Mirai: cameras become an army capable of blocking sites

A connected camera or recorder seems too modest to threaten large sites. In 2016, Mirai shows the opposite. The program brings together insufficiently protected devices in a remotely controlled network, capable of sending a very large volume of traffic.

The search for accessible devices and the use of default identifiers play a central role. An object can continue to perform its apparent function while participating in an attack. Its owner does not need to have asked to target anyone.

On October 21, 2016, Dyn suffered a denial-of-service attack against its DNS infrastructure. This service helps Internet users to find the addresses of the sites. Saturating it can therefore make several platforms difficult to join, even if their own servers continue to work.

Dyn identifies Mirai as a major source of hostile traffic and works to reduce its effect. The automatic reactions of systems that retry their requests can also amplify the pressure. The phenomenon is not an identical intrusion in each of the sites that have become inaccessible.

In 2017, Paras Jha, Josiah White and Dalton Norman plead guilty to creating and operating the Mirai botnet. As the code has been circulated and reused, this procedure does not automatically assign each subsequent attack using Mirai to these three people.

The episode shows how a great service can be weakened by a multitude of small devices. The power of the attacking network comes from their addition and dependencies of its targets, not from the exceptional sophistication of each camera.