40. DoS and DDoS – Availability Attacks
40.6 Botnets and IoT – Mirai-Class Lesson
Botnet = many compromised devices obeying C2. Mirai-class public history: IoT cameras/DVRs with default passwords recruited into DDoS armies; source code release made copycats easy (public reporting).
Blue for Maharashtra SMB + home lab students:
- Change default IoT passwords; isolate cameras on guest VLAN
- Patch firmware when vendor ships fixes
- Egress filter: IoT subnet should not open random outbound to weird C2 ports
- Don't expose admin UIs to the internet
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Scans for IoT defaults; enrolls bots | Unique passwords; network segmentation; disable UPnP where unsafe |
| Uses botnet for hire (crimeware market – awareness only) | ISP/cloud scrubbing; never "rent bots" yourself (illegal) |
| Targets DNS providers / single big VIP | Multi-DNS; Anycast; capacity partners |
Ravindra Bagale's Tip
Students gharatli CCTV admin/admin thevun office VPN bridge kartat. IoT = DDoS fuel + office pivot. Guest VLAN + strong password. Interview: Mirai lesson = defaults + exposure, not "I built a botnet."
Practice task
Amir (fictional IT, Solapur) la 12 IoT cams. Write 8-step hardening runbook: password, firmware, VLAN, firewall egress, inventory spreadsheet for owner Raja. No scanning the public internet for cameras.
Real incident: Krebs on Security / Mirai era (2016)
Public reporting described a very large DDoS against Krebs on Security in September 2016, with telemetry discussed in the hundreds of Gbps range and later Mirai analysis by Cloudflare and others. Akamai's free protection for the site was withdrawn under the load (reported), forcing a hosting change. Lesson: even strong CDN relationships have limits; IoT defaults powered much of Mirai. Source: Krebs on Security posts / Cloudflare Mirai retrospective (verify; say "reported" for sizes).