The Mirai botnet that used Internet of Things (IoT) devices to launch one of the largest distributed denial-of-service (DDoS) attacks to date was powered by a list of 61 default passwords.
Following the release of the botnet’s source code by its creator, security researchers have noticed the botnet leverages a list of more than 60 combinations of usernames and weak default passwords to scan the internet for insecure IoT devices.
By scanning the internet for these common default passwords – which include “admin” and “12345” – the malware can compromise devices and lock out its users. This method allowed the botnet to grow spread to 380,000 devices.
Mirai is responsible for successful attacks aimed at French hosting company OVH and cybersecurity journalist Brian Krebs’ website, krebsonsecurity.com.
