The Mirai botnet and the IoT Zombie Armies

TLDR

The rapidly growing presence of IoT devices has become an alluring playground for malicious actors who assemble botnets for DoS, spam, and ad fraud, exemplified by the Mirai malware responsible for massive DDoS attacks of unprecedented volume and diversity. The aim of this paper is to provide a comprehensive state‑of‑the‑art review of the IoT botnet landscape and the underlying reasons for its success, with a particular focus on Mirai and similar worms. We provide extensive details on the internal workings of IoT malware, examine their interrelationships, and elaborate on possible strategies for defending against them.

Abstract

The rapidly growing presence of Internet of Things (IoT) devices is becoming a continuously alluring playground for malicious actors who try to harness their vast numbers and diverse locations. One of their primary goals is to assemble botnets that can serve their nefarious purposes, ranging from Denial of Service (DoS) to spam and advertisement fraud. The most recent example that highlights the severity of the problem is the Mirai family of malware, which is accountable for a plethora of massive DDoS attacks of unprecedented volume and diversity. The aim of this paper is to offer a comprehensive state-of-the-art review of the IoT botnet landscape and the underlying reasons of its success with a particular focus on Mirai and major similar worms. To this end, we provide extensive details on the internal workings of IoT malware, examine their interrelationships, and elaborate on the possible strategies for defending against them.