Scourge · October 21 2016

The Scourge of Mirai

Chronicle

On 21 October 2016, in two waves, a huge DDoS from the Mirai botnet hit Dyn, a DNS provider. Its army was made of cameras, video recorders and other connected devices still using factory passwords. For hours Twitter, Netflix, Reddit, GitHub and many other sites became unreachable across much of the US and Europe. Mirai's three young authors later pleaded guilty in US federal court to creating the botnet.

Lesson learned

It made clear that the Internet of Things was also the Internet of default passwords, and that relying on a single DNS provider creates a single point of failure.

Prayer of reparation

O Mirai, army of cameras that watched nothing, teach manufacturers to change factory passwords and teach us not to depend on a single DNS. Amen.

How it is remembered

Remembered by changing the password on the home camera, updating connected devices' firmware and using more than one DNS provider for your domains.