Mirai Source Code Analysis

This is a creation in Article, where the information may have evolved or changed.

Mirai overview

mirai,2016, a much-watched DDoS attack, unlike traditional botnets, Mirai's controlled zombies are primarily embedded devices such as cameras, and Mirai's emergence has brought a wave of security researchers into the realm of IoT security.

The main deeds of Mirai are:

• In 2016.9.20, the attack on Brian Krebs personal website, with an attack traffic of 665Gbps, was allegedly attacked by 1.5 million zombies.
• 2016.9.21, attack the French network service provider OVH, attack traffic reached 1Tbps
• 2016.9.30,mirai Open Source
• 2016.10.21, attacks Dyn DNS, leading to GitHub, Twitter and other U.S. Internet offline
• 2016.11.28, attack on Deutsche Telekom, Mirai new variant

Mirai has become the mother of IoT DDoS attacks.

Mirai can control such a large-scale botnet, the main reason is that the security of the various equipment providers, including male equipment, Zhejiang Dahua and other enterprises, all device passwords are the same and can not be modified by the user, and open the Telnet port so that Mirai easily burst successfully.

Of course, Mirai Open source, do not look at the white.

Architecture

Mirai architecture

Mirai is mainly composed of three parts, the source code corresponds to four modules:

• Loader: monitor bot report and upload payload to infected device
• Cnc:command&control, that is, the control server, the main function is to handle user login and issued orders
• Bot: payload, zombie Program
• Tools: Tool

Loader source Code Analysis

• Initiating a Telnet connection
• Maintenance State Machine

CNC Source Analysis

The CNC section is written by Golang, Golang can write high-performance servers with Goroutine+channel.
CNC Source code is mainly divided into:

• User Management
• Attack Command Management
• Infection Node Management
• Database management

Bot Source Code Analysis

Bot Module Division

Bot source is mainly divided into:

• Attack module: Parse the issued command, launch a Dos attack
• Scanner module: Scan telnet weak password login, escalate to Loader
• Killer module: Occupy Port, kill similar zombie (eliminationist)
• Public module: Utils

1. Bot main flow

1. Close the watchdog to prevent the device from restarting
2. Ensure_single_instance binding 48101 To prevent multiple instances from executing
3. Generate random number, encrypt process path and process name
4, establish daemon, close stdin, stdout, stderr
5. Attack_init Master process, Add_attack () Add attack type and callback function
6, Kill_init Create killer sub-process, according to the port number to find the PID kill process, Killer_kill_by_port
7, Scanner_init, scan sub-process, a dead loop
8. Main process, dead loop, monitoring CNC connection, parsing attack parameters, initiating attack

2. Attack module

① gets the domain name and port of the CNC from table.c, establishes the connection, and then listens to the CNC connection
② timing sends heartbeat, keep connected
③ Parse attack parameters, Attack_start dos attack

Attack mode

• Attack_app.c
• Attack_gre.c
• Attack_tcp.c
  1, Attack_tcp_syn ()
  2, Attack_tcp_ack ()
  3, Attack_tcp_stomp ()
• Attack_udp.c
  1, Attack_udp_generic ()
  2, Attack_udp_vse ()
  3, Attack_udp_dns ()
  4, Attack_udp_plain ()

3. Scanner Module

1, using raw socket exploratory scan Telnet Port 23rd, there is a response to Telnet login attempt
2, use the hard-coded weak password dictionary in Scanner_init to try to login Telnet
3, enter the login state machine, execute a series of commands to determine whether the login success
4, if the login is successful, open a sub-process, IP, port, user name, password in a fixed format to the Loader,loader scanlisten.go processing the results of receiving a violent scan

4. Killer module

5. Public module

• Talbe.c saves some hard-coded data, encrypts the data, and provides an interface to decrypt, remove, and add members to the outside.

Tools Source Analysis

• XOR or encryption
• Anti-GDB debugging
• Receive scan results