The Botnet: Mirai and the Day Dyn Fell

On Monday, the internet is still counting the damage from the biggest attack in its history, and the attack came from the least likely weapons: cameras, routers, and digital video recorders. On Friday, October 21, a botnet made of more than a hundred thousand hacked internet-connected devices bombarded Dyn, a company that manages a critical part of the internet's address system, and the bombardment took down Twitter, Netflix, Reddit, Spotify, PayPal, and a long list of other services for hours. The attack is the October 2016 story, and the story is the lesson: the internet of things is the internet of vulnerable things, and the vulnerability is ours.

The Botnet is the subject of this article: how the attack worked, why it was so powerful, what it revealed about the internet of things, and what it means for the future of the network. The attack came in three waves on Friday, and the postmortems have been running ever since. This is the story of the botnet, and the story is about the day the weakest devices in the world took down the strongest.

1. The Target

The target of the attack was Dyn, a company most internet users had never heard of, and the company was the perfect target. Dyn runs a service called DNS, the domain name system, the directory that turns the names people type, like twitter.com, into the numbers that computers use to find each other. When the directory is slow, the whole internet feels slow, and when the directory is down, the whole internet looks down.

Dyn was not the only DNS provider, and it was not the biggest, and it was big enough to matter. The company's customers included some of the most popular services on the internet, and the services had chosen Dyn for the reliability it promised. The attack on Friday showed that reliability had a price: the company that everyone relied on became the company that everyone's outage was blamed on. The target was the directory, and the directory was the single point of failure.

2. The Weapon

The weapon of the attack was a botnet called Mirai, and the botnet was made of the internet of things. The botnet was a network of hacked devices: internet protocol cameras, digital video recorders, home routers, and other gadgets that connect to the internet and do one job. The devices were recruited through a weakness that was almost too simple to believe: they still had their factory-default usernames and passwords, and the botnet tried the defaults until it got in.

The recruited devices did not know they were weapons. The cameras kept recording and the routers kept routing, and inside each one sat a small piece of code that waited for orders. When the orders came, the devices began sending requests to Dyn at full speed, and the requests were the flood. The weapon was the ordinary hardware of the connected home, and the ordinary hardware was the army. The weapon was the story, and the story was the scale.

3. The Flood

The flood came in three waves on Friday, and the waves were the biggest the internet had seen. The first wave hit in the morning, the second around noon, and the third in the afternoon, and each wave overwhelmed a different part of Dyn's infrastructure. The attack traffic peaked at more than a terabit per second, a record at the time, and the traffic was made of millions of connections from more than a hundred thousand sources.

The flood worked because the sources were everywhere. A traditional attack could be filtered by blocking the attackers, and the Mirai botnet was too distributed to filter: the sources were spread across the globe, and each source looked like an ordinary device. The flood was the point of the botnet, and the point was that the internet could not tell the difference between a camera in someone's living room and an attacker. The flood was the weapon doing its job, and the job was the outage.

4. The Outage

The outage spread across the internet like a power cut, and the spread was the visible damage. Twitter went down, and users saw error messages instead of tweets; Netflix, Spotify, Reddit, Airbnb, PayPal, GitHub, and a long list of other services went dark or slowed to a crawl. The services themselves were not attacked; they were unreachable because the directory that found them was under water. The outage was the confusion, and the confusion was the point.

The outage was also the lesson in how the internet works. The internet was designed to survive the loss of any single part, and the design had worked for decades, and the attack showed the weakness in the design: the DNS directory was a part that everyone depended on and no one controlled. The outage was the first time the whole internet felt fragile, and the feeling was new. The outage was the damage, and the damage was the message.

5. The Source

The source of the botnet was the surprise, and the surprise was the vulnerability. The Mirai source code had been released publicly in late September by someone using the name Anna-senpai, and the release had turned the malware into a tool anyone could use. The same botnet, or copies of it, had already been used in earlier attacks, including an assault on the security researcher Brian Krebs and on a French hosting company, and the attacks had been the warnings.

The warnings were ignored, and the ignoring was the story. The security industry had been saying for years that the internet of things was a security disaster waiting to happen, and the waiting ended on Friday. The devices that shipped with default passwords, that could not be updated, that no one thought about after installation, were the ammunition, and the ammunition was everywhere. The source was the ecosystem, and the ecosystem was the problem.

6. The Response

The response to the attack was the scramble, and the scramble was the industry's first reaction. Dyn worked through the day to filter the flood and restore the service, and the company said the attack was sophisticated and distributed, and the FBI began investigating. The affected services posted their status updates, and the status updates were the sound of the internet apologizing to itself.

The response was also the beginning of the questions. The regulators asked who was responsible for the security of the internet of things, and the manufacturers said the users, and the users said the manufacturers, and the circle was the answer. The security researchers published their analyses of the botnet, and the analyses showed the weaknesses in the devices. The response was the beginning of the conversation, and the conversation was the beginning of the fix.

7. The Fix

The fix for the problem was not a patch, and the fix was not a product; the fix was a change in how the industry thinks. The devices needed to ship with unique passwords, or with no passwords at all; the devices needed to be updateable; and the users needed to know that their cameras and routers were computers with all the risks of computers. The fix was the boring work of security hygiene, and the boring work was the only work that would help.

The fix was also the business opportunity. The companies that sold secure devices, that made security easy, that took responsibility for their products after the sale, would be the companies that the customers trusted. The market was ready for the fix, and the readiness was the hope. The fix was the future, and the future was the work.

8. The Lesson

The lesson of the attack is about the gap between the promise of the internet of things and the reality of its security, and the gap is the most dangerous gap in technology. The connected devices were sold as convenience, and the convenience hid the vulnerability: the camera that watched the baby was also a soldier in a botnet, and no one had told the owner. The lesson is that every device on the internet is a computer, and every computer can be turned against its owner.

The lesson is also about the shared nature of the network. The cameras that were hacked were not the target of the attack, and the owners of the cameras did not choose to attack anyone, and the damage fell on services that had nothing to do with the cameras. The internet is a commons, and the commons is only as strong as its weakest device. The attack is the October 2016 story, and the story is the lesson: the internet of things is the internet of vulnerable things, and the vulnerability is ours. The flood came from the living rooms of the world, and the living rooms did not know. The work of fixing the internet of things will be slow, and the slowness is the point: the devices that were sold in the millions will take years to secure or replace. The lesson for builders is to ship security as a feature, not an afterthought, and the lesson for buyers is that the cheapest device can be the most expensive one.

Tags

#engineering #technology