Hajime vs Mirai vs Carna
Introduction
IoT botnet are networks of IoT devices that have been infected by malware and can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. IoT devices are specially in high demand for those attacks simply by the nature that so many of such devices exist.
In this article, we will examine and compare three well-known IoT botnets: Mirai, Hajime, and Carna.
A Short History Of Botnets
The term ”botnet” refers to a network of compromised devices controlled by a single operator. Early examples like EarthLink Spammer in2000, one of the first large botnets, highlighted the potential of automated malicious activities.ZeuS, emerging in 2007, marked a turning point by enabling banking credential theft on a massive scale. The Carna botnet (2012) conducted the Internet Census, revealing systemic security issues in IoT devices. Modern botnets like Mirai and Hajime have showcased the immense power of leveraging vulnerable IoT devices for Distributed Denial of Service (DDoS) attacks.
Mirai
Mirai[2] is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service (DDoS) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.[3]
Hajime
Hajime differs from Mirai because it uses a peer-to-peer[5] architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.[6]
Carna
Carna is quite unusual. It was created as part of the Internet Census 2012[8] project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers[9], but overall, the census was illegal, and the results need to be treated therefore with caution.
Stages of Botnet Attacks
- Scanning: Identifies vulnerable devices via open ports or default credentials.
- Infection: Installs malicious payload or backdoor.
- Command and Conquer: Establishes connection to the botnet operator.
- Attack Execution: Launches attacks such as DDoS, data theft, or lateral movement.
Comparison of the Botnets
| Botnet | Architecture | Main Objective | Special Features |
|---|---|---|---|
| Mirai | Centralized (C&C) | DDoS attacks | Uses default logins for infiltration |
| Hajime | Peer-to-peer | Protection of infected devices | No centralized control, blocks ports |
| Carna | Centralized | Research purposes | Developed for mapping global IoT security, no destructive activities |
Ethical Debate Around Botnets
While some botnets, like Carna, claim to serve research purposes, their legality and ethical implications are heavily debated. Unauthorized access, even for non-malicious intentions, raises questions about privacy and consent, underscoring the need for stricter security practices.
Conclusion
Mirai, Hajime, and Carna have different goals and architectures. Mirai is used for large-scale DDoS attacks, Hajime attempts to protect the devices it infects from other threats, and Carna was primarily a research project highlighting the security issues in IoT devices. What's interesting is that despite having very different objectives, these botnets often use similar methods to spread and compromise devices.
References
- Mirai: Cloudflare - Mirai Botnet
- Hajime: The Register - Hajime IoT Botnet
- Carna: Complex1 - Carna Botnet History
- Internet Census 2012 - Carna Botnet Paper
- ↑ ResearchGate - Global Active IoT Devices Over the Years
- ↑ https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Mirai.html
- ↑ https://ieeexplore.ieee.org/document/8170867
- ↑ Julian Wildauer, Hajime vs Mirai vs Carna, Unpublished Manuscript, 2024.
- ↑ https://www.researchgate.net/publication/345805408_Botnet_Fingerprint_Using_Bro-IDS
- ↑ https://www.infopoint-security.de/media/Botnet_Hajime_Radware_Analyse.pdf
- ↑ Julian Wildauer, Hajime vs Mirai vs Carna, Unpublished Manuscript, 2024.
- ↑ https://census2012.sourceforge.net/paper.html
- ↑ https://dl.acm.org/doi/pdf/10.1145/2656877.2656893
- ↑ name="carna">https://census2012.sourceforge.net/images.html