Incident: Massive Cyber Attack on Internet Infrastructure by Mirai Botnet

Published Date: 2016-10-21

Postmortem Analysis
Timeline 1. The software failure incident happened on October 21, 2016 [48610, 48812, 48858, 48879]. 2. The incident occurred on October 21, 2016, based on the articles reporting the cyber attack on that specific date.
System 1. Dyn's servers [48610, 48812, 48845, 48879, 49748] 2. Internet-connected devices like cameras, baby monitors, and home routers [48603, 48812, 48845, 48858, 48879] 3. Domain Name System (DNS) [48610, 48812, 48845, 48879] 4. Web-enabled cameras, DVR boxes, and circuit boards manufactured by Hangzhou Xiongmai [48845] 5. Internet infrastructure [48845] 6. Twitter, Netflix, Spotify, Airbnb, Reddit, Etsy, SoundCloud, The New York Times, Mashable, CNN, The Wall Street Journal, Yelp, Amazon.com Inc., GitHub, Facebook, and other websites [48812, 48845, 48879, 49748]
Responsible Organization 1. Hackers using infected Internet of Things (IoT) devices [48812, 48820, 48845, 48879, 49748]
Impacted Organization 1. Twitter [48603, 48610, 48812, 48845, 48858, 48879, 49748] 2. Paypal [48603, 48879, 49748] 3. Spotify [48603, 48812, 48845, 49748] 4. Netflix [48610, 48812, 48845] 5. Reddit [48610, 48812, 49748] 6. CNN [48610] 7. PayPal [48879] 8. The Guardian [48812, 48845] 9. The New York Times [48610, 48879] 10. The Wall Street Journal [48610, 48879] 11. Fox News [48610] 12. Mashable [48879] 13. Yelp [48879]
Software Causes 1. The failure incident was caused by a distributed denial-of-service (DDoS) attack that targeted internet infrastructure provider Dyn, overwhelming their systems with malicious traffic from compromised internet-connected devices [48603, 48610, 48812, 48820, 48845, 48858, 48861, 48863, 48879, 49748].
Non-software Causes 1. The failure incident was caused by a distributed denial-of-service (DDoS) attack that overwhelmed the internet infrastructure company Dyn with traffic from millions of internet addresses [48603, 48610, 48812, 48820, 48845, 48858, 48861, 48879, 49748]. 2. The attack utilized hundreds of thousands of internet-connected devices like cameras, baby monitors, and home routers that had been infected with malicious software, allowing them to cause outages [48812, 48820, 48845, 48879]. 3. The attackers exploited vulnerabilities in internet-connected devices such as webcams and digital recorders that had been infected with a malicious code named Mirai [48879]. 4. The attack targeted Dyn, which is one of the companies that run the internet's domain name system (DNS) [48610]. 5. The attack was facilitated by the use of botnets comprised of compromised smart security cameras [48820]. 6. The attack was a wake-up call for the tech industry to improve network security and response capabilities [48845]. 7. The attack highlighted the vulnerabilities in the Internet of Things (IoT) devices, emphasizing the need for manufacturers to eliminate default passwords and ensure devices can be updated against security threats [48820, 48879]. 8. The attack underscored the interconnected vulnerabilities of large portions of the internet, with brand-name companies affected by an attack on a single company [49748].
Impacts 1. Many popular websites, including Twitter, Netflix, Spotify, Reddit, CNN, PayPal, Pinterest, Fox News, The New York Times, The Wall Street Journal, Facebook, and The Guardian, were made inaccessible [48603, 48610, 48812, 48820, 48845, 48858, 48861, 48863, 48879, 49748]. 2. Users across wide swaths of the United States experienced sporadic problems reaching several websites [48812]. 3. The attack caused widespread online disruption on both sides of the Atlantic [48610]. 4. The incident led to a massive internet outage [48861]. 5. The attack relied on hundreds of thousands of internet-connected devices infected with malicious code [48879]. 6. The disruption affected users in Western Europe as well [48879]. 7. The attack highlighted the critical role of DNS in maintaining a stable and secure internet presence [49748].
Preventions 1. Implementing stronger security measures in internet-connected devices, such as requiring users to change default passwords and ensuring devices can be remotely and automatically updated against security threats [Article 48820]. 2. Manufacturers eliminating default passwords on IoT gadgets and ensuring devices are secure from cyber security breaches [Article 48820]. 3. Tech industry players banding together to improve the security of the open internet [Article 48845]. 4. Regulating IoT security by entities outside the tech industry, such as government intervention similar to banking industry regulation of computer-based fraud [Article 48845]. 5. Having multiple vendors for core services like routing internet traffic to ensure redundancy and reliability [Article 48879].
Fixes 1. Strengthening password functions and sending patches for products made before April last year for devices like webcams to prevent cyber attacks [48820]. 2. Eliminating default passwords on devices and ensuring they can be remotely and automatically updated against security threats to prevent similar events from recurring [48820]. 3. Updating software to address vulnerabilities in the internet infrastructure to prevent hackers from redirecting users to fraudulent sites [99570].
References 1. Department of Homeland Security [48610, 48812, 48879] 2. Dyn [48610, 48812, 48845, 48858, 48861, 48879] 3. Hangzhou Xiongmai Technology [48820, 48845] 4. Bruce Schneier [48610, 48812] 5. Nsfocus [48812] 6. White Ops [48845] 7. Kaspersky Lab [48845] 8. Lawfare blog [48812] 9. Twitter [48812, 48879] 10. Netflix [48610, 48812, 48861] 11. Spotify [48610, 48812, 48879] 12. Reddit [48610, 48812, 48820] 13. CNN [48610, 48812, 48879] 14. PayPal [48610, 48879] 15. Pinterest [48610] 16. Fox News [48610] 17. The Guardian [48610, 48845] 18. The New York Times [48610, 48812, 48879] 19. The Wall Street Journal [48610, 48879] 20. Gizmodo [48610] 21. Mashable [48879] 22. CNN [48879] 23. Yelp [48879] 24. Amazon.com Inc [48879] 25. Twitter [49748] 26. Spotify [49748] 27. WikiLeaks [49748] 28. Level 3 Communications [49748] 29. NewWorldHacking [49748] 30. FBI [49748]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - Hangzhou Xiongmai Technology, a Chinese firm that makes parts for surveillance cameras, had its webcams involved in a cyber attack that took down major websites like Twitter, Spotify, and Reddit [Article 48820]. - Hangzhou Xiongmai Technology announced recalls for 4.3 million circuit boards used in cameras due to the attack, blaming users for not changing default passwords on its devices [Article 48845]. (b) The software failure incident having happened again at multiple_organization: - The cyber attack that took down major websites like Twitter, Netflix, Spotify, Airbnb, Reddit, Etsy, SoundCloud, and The New York Times was caused by a distributed denial-of-service attack that relied on hundreds of thousands of internet-connected devices infected with software [Article 48812]. - The attack affected Amazon's web services division, the world's biggest cloud computing company, causing an outage that lasted several hours [Article 48610]. - The attack also impacted Twitter, Paypal, and Spotify, making them inaccessible after connected devices were exploited to overwhelm the web infrastructure company Dyn with traffic from millions of internet addresses [Article 48603]. - The Department of Homeland Security and the Federal Bureau of Investigation were investigating the attacks that disrupted internet services in the United States and Europe, highlighting the unprecedented fears about cyber threats [Article 48879]. - The attack was a distributed denial-of-service attack that targeted Dyn, a major internet management company, affecting services and websites across the US and parts of Europe [Article 48858]. - The attack used hundreds of thousands of internet-connected devices infected with malicious code, causing outages that started in the Eastern United States and spread to other regions [Article 48879].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the articles discussing the vulnerability of internet-connected devices due to default settings and the use of stock code from open-source software, making them easier to hack [48603]. Additionally, the incident highlights the use of outdated technologies like DNS and one-factor authentication, which are struggling to be updated, leading to vulnerabilities in the system [48610]. (b) The software failure incident related to the operation phase is evident in the articles discussing the distributed denial-of-service (DDoS) attacks that overwhelmed internet infrastructure companies like Dyn due to hundreds of thousands of infected internet-connected devices, causing outages and disruptions in services [48812, 48820, 48845, 48858, 48879, 49748]. The misuse of these devices, which were infected without their owners' knowledge, contributed to the success of the attacks.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident was caused by factors originating from within the system. The incident involved a DDoS (distributed denial-of-service) attack that overwhelmed the US-based web infrastructure company Dyn with traffic from millions of internet addresses. The attack relied on hundreds of thousands of internet-connected devices infected with software that allowed hackers to flood Dyn's systems with overwhelming traffic [48603, 48812, 48820, 48879]. (b) outside_system: The software failure incident was also influenced by factors originating from outside the system. The attack involved exploiting vulnerabilities in internet-connected devices like cameras, baby monitors, and home routers that were infected with malicious software without their owners' knowledge. This external factor of insecure IoT devices contributed to the success of the DDoS attack [48610, 48820, 48879].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident involving a distributed denial-of-service (DDoS) attack on Dyn's servers was caused by hundreds of thousands of internet-connected devices like cameras, baby monitors, and home routers that had been infected with software allowing them to participate in the attack [Article 48812]. - The attack utilized a botnet comprised of approximately 500,000 compromised smart security cameras, highlighting the vulnerability of IoT devices to be hijacked for malicious purposes [Article 48820]. - The Mirai malware was used to power the botnet that carried out the DDoS attack on Dyn's servers, conscripting hordes of internet-connected devices into the botnet [Article 48858]. - The attack was facilitated by insecure devices like DVRs and web-enabled cameras that were hijacked using simple methods such as factory-default passwords, leading to an overwhelming amount of traffic directed at Dyn's servers [Article 48845]. - The attack on Dyn's servers involved connected devices infected with control software named Mirai, indicating the exploitation of vulnerabilities in IoT devices lacking proper security measures [Article 48879]. (b) The software failure incident occurring due to human actions: - The attack on Dyn's servers was attributed to the Mirai malware, which was associated with the English-language hacking forum community and individuals frequenting the forum 'hackforums[.]net' [Article 49748]. - The attack involved the use of botnets controlled by hackers, demonstrating the intentional actions taken by individuals to orchestrate the DDoS attack on Dyn's servers [Article 49748].
Dimension (Hardware/Software) hardware, software (a) The software failure incidents reported in the articles were primarily due to hardware-related issues. For example, the incidents involved the exploitation of hundreds of thousands of internet-connected devices like cameras, baby monitors, home routers, and smart security cameras that had been infected with malicious software, allowing them to be used in coordinated attacks [48603, 48812, 48820, 48845, 48879, 49748]. These hardware devices were hijacked and used to overwhelm internet infrastructure companies like Dyn with massive amounts of traffic, leading to widespread outages of major websites. (b) While the software failures were a result of vulnerabilities in the software running on these compromised devices, the root cause of the incidents can be traced back to the hardware being exploited. The software used in these devices lacked proper security measures, such as default passwords and the ability to receive remote security updates, making them easy targets for hackers to take control of and use in distributed denial-of-service (DDoS) attacks [48603, 48610, 48820, 48845, 48879, 49748].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident related to malicious intent: - The articles discuss Distributed Denial of Service (DDoS) attacks orchestrated by hackers using botnets like Mirai to flood servers with requests, causing outages and disruptions [48610, 48820, 48845, 48858, 48879, 49731, 49748]. - The attacks were described as digital warfare using insecure devices hijacked by hackers to increase traffic beyond network capacity [48845, 48879]. - The attackers enslaved hundreds of thousands of internet-connected devices to launch the attacks, including webcams, DVRs, and other IoT gadgets [48820, 48879]. - The attacks were aimed at companies like Dyn, OVH, and major internet infrastructure providers, indicating a malicious intent to disrupt services [48610, 48820, 48845, 48858, 48879, 49731, 49748]. (b) The software failure incident related to non-malicious factors: - The incident involved the exploitation of vulnerabilities in internet-connected devices, such as default passwords and lack of security measures, making them susceptible to being hijacked for attacks [48820, 48845, 48879]. - The articles highlight the need for manufacturers to eliminate default passwords and ensure devices can be updated against security threats to prevent similar events in the future [48820]. - Researchers noted that the Mirai malware evolved to infect more vulnerable routers, DVRs, and IoT gadgets, indicating a continuous development of the malware rather than a one-off attack [49731]. - The incident showcased the vulnerabilities in IoT devices and the potential risks posed by insecure connected devices, emphasizing the importance of security measures in such devices [48820, 48879].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The intent of the software failure incident related to poor_decisions: - The software failure incident involving the DDoS attack on Dyn and other major websites was primarily due to poor decisions made by manufacturers of internet-connected devices. These devices, such as cameras, baby monitors, and home routers, were infected with malicious software due to default passwords not being changed by users, making them vulnerable to being hijacked for the attack [48603, 48820, 48845, 48879]. (b) The intent of the software failure incident related to accidental_decisions: - The software failure incident involving the DDoS attack on Dyn and other major websites was also influenced by accidental decisions or unintended actions. For example, the attack relied on hundreds of thousands of infected internet-connected devices that were compromised without their owners' knowledge, indicating an unintentional contribution to the incident [48812, 48879].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the articles. The incident involving the distributed denial-of-service attack on Dyn was caused by hundreds of thousands of internet-connected devices infected with software that allowed hackers to overwhelm the servers with traffic [Article 48812]. The attack exploited vulnerabilities in IoT devices like cameras and home routers, which were infected with malicious code due to poor security practices such as default passwords and lack of updates [Article 48820]. Additionally, the attack was facilitated by the use of insecure devices with factory-default passwords, highlighting the lack of security measures in the design and development of these products [Article 48845]. (b) The software failure incident related to accidental factors is also apparent in the articles. The attack on Dyn's servers was described as a digital warfare of the least intelligent kind, where insecure devices were hijacked using simple methods like factory-default passwords [Article 48845]. The incident highlighted the unintentional consequences of using vulnerable IoT devices, as users may not be aware that their devices have been infected with malicious software [Article 48812]. The attack was not a deliberate act by the device owners but rather a result of the devices being compromised without their knowledge, emphasizing the accidental nature of the incident.
Duration temporary (a) The software failure incident in the articles was temporary. The incident caused widespread online disruption on both sides of the Atlantic, affecting major websites and services like Twitter, Spotify, Amazon, and Dyn. The outages were intermittent and varied by geography, starting on the East Coast and spreading westward in waves throughout the day and into the evening [Article 48610]. The attack overwhelmed Dyn's systems, causing disruptions that were resolved temporarily but resurfaced multiple times throughout the day [Article 48812]. The outages eased after two hours but returned with a vengeance at midday, affecting areas across the US and parts of Europe [Article 48858]. The attack was a distributed denial-of-service (DDoS) attack that swarmed Dyn with data requests from hijacked machines, leading to the temporary shutdown of services and websites [Article 48845]. The incident highlighted the interconnected vulnerabilities of the internet, with brand-name companies affected by the attack on a single company [Article 49748]. (b) The incident was caused by contributing factors introduced by certain circumstances but not all. The attack relied on hundreds of thousands of internet-connected devices infected with malicious code, allowing hackers to cause outages that started in the Eastern United States and spread to other parts of the country and Europe [Article 48879]. The attackers used compromised smart security cameras and other insecure "smart" devices to create a botnet for the attack, emphasizing the need for manufacturers to improve device security by eliminating default passwords and enabling automatic security updates [Article 48820]. The attack demonstrated the increasing sophistication and power of DDoS attacks, with hackers using simple methods like exploiting factory-default passwords to hijack insecure devices and flood networks with traffic [Article 48845].
Behaviour crash, omission, value, other (a) crash: - The software failure incident involved a crash where the system lost state and did not perform its intended functions. This is evident from the description of websites being knocked down and services being shut down due to overwhelming traffic, causing outages across the US and Europe [48812]. - The incident caused websites like Twitter, Spotify, Etsy, Netflix, and GitHub to be knocked for a loop, indicating a crash in their services [48858]. (b) omission: - The failure involved omission as the system omitted to perform its intended functions at instances, leading to websites becoming inaccessible and experiencing outages [48812]. - The incident resulted in the omission of services, affecting areas across the US and parts of Europe [48858]. (c) timing: - The software failure incident did not specifically involve timing issues where the system performed its intended functions too late or too early. (d) value: - The failure included the system performing its intended functions incorrectly, leading to websites being taken down as a result of overwhelming traffic from hijacked devices [48845]. - The incident caused disruptions and outages, preventing users from accessing various internet destinations, indicating incorrect performance of the system [48879]. (e) byzantine: - The incident did not exhibit byzantine behavior where the system behaved erroneously with inconsistent responses and interactions. (f) other: - The software failure incident involved a distributed denial-of-service attack, which is a type of attack not specifically categorized in the provided options [48845]. - The attack utilized hundreds of thousands of internet-connected devices infected with malicious code to cause outages, showcasing a unique behavior not fitting into the defined categories [48879].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, delay, non-human, theoretical_consequence (a) death: People lost their lives due to the software failure - No information about people losing their lives due to the software failure was mentioned in the articles. (b) harm: People were physically harmed due to the software failure - No information about people being physically harmed due to the software failure was mentioned in the articles. (c) basic: People's access to food or shelter was impacted because of the software failure - No information about people's access to food or shelter being impacted due to the software failure was mentioned in the articles. (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incident led to the disruption of major websites like Twitter, Spotify, Reddit, Netflix, Facebook, and others, affecting users' access to these services [48603, 48812, 48820, 48845, 48858, 48879, 49748]. (e) delay: People had to postpone an activity due to the software failure - Users across the US and parts of Europe experienced delays in accessing websites like Twitter, Spotify, Etsy, Netflix, and GitHub due to the software failure incident [48858]. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incident affected internet-connected devices like cameras, baby monitors, home routers, and smart security cameras that were infected with software, leading to the disruption of services [48603, 48812, 48820, 48845, 49748]. (g) no_consequence: There were no real observed consequences of the software failure - The software failure incident had real observed consequences, such as the disruption of major websites and services [48603, 48812, 48820, 48845, 48858, 48879, 49748]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The potential consequences discussed included the vulnerability of the internet infrastructure to future attacks, the need for improved security measures, and the interconnected vulnerabilities of the internet due to the attack on a single company [48610, 48845, 48879]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - No other consequences of the software failure were mentioned in the articles.
Domain information, sales, manufacturing, finance, knowledge, entertainment, government (a) The software failure incident affected the information industry, particularly websites and online services that provide information and content to users. Major news sites like The New York Times, The Guardian, and CNN were impacted, along with social media platforms like Twitter and entertainment services like Netflix and Spotify [48610, 48812, 48845, 48879]. (b) The transportation industry was not directly impacted by the software failure incident reported in the articles. (c) The natural resources industry was not directly impacted by the software failure incident reported in the articles. (d) The sales industry was indirectly impacted as some e-commerce platforms like Etsy experienced disruptions due to the attack on the internet infrastructure [48812]. (e) The construction industry was not directly impacted by the software failure incident reported in the articles. (f) The manufacturing industry was indirectly impacted as companies providing online services and products faced disruptions, affecting their ability to serve customers [48845]. (g) The utilities industry was not directly impacted by the software failure incident reported in the articles. (h) The finance industry was indirectly impacted as financial services and payment platforms like PayPal were affected by the attack on the internet infrastructure [48603, 48812]. (i) The knowledge industry, encompassing education and research, was indirectly impacted as online educational platforms and research websites experienced disruptions [48879]. (j) The health industry was not directly impacted by the software failure incident reported in the articles. (k) The entertainment industry was directly impacted as popular streaming services like Netflix and music platforms like Spotify were rendered inaccessible due to the attack on the internet infrastructure [48610, 48812, 48845, 49748]. (l) The government industry was indirectly impacted as government websites and services may have experienced disruptions during the incident [48879]. (m) The software failure incident was related to the technology industry, specifically the internet infrastructure and cybersecurity sector, as it involved attacks on companies providing critical internet services like DNS hosting and internet traffic optimization [48812, 48845, 49748].

Sources

Back to List