While doing heap research on Linux processes (results are going to be published
soon), I came across the bot from the Mirai Botnet. As already mentioned in the
blog post by
Brian,
the Mirai bot uses obfuscated configuration data which contains e.g. the CnC
server. When now confronted only with a bot (e.g. in the context of a running
task or the ELF binary), but without the according source code, the decryption
of this configuration data for e.g. incident analysis purposes might not be
easily possible (with the python script from the blog post), if the key has been
changed.
But in this case that is not a problem at all, because
Mirai
A Quick Insight Into the Mirai Botnet
As you might have read,
I recently had a closer look at how easy it actually is to become part of an IoT Botnet.
To start a further discussion and share some of my findings I gave a quick
overview at the recent Dayton Security Summit. The Mirai
Botnet was supposed to be one of the case studies here. But the way things go if
one starts diving into code…I eventually gave an overview of how the Mirai Bot
actually works and what it does. As such: Here a quick summary of the Mirai
Botnet bot.
As described in my previous post,
KrebsonSecurity.com was attacked by a major DDoS attack.
Reaching between 620Gbps and 660Gbps it was the largest documented DDoS attack
so far. The attack seemingly resulted from a Botnet called Mirai. Shortly after
the attack, a
post on hackforums
claimed to contain the actual source code of just this botnet.
The source code consists of
three projects: The bot itself with its CnC server and a loader component.