running Play Services, which basically keeps an open root shell to the mothership at all times. However that is used mostly for good, by keeping devices updated and removing malware remotely. An responsibility model would entail insurances, and that could easily change the situation for the worse. But it's also important the realize the inherent risk in this. Has anyone tried to quantify it? Then there has to be a line drawn somewhere. Holding the keys to Window Update means a potential botnet. Maybe even being a Debian Developer. That probably shouldn't carry the same responsibilities.
- Bedon292 10y agoIs there a page somewhere that maps the passwords to corresponding devices? Essentially a list of what devices are affected by this botnet? I don't think anything I own is affected, and I monitor my network pretty closely, but would like to double check. And make sure not to buy any of them either.
- creeble 10y agoYour post is late, but I would like to +10 it. AFAICT, Mirai gains access ONLY through telnet on port 23. I see no one mentioning that anywhere here. If you do not have a device with something answering on port23, then you cannot be p0wned by Mirai. Can anyone verify that statement as correct or incorrect?
- marmot777 10y agoI just came into this thread yesterday and today and mentioned it but I get the feeling this thread but maybe it's too late for discussing as this thread's been around for like 5 days. I'd like to discuss it more, maybe start another threwd but it might be futile to try to talk about this topic more. It's a bummer there's not more passion for this.