www.cloudflare.com
Open in
urlscan Pro
2606:4700::6810:7b60
Public Scan
URL:
https://www.cloudflare.com/learning/ddos/glossary/mirai-botnet/
Submission: On November 14 via api from US — Scanned from DE
Submission: On November 14 via api from US — Scanned from DE
Form analysis
0 forms found in the DOMText Content
WHY CLOUDFLARE * WHY CHOOSE CLOUDFLARE * LEARN ABOUT CLOUDFLARE * What is Cloudflare? Learn what makes us different * One of the largest global networks Learn about our growing network * How Cloudflare continues to innovate Explore our innovative technologies * Cloudflare is a trusted partner to millions Learn what makes us trustworthy COMPARISONS * Zscaler vs Cloudflare See how our services compare * Cisco Umbrella vs Cloudflare See how our services compare WHY TRUST CLOUDFLARE * Case studies Learn how we've helped others * Solution & product guides Explore our product documentation * Industry analysts on Cloudflare Explore industry analysis of our products * Webinars Explore past & upcoming webinars * Explore our Trust Hub Explore our trust & safety resources * Legal documentation Explore our legal resources RESOURCE HUB * Explore our Resource Hub Explore white papers, reports, & more * Case studies Learn how we've helped others * Industry analysts on Cloudflare Explore industry analysis of our products * Solution & product guides Explore our product documentation * Webinars Explore past & upcoming webinars BLOG * Blog ENTERPRISE LEVEL SERVICES * Enterprise EXPLORE CASE STUDIES * Explore case studies * Contact Sales SOLUTIONS * BY NEED * SASE * Cloudflare One: Comprehensive SASE platform * Easier alternative to Zscaler PROTECT WEBSITES & APPLICATIONS * Secure websites & APIs * Mitigate DDoS attacks * Stop malicious bot abuse IMPROVE WEBSITE & APPLICATION PERFORMANCE * Accelerate internet applications * Ensure app availability * Optimize web experience * Video streaming on-demand * Visitors from China SECURE WORK-FROM-ANYWHERE * Deliver Zero Trust network access * Manage contractor access * Protect employees on the internet * Replace Virtual Private Networks (VPN) * Secure remote workforces * Secure SaaS access (CASB) * Stop ransomware, phishing, & data loss * Activate Phishing-Resistant MFA PROTECT & ACCELERATE NETWORKS * Explore all network services * Connect your network to Cloudflare * Mitigate L3 DDoS attacks * Transform corporate networks BUILD & DEPLOY CODE AT EDGE * Build a serverless application * Configure CDN * Deploy JAMstack website * Define conditional request routing MANAGE YOUR CLOUD DEPLOYMENT * Enable multi-cloud * Enable SSL for SaaS applications * Reduce cloud data transfers REGISTER A DOMAIN * Register or transfer a website BY INDUSTRY * Ecommerce For online stores or services * Education For academic institutions * Finance For financial services * Gaming For gaming services or platforms * Healthcare For medical institutions or services * Media & entertainment For media services * Non-profit For philanthropic organizations * Public sector For government organizations * SaaS For software services PUBLIC INTEREST * At-risk websites For vulnerable organizations * Athenian Project For humanitarian organizations * Critical Infrastructure Defense Project For government institutions * Project Fair Shot For vaccine access organizations * Election campaigns For political organizations NEED HELP CHOOSING? * Need help choosing? * Contact Sales PRODUCTS * SASE * SASE * Cloudflare One Cloudflare's Secure Access Service Edge that delivers network as a service (NaaS) with Zero Trust security built-in ZERO TRUST SERVICES * Cloudflare Zero Trust Reduce risks, increase visibility, and eliminate complexity as employees connect to applications and the Internet * Access Zero Trust security for accessing your self-hosted and SaaS applications * Browser Isolation Add-on Zero Trust browsing to Access and Gateway to maximize threat and data protection * CASB Easily secure workplace tools, granularly control user access, and protect sensitive data * Data Loss Prevention (DLP) Protect your organization’s most sensitive data * Area 1 (Email Security) Cloud-native email security to protect your users from phishing and business email compromise * Gateway Secure web gateway for protecting your users via device clients and your network NETWORK SERVICES * Magic WAN Use the Internet for your corporate network with security built in, including Magic Firewall * Magic Firewall Enforce consistent network security policies across your entire WAN * Network Interconnect Connect your network infrastructure directly to the Cloudflare network * Magic Transit Protect your IP infrastructure and Internet access from DDoS attacks * Argo Smart Routing Route web traffic across the most reliable network paths APPLICATION SERVICES * APPLICATION SECURITY * API Gateway Make the massive Cloudflare network your secure API Gateway * Bot Management Stop bad bots by using threat intelligence at-scale * DDoS Protection Block DDoS attacks of any size and kind * Page Shield Stop client-side Magecart and JavaScript supply chain attacks * Rate Limiting Protect against denial-of-service attacks, brute-force login attempts, and other types of abusive behavior * SSL / TLS Encryption Issue and manage certificates in Cloudflare * SSL / TLS for SaaS Providers Cloudflare manages the SSL certificate lifecycle to extend security to your customers * Web Application Firewall (WAF) Protect your business-critical web applications from malicious attacks APPLICATION PERFORMANCE * CDN Static and dynamic content delivery * DNS Fastest, most resilient and secure authoritative DNS * Load Balancing DNS-based load balancing and active health checks against origin servers and pools * Argo Smart Routing Route web traffic across the most reliable network paths * Website Optimization Services Gauge how fast your website is and how you can make it even faster * Waiting Room Virtual waiting room to manage peak traffic * China Network Extend Cloudflare performance and security into mainland China * Video Stream Delivery Cache and deliver HTTP(S) video content * Zaraz (3rd Party Tool Manager) Load third-party tools in the cloud, improving speed, security, and privacy * Web3 Gateways Leverage Cloudflare's IPFS and Ethereum gateways to build fast, secure and reliable Web3 applications ZERO TRUST SERVICES * Cloudflare Zero Trust Reduce risks, increase visibility, and eliminate complexity as employees connect to applications and the Internet * Access Zero Trust security for accessing your self-hosted and SaaS applications * Browser Isolation Add-on Zero Trust browsing to Access and Gateway to maximize threat and data protection * CASB Easily secure workplace tools, granularly control user access, and protect sensitive data * Data Loss Prevention (DLP) Protect your organization’s most sensitive data * Area 1 (Email Security) Cloud-native email security to protect your users from phishing and business email compromise * Gateway Secure web gateway for protecting your users via device clients and your network NETWORK SERVICES * Explore All Network Services Connectivity, security, and performance — all delivered as a service. * Magic WAN Use the Internet for your corporate network with security built in, including Magic Firewall * Magic Transit Protect your IP infrastructure and Internet access from DDoS attacks * Magic Firewall Enforce consistent network security policies across your entire WAN * Network Interconnect Connect your network infrastructure directly to the Cloudflare network * Argo Smart Routing Route web traffic across the most reliable network paths * Spectrum (TCP/UDP) Security and acceleration for any TCP or UDP-based application DEVELOPER PLATFORM * DOMAIN REGISTRATION * Registrar Manage your domain with Cloudflare Registrar SERVERLESS APPLICATIONS * Workers Build applications directly onto our network * Email Routing Simplify the way you create and manage custom email addresses for your domain SAAS DEVELOPERS * Cloudflare for SaaS Extend Cloudflare security and performance to your end customers STORAGE * R2 Object storage for all your data * Workers KV Serverless key-value storage for applications * Durable Objects Strongly consistent data store WEBSITE DEVELOPMENT * Pages (JAMstack) JAMstack platform for frontend developers to collaborate and deploy websites * Stream Cloudflare Stream is a live streaming and on-demand video platform * Images Store, resize, and optimize images at scale with Cloudflare Images CONSUMER SERVICES * DOMAIN REGISTRATION * Registrar Manage your domain with Cloudflare Registrar FAST AND PRIVATE BROWSING * 1.1.1.1 A fast and private way to browse the internet * 1.1.1.1 with Warp Send all of your Internet traffic over optimized Internet routes * 1.1.1.1 for Families Protect your home network from malware and adult content EMAIL * Email Routing Simplify the way you create and manage custom email addresses for your domain ANALYTICS & INSIGHTS * Analytics Granular lens into network traffic * Logs Access to detailed logs of HTTP requests, Spectrum events, or Firewall events * Radar Internet insights, threats and trends based on aggregated Cloudflare network data * Security Center Better manage attack surfaces with Cloudflare attack surface management * Web Analytics Privacy-first, lightweight, accurate web analytics – for free PRIVACY & COMPLIANCE * Access Management Stop data loss, malware and phishing with the most performant Zero Trust application access * Application Security Keeping websites and APIs secure and productive * Encryption Get free SSL / TLS with any Application Services plan to prevent data theft and other tampering * Data Localization Manage your data locality, privacy, and compliance needs * Web Analytics Privacy-first, lightweight, accurate web analytics—for free * Zaraz (3rd Party Tool Manager) Load third-party tools in the cloud, improving speed, security, and privacy * View What's New * Contact Sales PRICING * OUR PLANS & PRICING * Zero Trust platform plans ZTNA, CASB, SWG, RBI, email security, & more * Websites & application services plans DDoS, WAF, CDN, DNS, load balancing, & more * Network services WAN, FWaaS and DDoS protection * Developer platform plans Build & deploy serverless code * Enterprise plan Access to advanced tools and live support ENTERPRISE PLANS * Enterprise plans COMPARE ALL PLANS * Compare all plans NEED HELP CHOOSING? * Need help choosing? * View FAQs * Contact Sales RESOURCES * DOCUMENTATION * GETTING STARTED * New to Cloudflare? Start here APPLICATION SECURITY * Bot Management * Firewall Rules * SSL * WAF APPLICATION SERVICES * CDN * DNS * Image Resizing * Load Balancing * Stream (video) * China Network ZERO TRUST SERVICES * Zero Trust * Application Access (ZTNA) * Browser Isolation * Gateway (SWG) * Email Security (Area 1) NETWORK SERVICES * Magic Transit * Magic WAN * Magic Firewall * Spectrum (TCP/UDP) INSIGHTS * Analytics * Logs DEVELOPER PLATFORM * Workers Quick Start * Workers Pages * Sample Workers Projects * Workers Tutorials * Command-line (Wrangler) * Runtime API * API Reference * API Authentication RESOURCE HUB * Explore our Resource Hub Explore white papers, reports, & more * Case studies Learn how we've helped others * Industry analysts on Cloudflare Explore industry analysis of our products * Solution & product guides Explore our product documentation * Webinars Explore past & upcoming webinars LEARNING * Learning Center Explore our resources on cybersecurity & the Internet * Bot management Learn the difference between good & bad bots * Cloud Learn how the cloud works & explore benefits * CDN Learn how CDN works & explore benefits * DDoS Learn about DDoS attacks & mitigation * DNS Learn about DNS & how it works * Email security Learn about email security & common attacks * Network layer Learn about network layer & how it works * Performance Learn about performance & why it matters * Security Learn about core security concepts & common vulnerabilities * Serverless Learn about serverless computing & explore benefits * SSL Learn about SSL, TLS, & understanding certificates * Zero Trust Learn about Zero Trust security model & implementation TRENDS & INSIGHTS * Blog Explore the latest news in cybersecurity * Radar Up to date Internet trends & insights BLOG * Blog COMMUNITY FORUM * Community DEV DOCUMENTATION HUB * Dev Documentation Hub GET HELP * Get help * Contact Sales PARTNERS * CHANNEL & ALLIANCE PARTNERS * Partner network Learn about the types of partners available in our network * Find a partner Looking for a Cloudflare partner? We can connect you. * Cloudflare One Partner Program Partners that support organizations of all sizes adopting our Zero Trust solutions * Services Partner Program Partners with deep expertise in SASE & Zero Trust services * Become a Cloudflare Partner Interested in joining our Partner Network? Apply today to get started. * Self-Serve Partner Program Get started as a partner by selling & supporting Cloudflare's self-serve plans TECHNOLOGY PARTNERS * Technology Partner Program Apply to become a technology partner to facilitate & drive our innovative technologies * Analytics Use insights to tune Cloudflare & provide the best experience for your end users * Bandwidth alliance We partner with an alliance of providers committed to reducing data transfer fees * Cyber risk We partner with leading cyber insurers & incident response providers to reduce cyber risk * Developer platform We work with partners to provide network, storage, & power for faster, safer delivery * Endpoint security Integrate device posture signals from endpoint security programs * Identity providers Get frictionless authentication across provider types with our identity partnerships * Network interconnection Extend your network to Cloudflare over secure, high-performing links * Mobile device management Secure endpoints for your remote workforce by deploying our client with your MDM vendors * Network observability Enhance on-demand DDoS protection with unified network-layer security & observability * Network on-ramp Connect to Cloudflare using your existing WAN or SD-WAN infrastructure PEERING PORTAL * Peering portal PARTNER NETWORK * Partner network * Partner Network LOG IN * Log In UNDER ATTACK? * Under Attack? UTILITY NAV - SIGN UP * Sign Up SUPPORT * Contact Support * Help Center * Cloudflare Community +49 89 2555 2276+1 (650) 319 8930 | Sign Up | Support | Sign Up | Why CloudflareSolutionsProductsPricingResourcesPartners Support Under Attack? Sales: +49 89 2555 2276 Log InContact Sales Log InUnder Attack? WHAT IS THE MIRAI BOTNET? The Mirai malware exploits security holes in IoT devices, and has the potential to harness the collective power of millions of IoT devices into botnets, and launch attacks. LEARNING CENTER * What is a DDoS Attack? * What is a DDoS Botnet? * Common DDoS Attacks * Flood Attacks * DDoS Attack Tools * Glossary * Insights LEARNING OBJECTIVES After reading this article you will be able to: * Learn about the Mirai botnet * Learn how botnets are mutating * Learn why botnets are dangerous * Learn how IoT devices and botnets are related Related Content -------------------------------------------------------------------------------- What is a DDoS Botnet? Denial Of Service How to DDoS Internet Of Things (IOT) Blackhole Routing Copy article link WHAT IS MIRAI? Mirai is malware that infects smart devices that run on ARC processors, turning them into a network of remotely controlled bots or "zombies". This network of bots, called a botnet, is often used to launch DDoS attacks. Malware, short for malicious software, is an umbrella term that includes computer worms, viruses, Trojan horses, rootkits and spyware. In September 2016, the authors of the Mirai malware launched a DDoS attack on the website of a well-known security expert. A week later they released the source code into the world, possibly in an attempt to hide the origins of that attack. This code was quickly replicated by other cybercriminals, and is believed to be behind the massive attack that brought down the domain registration services provider, Dyn, in October 2016. HOW DOES MIRAI WORK? Mirai scans the Internet for IoT devices that run on the ARC processor. This processor runs a stripped-down version of the Linux operating system. If the default username-and-password combo is not changed, Mirai is able to log into the device and infect it. IoT, short for Internet of Things, is just a fancy term for smart devices that can connect to the Internet. These devices can be baby monitors, vehicles, network routers, agricultural devices, medical devices, environmental monitoring devices, home appliances, DVRs, CC cameras, headset, or smoke detectors. The Mirai botnet employed a hundred thousand hijacked IoT devices to bring down Dyn. WHO WERE THE CREATORS OF THE MIRAI BOTNET? Twenty-one-year-old Paras Jha and twenty-year-old Josiah White co-founded Protraf Solutions, a company offering mitigation services for DDoS attacks. Theirs was a classic case of racketeering: Their business offered DDoS mitigation services to the very organizations their malware attacked. WHY DOES THE MIRAI MALWARE REMAIN DANGEROUS? The Mirai is mutating. Though its original creators have been caught, their source code lives on. It has given birth to variants such as the Okiru, the Satori, the Masuta and the PureMasuta. The PureMasuta, for example, is able to weaponize the HNAP bug in D-Link devices. The OMG strain, on the other hand, transforms IoT devices into proxies that allow cybercriminals to remain anonymous. There is also the recently discovered - and powerful - botnet, variously nicknamed IoTrooper and Reaper, which is able to compromise IoT devices at a much faster rate than Mirai. The Reaper is able to target a larger number of device makers, and has far greater control over its bots. WHAT ARE THE VARIOUS BOTNET MODELS? CENTRALIZED BOTNETS If you think of a botnet as a theatrical play, the C&C (Command and Control Server, also known as the C2) server is its director. The actors in this play are the various bots that have been compromised by malware infection, and made part of the botnet. When the malware infects a device, the bot send out timed signals to inform the C&C that it now exists. This connection session is kept open till the C&C is ready to command the bot to do its bidding, which can include sending out spam, password cracking, DDoS attacks, etc. In a centralized botnet, the C&C is able to convey commands directly to the bots. However, the C&C is also a single point of failure: If taken down, the botnet becomes ineffective. TIERED C&CS Botnet control may be organized in multiple tiers, with multiple C&Cs. Groups of dedicated servers may be designated for a specific purpose, for example, to organize the bots into subgroups, to deliver designated content, and so on. This makes the botnet harder to take down. DECENTRALIZED BOTNETS Peer-to-peer (P2P) botnets are the next generation of botnets. Rather than communicate with a centralized server, P2P bots act as both a command server, and a client which receives commands. This avoids the single point of failure problem inherent to centralized botnets. Because P2P botnets operate without a C&C, they are harder to shut down. Trojan.Peacomm and Stormnet are examples of malware behind P2P botnets. HOW DOES MALWARE TURN IOT DEVICES INTO BOTS OR ZOMBIES? In general, email phishing is a demonstrably effective way of infecting the computer - the victim is tricked into either clicking a link that points to a malicious website, or downloading infected attachment. Many times the malicious code is written in such a way that common antivirus software is not able to detect it. In the case of Mirai, the user doesn’t need to do much beyond leaving the default username and password on a newly installed device unchanged. WHAT IS THE CONNECTION BETWEEN MIRAI AND CLICK FRAUD? Pay-per-click (PPC), also known as cost-per-click (CPC), is a form of online advertising in which a company pays a website to host their advertisement. Payment depends on how many of that site’s visitors clicked on that ad. When CPC data is fraudulently manipulated, it is known as click fraud. This can be done by having people manually click on the ad, by use of automated software, or with bots. Through this process, fraudulent profits can be generated for the website at the expense of the company placing those ads. The original authors of Mirai were convicted for leasing their botnet out for DDoS attacks and click fraud. WHY ARE BOTNETS DANGEROUS? Botnets have the potential to impact virtually every aspect of a person’s life, whether or not they use IoT devices, or even the Internet. Botnets can: * Attack ISPs, sometimes resulting in denial-of-service to legitimate traffic * Send spam email * Launch DDoS attacks and bring down websites and APIs * Perform click fraud * Solve weak CAPTCHA challenges on websites in order to imitate human behavior during logins * Steal credit card information * Hold companies to ransom with threats of DDoS attacks WHY IS BOTNET PROLIFERATION SO HARD TO CONTAIN? There are many reasons why it is so difficult to stop the proliferation of botnets: IOT DEVICE OWNERS There is no cost or interruption in service, so there is no incentive to secure the smart device. Infected systems may be cleaned out with a reboot, but since scanning for potential bots happens at a constant rate, it’s possible for them to be reinfected within minutes of the reboot. This means users have to change the default password immediately after reboot. Or they must prevent the device from accessing the Internet until they can reset the firmware, and change the password offline. Most device owners have neither the know-how, nor the motivation to do so. ISPS The increased traffic on their network from the infected device typically does not compare to the traffic that media streaming generates, so there is not much incentive to care. DEVICE MANUFACTURERS There is little incentive for device manufacturers to invest in the security of low-cost devices. Holding them liable for attacks might be one way of forcing change, though this might not work in regions with lax enforcement. Ignoring device security comes at great peril: Mirai, for example, is able to disable anti-virus software, which makes detection a challenge. MAGNITUDE With over a billion-and-a-half ARC-processor-based devices flooding the market each year, the sheer number of devices that can be conscripted into powerful botnets means that these malware variants have grown in possible impact. SIMPLICITY Ready-to-go botnet kits obviate the need for tech savvy. For $14.99-$19.99, a botnet may be leased for an entire month. Refer to What is a DDoS Booter/Stresser? for more details. GLOBAL IOT SECURITY STANDARDS There is no global entity, or consensus, to define and enforce IoT security standards. While security patches are available for some devices, users might not have the skill, or the incentive, to update. Many manufacturers of low-end devices don’t offer any kind of maintenance at all. For ones that do, it is often not long term. There is also no way to decommission devices once the updates are no longer maintained, making them indefinitely unsecure. GLOBAL LAW ENFORCEMENT The difficulty in tracking down and prosecuting botnet creators makes the containment of botnet proliferation difficult; There is no global Interpol-equivalent (International Criminal Police Organization) for cybercrime, with corresponding investigative skills. Law enforcement across the globe is commonly not been able to keep up with cybercriminals when it comes to latest technology. Many botnets now employ a DNS technique called Fast Flux in order to hide the domains they use to download malware, or to host phishing sites. This makes them extremely hard to track, and take down. DOES BOTNET INFECTION DEGRADE PERFORMANCE FOR IOT DEVICES? It might. Every once in a while, infected devices might perform sluggishly, but they mostly work as intended. Owners have no great motivation to find ways to clear out the infection. ADDENDUM A legislation on the desk of California governor, Jerry Brown, requires that IoT devices have reasonable security feature(s) “appropriate to the nature and function of the device.” This would come into effect in January 2020. Why this legislation is so important? The lucrative California market makes it impossible for companies to ignore. If they want to sell in California, they will need to improve security in their devices. This will benefit all states. Sales * Enterprise Sales * Become a Partner * Contact Sales: * +49 89 2555 2276 About DDoS Attacks * What is a DDoS Attack? * What is a DDoS Botnet? * Famous DDoS Attacks * DDoS Mitigation DDoS Attacks * Memcached DDoS Attack * NTP Amplification Attack * DNS Amplification Attack * SSDP Attack * Low and Slow Attack * Application Layer Attack * Layer 3 Attacks * Cryptocurrency Attacks * Ransom DDoS attack * Smurf Attack (historic) * Ping of Death (historic) * ACK Flood Attack * DNS Flood * HTTP Flood * Ping (ICMP) Flood Attack * QUIC Flood Attack * SYN Flood Attack * UDP Flood Attack DDoS Attack Tools * How to DDoS * Low Orbit Ion Cannon * High Orbit Ion Cannon * R U Dead Yet? (R.U.D.Y.) * Slowloris Attack * DDoS Booter/IP Stresser * IP Spoofing * Malware * Mirai Botnet DDoS Glossary * Denial Of Service * Blackhole Routing * OSI Model * TCP/IP * ICMP * HTTP * Web Application Firewall (WAF) * User Datagram Protocol (UDP) * Layer 7 * Internet Of Things (IOT) Learning Center Navigation * Learning Center Home * DNS Learning Center * CDN Learning Center * Serverless Learning Center * Security Learning Center * Performance Learning Center * SSL Learning Center * Bots Learning Center * Cloud Learning Center * Access Management Learning Center * Network Layer Learning Center * Privacy Learning Center * Video Streaming Learning Center * Email Security Learning Center © 2022 Cloudflare, Inc.Privacy PolicyTerms of UseReport Security IssuesCookie PreferencesTrademark OUR SITE USES COOKIES Like most websites, we use cookies to make our site work the way you expect it to, improve your experience on our site, analyze site usage, and assist in our marketing efforts. By choosing "Accept", you agree to the storing of all categories of cookies on your device. If you wish to reject some or all categories of cookies, please click "More Options" Cookie Preferences Reject All Accept All Cookies