Mirai worked by brute force in the simplest sense. It scanned for devices with open Telnet ports, tried a short list of default usernames and passwords common on IP cameras, DVRs and home routers, and installed itself on any that answered. Infected devices then scanned for more. The resulting botnet was used against a security journalist’s site, a French hosting provider and the DNS provider Dyn, whose outage took major websites offline for hours.
The source code was published shortly afterwards, which spawned many variants that still circulate. Mirai is the standard illustration of why default credentials are now explicitly prohibited by consumer IoT regulation such as the UK’s PSTI Act, and why exposed management interfaces belong behind network segmentation.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.