An After-Action Analysis of the Mirai Botnet Attacks on Dyn

Background

On October 21, 2016, a series of distributed denial-of-service (DDoS) attacks against Dyn DNS impacted the availability of a number of sites concentrated in the northeastern United States and, later, other areas of the country. Flashpoint has assessed with high confidence — and Dyn has confirmed — that a Mirai botnet participated in the attacks, although it is unclear if other botnets were also involved. Flashpoint is continuing to work with security researchers and service providers to takedown the Mirai infrastructure that was involved in carrying out these high-volume attacks.

Impact

Impacted sites include but are not limited to:

• PayPal
• Twitter
• Reddit
• GitHub
• Amazon
• Netflix
• Spotify
• RuneScape

Timeline of the Attacks

• Starting at approximately 7:00 AM ET on October 21, a major DDoS attack was directed against three Dyn datacenters in the northeastern United States. The targeting of these DNS servers had localized impacts on users within these regions attempting to resolve DNS queries sent to Dyn servers.

• The attacks continued throughout the day in two subsequent waves: one occurring around 1:00 PM ET, and another later that evening. The two subsequent attacks were successfully mitigated by Dyn DNS and resulted in no outages, although some customers may have experienced slight delays.

Assessment of Attack Infrastructure

While the attacks were still ongoing, Flashpoint was able to confirm that some portion of the attack infrastructure used throughout the attack were botnets comprised of Mirai malware. Mirai botnets were previously used in the DDoS attacks earlier this month against the “Krebs on Security” blog and the French internet service and hosting provider OVH. Flashpoint has also confirmed that at least some of the devices used in the Dyn DNS attacks were digital video recorders (DVRs), further matching the technical indicators and tactics, techniques, and procedures (TTPs) associated with previous known Mirai botnet attacks.

Flashpoint assesses with moderate confidence that the Command and Control server used in the Dyn DNS attack was separate and distinct from those used in the Krebs and OVH attacks. It is unknown how the most recent attack compares to previous ones, and the size and scale of the infrastructure used. The previous Mirai attacks against OVH and Krebs were recorded at approximately 1 Tbps and 620 Gbps, respectively.

The development of Internet of Things (IoT) botnets over the past few years has enabled those in the hacking community to launch DDoS attacks at a scale that was previously impossible. These developments have culminated in the Mirai botnets used in these attacks. Mirai targets IoT devices like routers, DVRs, and web-enabled security cameras, enslaving vast numbers of these devices into a botnet, which is then used to conduct DDoS attacks. Mirai malware has strategically targeted the right IoT devices that allow for botnets of immense size that maximize disruption potential.

Dubious Claims of Responsibility

Over the weekend, various actors have spoken out to claim responsibility for the attack or to attribute it to a different set of actors. Some of the most high-profile claims are as follows:

• The well-known grey hat hacker “The Jester” has intimated that the Russian government is behind the attacks. On October 22, The Jester defaced the Russian Foreign Ministry’s website, posting a message scolding the government for the hacks against the Democratic National Committee (DNC) and the alleged interference with the 2016 US presidential election. Subsequent statements made by The Jester to media outlets, as well as the timing of the defacement, have indicated that the actor believes the Russian government to be the culprit.

• WikiLeaks has also linked itself to the attack, but stopped short of claiming credit. On October 21, the official WikiLeaks Twitter account @WikiLeaks asked “supporters to stop taking down the US internet.” The organization further stated that attackers had “proved [their] point.”

• On October 22, 2016, the hacker group known as “New World Hackers” appears to have claimed responsibility for the attack via its Twitter account @NewWorldHacking, stating that it had “broke a couple records” (an apparent reference to size of the earlier Mirai DDoS attacks, which broke records as the largest DDoS attacks in history.)

Flashpoint assesses with medium confidence that each of these claims is dubious and likely to be false.

Likely Ties to Hacking Forum Community

In its investigation of Dyn DDoS attacks, Flashpoint discovered that the infrastructure used in the attack also targeted a well-known video game company. While there does not appear to have been any disruption of service, the targeting of a video game company is less indicative of hacktivists, state-actors, or social justice communities, and aligns more with the hackers that frequent online hacking forums. These hackers exist in their own tier, sometimes called “script kiddies,” and are separate and distinct from hacktivists, organized crime, state-actors, and terrorist groups. They can be motivated by financial gain, but just as often will execute attacks such as these to show off, or to cause disruption and chaos for sport.

Flashpoint assesses with moderate confidence that the most recent Mirai attacks are likely connected to the English-language hacking forum community, specifically users and readers of the forum “hackforums[.]net.” The personalities involved in these communities are known for creating and using commercial DDoS tools called “booters” or “stressers.” The hackers offer these services online for pay, essentially operating a “DDoS-for-hire” service. One of the few known personalities that have been associated with Mirai malware and botnets is known to frequent these forums. A hacker operating under the handle “Anna-Senpai” released the source code for Mirai in early October, and is believed to have operated the original Mirai botnet that was used in the attack against “Krebs on Security” and hosting provider OVH earlier this month. The hackers that frequent this forum have been previously known to launch these types of attacks, though at a much smaller scale.

Attack Motivations

Flashpoint assesses with moderate confidence that these attacks were not financially or politically motivated. Typically, financially motivated DDoS attacks will target business competitors, online gambling sites, or Bitcoin exchanges. Attackers can also use DDoS attacks or threats to extort money from businesses that would be affected by an outage. Despite various groups claiming responsibility for the attack, there have been no publicly available indicators of extortion — attempted or not — against Dyn DNS or any of the sites affected by the attack.

Similarly, Flashpoint discounts many of the claimed political motivations for this attack. Dyn DNS is a central target whose outage would affect a wide variety of website and online services, and does not disproportionately affect any one political entity. Such a broad scope of targeting does not lend itself to a politically motivated attack. Additionally, the indicators that we do have point to specific communities that have historically been apolitical.

Final Notes

The technical and social indicators of this attack align more closely with attacks from the Hackforums community than the other type of actors that may be involved, such as higher-tier criminal actors, hacktivists, nation-states, and terrorist groups. These other types of threat actors are unlikely to launch such an attack without a clear financial, political, or strategic objective, and they are very unlikely to launch an attack against a video game company. Participants in the Hackforums community have been known to launch DDoS attacks against video game companies to show off their credentials as hackers of skill, or to “troll” and gain attention by causing disruption to popular services.