Mirai and the 2016 Dyn Attack: When Smart Cameras Took Down Sites

On 21 October 2016, many people in the United States and Europe found that popular websites, including Twitter, Reddit, Netflix, Spotify and GitHub, would not load. The sites themselves were working. The problem lay with a company most users had never heard of: Dyn, a provider of DNS services. It was under attack from a botnet called Mirai, built largely from poorly secured internet-connected devices such as cameras and home routers.

What DNS is, and why it was the target

The Domain Name System translates names such as example.com into the numeric addresses that computers use. If the DNS provider for a website stops responding, visitors cannot find the site, even though its servers are fine. Dyn hosted DNS for a large number of well-known brands, which made it an efficient target: knock out one provider and many sites are affected at once.

How Mirai worked

Mirai was a piece of malware that scanned the internet for devices with open remote-access services, mainly Telnet. It then tried a short list of default usernames and passwords, around 60 pairs such as "admin" and "admin" or the factory credentials used by particular manufacturers. Devices that still used their defaults were taken over and joined the botnet, and the malware then searched for more devices.

The infected devices were mostly internet-connected cameras, digital video recorders and home routers. Owners rarely noticed anything, because the devices continued to work, perhaps a little more slowly. Because these devices rarely receive updates, many were hard to repair.

A short timeline

• September 2016. The security journalist Brian Krebs reported that his website was hit by a very large flood of traffic, in the region of 600 gigabits per second. The French hosting company OVH was hit by an attack that it described as exceeding a terabit per second.
• Late September 2016. Someone using the name Anna-senpai released the Mirai source code on a hacking forum. Once the code was public, anyone could build their own botnet.
• 21 October 2016. Attacks on Dyn came in several waves during the day. Dyn said the traffic came from a large number of sources, including Mirai-infected devices, and that around 100,000 malicious endpoints were involved.

Who was responsible

In December 2017, three young men, Paras Jha, Josiah White and Dalton Norman, pleaded guilty in US courts to offences connected to creating and running Mirai, including using the botnet for click fraud and attacks on other targets. The authorities did not publicly tie the October 2016 attack on Dyn to a specific named person, and the motive for that attack remains unclear. It is more accurate to say that Mirai was behind the attack than to say who launched it.

The fallout for device makers

The incident exposed how many consumer devices were shipped with fixed default passwords that users were never forced to change. One Chinese component maker whose products were found in many infected cameras announced a recall of some devices. Regulators in several countries began to draft rules requiring unique default passwords and a way to update security-critical devices. California passed a law along those lines in 2018, and the United Kingdom followed with its own legislation.

Lessons for website owners

A DDoS attack on your own site is one risk. Another is that the provider you depend on, for DNS, hosting or your CDN, becomes the target. Sites that used more than one DNS provider recovered faster than those with a single point of failure. There are practical steps you can take:

1. Change default passwords on every device on your network, such as routers, cameras and printers, and update their firmware.
2. Put your site behind a service that can absorb floods of traffic.
3. Choose DNS arrangements that do not depend on a single provider, where your setup allows.
4. Keep a plan for telling customers what is happening when an outage is outside your control.

Why a DDoS attack is hard to stop

A distributed denial-of-service attack uses many sources at once, so you cannot simply block one address. Each infected camera sends what looks like an ordinary request, but when tens of thousands arrive in the same moment, the target is overwhelmed. Mirai was efficient at this because it could generate large floods from relatively weak devices, and because it used techniques that made the traffic harder to filter.

The defence is capacity and distribution. Providers that operate large networks with many locations can absorb floods that would flatten a single server, and they can filter on the edge before the traffic reaches your site. That is why services built for this purpose became a standard part of how serious sites operate after 2016.

Mirai's source code also spawned many variants over the following years, some of which added new exploits so they could take over devices beyond those with default passwords. This illustrates how once malicious code is public, it rarely disappears. It is reused, improved and used again.

The practical lesson for site owners

Do not leave anything with a factory password, and do not assume that an outage is always your server's fault. A content delivery network spreads your content across many locations and can absorb a great deal of malicious traffic before it reaches your server. Cloudflare's CDN is available on our hosted sites; read about it on the CDN page, and see our security overview for the other protections that complement it.