View source for Hajime vs Mirai vs Carna

== Introduction ==

IoT [[Botnets|botnet]] are networks of IoT devices that have been [[IoT_Malware|infected by malware]] and can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. IoT devices are specially  in high demand for those attacks simply by the nature that so many of such devices exist.[[File:IoT_devicesNumber.png|center|thumb|Estimated number of IoT Devices<ref name="IoTDevices">[https://www.researchgate.net/figure/Global-active-IoT-devices-over-the-years-1_fig1_360765945 ResearchGate - Global Active IoT Devices Over the Years]</ref>]]


In this article, we will examine and compare three well-known IoT botnets: Mirai, Hajime, and Carna.

== A Short History Of Botnets ==
The term ”botnet” refers to a network of compromised devices controlled by a single operator. Early examples like EarthLink Spammer in2000, one of the first large botnets, highlighted the potential of automated malicious activities.ZeuS, emerging in 2007, marked a turning point by enabling banking credential theft on a massive scale. The Carna botnet (2012) conducted the Internet Census, revealing systemic security issues in IoT devices. Modern botnets like Mirai and Hajime have showcased the immense power of leveraging vulnerable IoT devices for Distributed Denial of Service (DDoS) attacks.

== Mirai ==

Mirai<ref name="MiraiReference">https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Mirai.html</ref> is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service ([https://wiki.elvis.science/index.php?title=Denial_of_Service_Attacks DDoS]) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.<ref name="MiraiReference2">https://ieeexplore.ieee.org/document/8170867</ref>
[[File:Mirai_Kommunkation.png|center|thumb|Generic P2P Attack Communication<ref>Julian Wildauer, ''Hajime vs Mirai vs Carna'', Unpublished Manuscript, 2024.</ref>]]

== Hajime ==

Hajime differs from Mirai because it uses a peer-to-peer<ref name="PeerToPeerReference">https://www.researchgate.net/publication/345805408_Botnet_Fingerprint_Using_Bro-IDS</ref> architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.<ref name="HajimeReference">https://www.infopoint-security.de/media/Botnet_Hajime_Radware_Analyse.pdf</ref>
[[File:P2P_comm.png|center|thumb|Generic P2P Attack Communication<ref>Julian Wildauer, ''Hajime vs Mirai vs Carna'', Unpublished Manuscript, 2024.</ref>]]


== Carna ==

Carna is quite unusual. It was created as part of the Internet Census 2012<ref name="CarnaReference">https://census2012.sourceforge.net/paper.html</ref> project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers<ref>https://dl.acm.org/doi/pdf/10.1145/2656877.2656893</ref>, but overall, the census was illegal, and the results need to be treated therefore with caution.
[[File:carna420.jpg|center|thumb|Carna Clients in 2012<ref> name="carna">https://census2012.sourceforge.net/images.html</ref>]]

== Stages of Botnet Attacks ==

# '''Scanning:''' Identifies vulnerable devices via open ports or default credentials.  
# '''Infection:''' Installs malicious payload or backdoor.  
# '''Command and Conquer:''' Establishes connection to the botnet operator.  
# '''Attack Execution:''' Launches attacks such as '''DDoS''', data theft, or lateral movement.  

== Comparison of the Botnets ==
<center>
{| class="wikitable"
|+ Differences between Mirai, Hajime, and Carna
|-
! Botnet !! Architecture !! Main Objective !! Special Features
|-
| Mirai || Centralized (C&C) || DDoS attacks || Uses default logins for infiltration
|-
| Hajime || Peer-to-peer || Protection of infected devices || No centralized control, blocks ports
|-
| Carna || Centralized || Research purposes || Developed for mapping global IoT security, no destructive activities
|}
</center>

== Ethical Debate Around Botnets ==
While some botnets, like Carna, claim to serve research purposes, their legality and ethical implications are heavily debated. Unauthorized access, even for non-malicious intentions, raises questions about privacy and consent, underscoring the need for stricter security practices.

== Conclusion ==

Mirai, Hajime, and Carna have different goals and architectures. Mirai is used for large-scale [https://wiki.elvis.science/index.php?title=Denial_of_Service_Attacks DDoS] attacks, Hajime attempts to protect the devices it infects from other threats, and Carna was primarily a research project highlighting the security issues in IoT devices. What's interesting is that despite having very different objectives, these botnets often use similar methods to spread and compromise devices.

== References ==

* Mirai: [https://www.cloudflare.com/de-de/learning/ddos/glossary/mirai-botnet/ Cloudflare - Mirai Botnet]
* Hajime: [https://www.theregister.com/2017/04/27/hajime_iot_botnet/ The Register - Hajime IoT Botnet]
* Carna: [https://www.c0mplex1.com/blog/carna-botnet-history/ Complex1 - Carna Botnet History]
* [https://census2012.sourceforge.net/paper.html Internet Census 2012 - Carna Botnet Paper]
<references />

[[Category:Basic]]