How 62 Default Passwords Knocked Twitter and Netflix Offline in 2016

Friday, Oct. 21, 2016, was a strange morning to be online. Around 7:10 a.m. Eastern, Twitter stopped loading for a lot of people. Then Reddit, Spotify and Netflix went wobbly, along with PayPal, GitHub, Shopify and SoundCloud, plus a long list of other names you'd know.

None of those companies had been broken into. Their own computers were fine. What broke was a service in the middle, one most people don't think about, that tells your phone where to find them.

The attack that jammed it didn't come from a hacker's lair. A big share of the junk traffic came from gadgets that people had bought at an electronics store and then forgotten about: security cameras, the little boxes that record them (DVRs, short for digital video recorders), and home Wi-Fi routers. Somewhere, a camera pointed at someone's front door was helping knock Twitter offline.

It comes down to a list of 62 passwords.

What this means for you

If you have a camera, video recorder or router at home that still uses the password it came with, it's the kind of gadget this attack was built on. The fix takes a few minutes: change that password to a strong one, install any updates the maker offers, and switch off a router setting called UPnP unless you need it. The steps are at the end of this story.

The address book that fell over

Every website has a name, like twitter.com, and every name has to be turned into a number before a computer can connect to it. That job belongs to the Domain Name System, or DNS, which works like an address book for the whole internet. Many sites rent theirs from a specialist company, and Dyn was one of them.

Dyn's address book got flooded twice that morning. The first wave ran from about 7:10 to 9:20 a.m. Eastern, and the second from about 11:50 a.m. to 1 p.m., with leftover trouble lasting until roughly 4:30 p.m. The sites were up, but with the address book jammed, your phone couldn't find them. The first wave started by flooding Dyn's servers in Asia Pacific, South America, Eastern Europe and the U.S. West, then abruptly swung toward its East Coast data centers, so engineers added more defenses on top of the automatic ones. They reshaped and rerouted traffic, filtered the junk, and deployed scrubbing services. Dyn's chief strategy officer, Kyle York, told reporters during the afternoon: "It's a very smart attack. As we mitigate, they react."

Early numbers sounded impossible, with traffic coming from tens of millions of internet addresses. The real count turned out to be smaller and stranger. Up to 100,000 hijacked devices did the attacking. When Dyn's servers got swamped and started dropping requests, the internet's lookup servers kept retrying, and the retries piled on until traffic ran 10 to 20 times normal, which made the crowd look far bigger than it was.

Hold onto that number. A hundred thousand forgotten gadgets were enough to rattle some of the biggest names on the internet.

Sixty-two guesses

The software that took over those gadgets is called Mirai. It's malware, meaning software built to do harm, and it spreads by itself from one device to the next. The result is a botnet, a pile of hijacked devices that all obey one controller while their owners usually notice nothing.

Mirai's trick is almost embarrassing. It picks internet addresses at random and knocks on a door called Telnet, an old way of logging into a machine from far away. (Ports 23 and 2323, if you like numbers.) When a device answers, Mirai tries to log in using 10 username-and-password pairs chosen from a built-in list of 62. Every pair on the list is a factory default, the login a device ships with and plenty of owners leave alone. Passwords such as "admin," "123456" and "888888" are on it, along with odder ones like "xc3511," a default on certain Chinese-made DVRs.

A hit gets sent to a report server, and a second program then logs in and installs the malware. The new recruit then starts knocking on doors itself. It deletes its own file, scrambles its process name, and shuts out rival malware so nobody else can use the device.

Diagram in four steps: a camera with an open door is found, 10 of 62 factory logins are tried, the camera is taken over, and hundreds of cameras then flood one internet address book. How Mirai spread: find a gadget, try factory logins, take it over, then use it to flood the internet's address book.

The speed is what stuns. Mirai's first scans began on Aug. 1, 2016, from a single address. Within a minute, 834 devices were scanning. Within 10 minutes, about 11,000 were infected, and within 20 hours about 64,500. For the next couple of months it held steady at 200,000 to 300,000 devices.

The gear came from a short list of makers. A handful of consumer electronics companies, with big market shares and weak design choices, ended up deciding what the botnet was made of.

Each device was feeble. Most scanned at less than 250 bytes a second, roughly 6,000 times slower than a famous 2003 internet worm called SQL Slammer, but hundreds of thousands of weaklings pushing together add up to a battering ram. Brazil, Colombia and Vietnam alone held 41.5 percent of the infected devices, while half of the targets sat in the U.S.

The attacks themselves are called DDoS attacks, short for distributed denial of service. Thousands of machines send so many requests at one target that real visitors can't squeeze through.

The blogger and the French web host

Mirai's first famous victim was a journalist. Around 8 p.m. Eastern on Sept. 20, 2016, the site of security reporter Brian Krebs took roughly 620 gigabits of traffic every second. The company defending it, Akamai, had logged nothing bigger than 363 before. Two days later his site went offline for nearly four days.

Around the same time, the French hosting company OVH took an even bigger hit from the same botnet.

Then, on Sept. 30, Paras Jha posted Mirai's complete source code on a hacker forum under the name Anna-Senpai, with a headline promising the "world's largest net." Source code is the recipe, and now it was free. Dozens of variants followed, run by competing operators, with at least 48 different password lists among them. One variant added a router flaw and helped knock out service for customers of Deutsche Telekom in late November, which pushed the botnet to its peak of about 600,000.

The Dyn attack came three weeks after the leak. Researchers traced it to a different cluster of Mirai-infected devices than the one that hit Krebs, which points to copies of the leaked recipe in different hands. The attack commands also tell a smaller story than the headlines did. Alongside Dyn, the botnet was told to hit PlayStation's name servers and servers for Xbox Live and Steam. The likeliest target was gaming, and Twitter, Netflix and the rest were collateral damage.

By the end of February 2017, the botnet had shrunk to roughly 100,000 devices, partly, it seems, because internet providers cleaned up their customers' gear. One Colombian provider alone shed 38,589 infected devices.

Three young men and a plea deal

On Dec. 8, 2017, three men pleaded guilty in federal court in Alaska to conspiring to violate the Computer Fraud and Abuse Act by running Mirai: Paras Jha, 21, of Fanwood, New Jersey; Josiah White, 20, of Washington, Pennsylvania; and Dalton Norman, 21, of Metairie, Louisiana. They'd built it in the summer and fall of 2016, and at its peak it held hundreds of thousands of hijacked devices.

Jha had a second charge, closer to home. He also pleaded guilty in New Jersey to attacking Rutgers University's network between November 2014 and September 2016, shutting down the central server behind the portal where students turned in assignments, at times for days at a stretch.

After the code went public, Jha and Norman moved on to a second botnet. From December 2016 to February 2017 they infected over 100,000 mostly American devices, such as home routers, for clickfraud, a scheme that fakes clicks on online ads to earn money.

There was no prison time. On Sept. 18, 2018, a federal judge sentenced all three to five years of probation, 2,500 hours of community service and $127,000 in restitution. They also gave up seized cryptocurrency, and they must keep working with the FBI. The reason was cooperation: the men had helped agents with other complex cybercrime investigations. "Cyber criminals often develop their technical skills at a young age," said Jeffery Peterson, who led the FBI's Anchorage office. "This case demonstrates our commitment to hold criminals accountable while encouraging offenders to choose a different path to apply their skills."

Neither Justice Department announcement mentions the Dyn outage.

What to do about the box on your shelf

Illustration: a home security camera with its plug pulled from the wall outlet, a Restart arrow, and a sticky note with a long new password. Take it off your network, restart it, then change the password before it goes back online.

Mirai lives only in a device's working memory, so a reboot wipes it out. The catch is that a device still wearing its factory password can be reinfected quickly, so the order matters: disconnect it from the network, reboot, change the password, and only then plug it back in.

The U.S. cybersecurity agency CISA laid out the prevention steps, and they're short. Change every default password to a strong one, on every connected gadget. Install security updates as soon as the maker offers them. Turn off UPnP on your router unless something truly needs it; that's a setting that lets gadgets ask your router to open paths to the internet on their own. And buy from companies with a reputation for making secure devices.

The researchers who tracked Mirai from its first scan to its decline closed their paper with a thought about the name. "Mirai seems aptly named," they wrote. "It is Japanese for 'the future.'"

The 62 Passwords That Turned Home Cameras Into a Weapon