Week 3: Improving Mirai

It looks like I'll be able to switch back to writing about IoT devices! Which is good, since I found a very interesting article related to everyone's favorite IoT disaster--Mirai (See my previous post "The Fruit of Insecurity" for a specific coverage of that botnet).

For those of you too busy to read my link, Mirai was an IoT botnet that surfaced close to a year ago. The Mirai malware spread using a relatively simple process--by using ~60 Telnet credentials as a small dictionary attack against open Telnet ports in IoT devices. When it had a successful login, it infected the device and incorporated it into a denial-of-service botnet. At its peak, it was capable of 600 Gbps DDoS attacks and included hundreds of thousands of IoT devices.

Fast forward to today, where a penetration testing company had the nerve to describe how, with some tweaking, Mirai could have been even larger. Their goal was to highlight chronic security issues in the Internet of Things world, problems that are not really being addressed but which pose serious issues to IoT devices (and pretty much any human) on the Internet. Some of the vulnerabilities they found include:

• Devices that use non-traditional ports for Telnet; the reason Mirai didn't compromise them is because Mirai only looked on port 23 for Telnet servers.
• Baked-in credentials that, if incorporated into Mirai (with a few tweaks) could allow Mirai to log into more IoT devices.
• Non-Telnet shells accessible on other ports.

These findings raise several important questions. Perhaps the most obvious is, "Were the researchers acting ethically by revealing these findings?" The last thing we need is more Mirai! It doesn't seem like IoT manufacturers will be goaded into using more secure practices with an article like this, but prospective botnet makers will definitely be inspired by such data.

Before writing off the researchers for showing their findings, though, we need to ask a second question: what will it take to fix the IoT security problem once and for all? More Mirais? Will governments have to step in and force manufacturers to stop making boneheaded decisions like this, or will market pressures be enough? As convenient as it is to condemn the researchers for releasing this data, we need to evaluate whether the flaws they found would eventually be exploited and if the extra awareness generated now (however futile it may be) is better than silence until a black hat exploits these devices. Considering that widespread issues like this exist after Mirai, it's obvious that the one incident wasn't enough to turn the tide.