IoT botnets: a case study on mirai malware

The rapidly growing presence of Internet of Things (IoT) ecosystem has not only contributed in digital transformation of industry, transportation, healthcare and many other fields with smart devices producing and sharing data online; but also promised innovative business models and novel user experiences. Cyber attacks targeting IoT devices have been known for a long time but they became widespread after Mirai malware in 2016. By means of Mirai and its variants, malicious actors gain control of IoT devices, add them to botnets and perform distributed denial of service (DDoS) attacks to various targets. These attacks cause service outage, financial and reputational loss of victim organizations. Publishing source code of malware online expedites evolution of malware and leads to new variants. Even these variants have similar mechanisms of attack, propagation and infection; they may target different vulnerabilities. Considering the significant impact of Mirai, the number of attempts to secure IoT ecosystem has been increased. Few countries issued legal measures to prevent circulation of vulnerable devices in their markets. Some, but not all, vendors called back their vulnerable devices or released security updates. In this study, the source code of Mirai, the inspirer of recent IoT botnets, was analyzed and propagation, infection, command&control mechanisms were revealed. The legal and practical measures against Mirai and its variants issued by vendors and authorities were researched, academic literature was reviewed. A user research was conducted to determine public tendencies and perception about IoT security in Turkey. It is observed that every two of five users don't change their IoT devices' default credentials during initial configuration. Popular free IoT vulnerability scanning applications developed for customers were tested and the results showed that these applications are inadequate to guide non-English speaking and low technolgy literacy skilled users about identified vulnerabilities. Findings were discussed, proposals of legal measures and certification of IoT devices were made to Turkish authorities, a web browser extension to enhance configuring IoT devices with secure passwords was designed for Turkish speaking home users.