> series: anatomy_of_a_breach —— part: 094 —— weapon: mirai_botnet —— devices: 100,000_iot —— casualties: twitter_netflix_reddit_spotify<span class="cursor-blink">_</span>_
On 21 October 2016, three waves of DDoS attacks struck Dyn, a managed DNS provider whose infrastructure resolved domain names for hundreds of major websites. The attacks, peaking at over 1.2 Tbps (terabits per second) — four times the record-setting Spamhaus attack of 2013 — overwhelmed Dyn's DNS servers and caused widespread service disruptions across the eastern United States and Europe. Twitter, Netflix, Reddit, Spotify, GitHub, PayPal, Amazon, the BBC, and dozens of other major services were inaccessible for hours.
The weapon was the Mirai botnet — a network of approximately 100,000 compromised Internet of Things (IoT) devices, primarily IP cameras, digital video recorders (DVRs), and home routers manufactured by companies like Dahua and XiongMai. Mirai spread by scanning the internet for IoT devices with default factory credentials — trying a list of just 62 common username-password combinations (admin/admin, root/root, etc.). The devices, which had never had their default passwords changed by their owners, were enrolled into the botnet and used to generate the traffic that took down half the internet.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallMirai's infection mechanism was devastatingly simple: it scanned the internet for devices with open Telnet ports and attempted to log in using a hard-coded list of 62 factory-default credentials. Devices that accepted these credentials were immediately compromised and recruited into the botnet. The list included entries like admin/admin, root/root, root/12345, admin/password — the same default credentials that have appeared in this series since the News of the World voicemail PINs (2011).
The Mirai attack established that IoT device security is not just a consumer concern — it is an internet infrastructure concern. Insecure devices in homes and businesses become the weapons that take down services worldwide. For organisations, the defence is twofold: secure your own IoT devices (change defaults, segment IoT networks, monitor IoT traffic), and ensure your services are resilient to DDoS (multi-provider DNS, CDN-based mitigation, incident response planning).
Cyber Essentials mandates default credential change and device security. Our infrastructure testing assesses IoT device security and DDoS resilience. SOC in a Box monitors for IoT compromise indicators and DDoS attack precursors. And UK Cyber Defence provides incident response during active DDoS events and IoT compromise investigations.
<a href="/cyber-essentials">Cyber Essentials</a> mandates default password changes. <a href="/penetration-testing/infrastructure">Infrastructure testing</a> assesses IoT security and DDoS resilience. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for IoT compromise.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call