DDoS distributed denial-of-service attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers.

Such an attack is often the result of multiple compromised systems (for example, a botnet) flooding the targeted system with traffic.

Mirai Botnet

For our reader who are unfamiliar with Mirai: Mirai is malware which turns computer systems running Linux into remotely controlled “bots”, that can be used as part of a botnet in large-scale network attacks.

- Advertisement -

It primarily targets online consumer devices such as remote cameras and home routers.The Mirai botnet has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks.

DDOS Mirai botnets available for Hire from Two hackers, which they claim has more than 400,000 infected bots, ready to carry out DDoS attacks at anyone’s behest. Recent High profiled DDOS attack’s with (kerbs,DNS service provider Dyn).

Two security researchers that go online only by their nicknames, 2sec4u and MalwareTech, have been tracking some of these Mirai-based botnets via the @MiraiAttacks Twitter account and the MalwareTech Botnet Tracker.

Advertising 400k Mirai Botnet

In a spam campaign carried out via XMPP/Jabber started yesterday, both hackers have begun advertising their own DDoS-for-hire service, built on the Mirai malware.The two claim to be in the control of a Mirai botnet of 400,000 devices, albeit we couldn’t 100% verify it’s the same botnet observed by 2sec4u and MalwareTech.

• Rent from Biggest Mirai Botnet (400k+ devices)
• We use 0day exploits to get devices – not only telnet and ssh scanner.
• Anti ddos mitigation techniques for tcp/udp.
• Limited spots – Minimum 2 week spot.
• Flexible plans and limits.
• Free short test attacks, if we have time to show.

How mirai having control over this Huge DDOS Attack

Conventional Botnets

Conventional botnets are made by leveraging methods such as malicious spam, exploits, executable infection, and social engineering to infect desktop computers.it’s a fact that the AV industry has put a significant dent in botnets and general malware propagation over the past decade. Nowadays hackers have to spend large amounts of time and money constantly modify their malware to evade AV detection, and although botnets still exist

Profitability – At current the maintenance cost of  desktop botnets has exceeded the revenue from DDoS attacks for most. Cheap anti-DDoS services make DDoS protection more affordable that paying ransoms to attackers, resulting in DDoS for hire or DDoS ransom based botnets slowly dying out.

Noise – As we saw with Mirai, DDoS attacks are noisy and draw a lot of attention. Mirai, which was mostly ignored due to its unsophisticated telnet bruteforcing attacks.

Overblown Statistics – The few large desktop botnets which do perform DDoS usually end up being sinkholed; however, sinkholes often measure botnets by unique IPs over a few month period (keep in mind lots of infections will have dynamic IPs which change daily), resulting in infection numbers being hugely over-inflated.

Conclusion

It’s likely that significant DDoS attacks will become more common as hackers find more and new vulnerable IoT devices, or was to infect those vulnerable devices hidden behind NAT.

Also Read:

1. Does Anna-Senpai, the Mirai Worm Author?

2. Top 10 Cities | Countries in the World for Total Bot Population

3. DDoS attack prevention method on your enterprise’s systems – A Detailed Report