Fighting Mirai in an automatic manner

Although over 2 years have passed since the first time Mirai attracted lots of public attention for crippling some well-known sites such as Krebsonsecurity, OVH, and DYN, the infamous Linux DDoS botnet family still come to the media center very often in now days, which is for its new variants get discovered, or some zero-day exploits are found being used to deliver Mirai samples. Actually Mirai and its variants have always been very active in the past 2 years. Our honeypot data shows Mirai has held the top 1 position for a long time among our captured Linux malware families in terms of sample number and, furthermore, its sample number has always kept an increasing trend.




Figure 1, Mirai sample captured by our honeypots


The Mirai's nearly crazy variant prolieration could probably be explained by the facts that Mirai and some of its variants (e.g., MASUTA, OWARI, SORA, OMNI) sources were released. By equipping the freely available bot code with the same easy to get IoT exploits, a scipt kiddie can quickly create his own version Mirai IoT botnet. Of course they build that is not for fun, but for profit(stats to the Mirai launched attacks seen in the past 3 months). To better illustrate the current variant status, we have made a word cloud based on the branch names extracted from captured samples, where the larger a branch name is, the more samples it stands for.



Figure 2, Mirai branch jungle


While building Mirai like botnets might be easy, the defence doesn't [seem that easy]. To break the game unbalance, we have spent a lot of time to improve our Mirai botnet detection and tracking. Now that work has been summarized and presented on 2 botnet related conferences held this year：

1，"Tracking Mirai Variants", VB2018 held in Montreal, Canada in October

2, "How many Mirai variants are there?", Botconf2018 held in Toulouse, France in December.


Both talks are about Mirai variant classification. They are mainly to answer the following questions:

1, What CNC information, or IoC, is included in the the newly captured samples?

2, Does the new variant change in C&C protocol (e.g., attack command code and attack options) ?

3, How to check whether 2 variants derive from the same code base?

4, How to extract the above information in a scalable manner so that we can quickly detect and track the newly emerging botnets by automatically analying dozens of new Mirai samples daily captured?


After plenty of manual analysis, we found the above 3 questions can be well answered by analysing the following 3 kinds of Mirai data which we call Mirai genes:





1, configuration


We firstly noticed the configuration because the interested IoC information was stored there, which was observed in the first version, and is still adhered to by many current variants. Further analysis shows the changes among variants can be well reflected by their configurations and the encryption keys. That inspired us to design configuration based classification.



2, supported attack methods


On the other hand, we also study each variant's supported attack methods to better track and understand their commands, because Miraints usually vary in terms of method count, command code, and attack options.








[since fighting botnet is always a kind of cat and mouse game, it's expected that there would be new variants emerging in the future. We will still keep a tight watch on that progress]