Hajime vs Mirai vs Carna - Revision history

JWildauer at 14:27, 16 December 2024

2024-12-16T14:27:37Z

← Older revision		Revision as of 14:27, 16 December 2024
Line 12:		Line 12:

	Mirai<ref name="MiraiReference">https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Mirai.html</ref> is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service ([https://wiki.elvis.science/index.php?title=Denial_of_Service_Attacks DDoS]) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.<ref name="MiraiReference2">https://ieeexplore.ieee.org/document/8170867</ref>		Mirai<ref name="MiraiReference">https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Mirai.html</ref> is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service ([https://wiki.elvis.science/index.php?title=Denial_of_Service_Attacks DDoS]) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.<ref name="MiraiReference2">https://ieeexplore.ieee.org/document/8170867</ref>
			[[File:Mirai_Kommunkation.png\|center\|thumb\|Generic P2P Attack Communication<ref>Julian Wildauer, ''Hajime vs Mirai vs Carna'', Unpublished Manuscript, 2024.</ref>]]

	== Hajime ==		== Hajime ==

	Hajime differs from Mirai because it uses a peer-to-peer<ref name="PeerToPeerReference">https://www.researchgate.net/publication/345805408_Botnet_Fingerprint_Using_Bro-IDS</ref> architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.<ref name="HajimeReference">https://www.infopoint-security.de/media/Botnet_Hajime_Radware_Analyse.pdf</ref>		Hajime differs from Mirai because it uses a peer-to-peer<ref name="PeerToPeerReference">https://www.researchgate.net/publication/345805408_Botnet_Fingerprint_Using_Bro-IDS</ref> architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.<ref name="HajimeReference">https://www.infopoint-security.de/media/Botnet_Hajime_Radware_Analyse.pdf</ref>
	[[File:~~carna420~~.~~jpg~~\|center\|thumb\|Generic P2P Attack Communication<ref ~~name="P2P Attack Communication"~~>~~https://census2012.sourceforge.net/images~~.~~html~~</ref>]]		[[File:P2P_comm.png\|center\|thumb\|Generic P2P Attack Communication<ref>Julian Wildauer, ''Hajime vs Mirai vs Carna'', Unpublished Manuscript, 2024.</ref>]]


	== Carna ==		== Carna ==

	Carna is quite unusual. It was created as part of the Internet Census 2012<ref name="CarnaReference">https://census2012.sourceforge.net/paper.html</ref> project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers<ref>https://dl.acm.org/doi/pdf/10.1145/2656877.2656893</ref>, but overall, the census was illegal, and the results need to be treated therefore with caution.		Carna is quite unusual. It was created as part of the Internet Census 2012<ref name="CarnaReference">https://census2012.sourceforge.net/paper.html</ref> project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers<ref>https://dl.acm.org/doi/pdf/10.1145/2656877.2656893</ref>, but overall, the census was illegal, and the results need to be treated therefore with caution.
	[[File:carna420.jpg\|center\|thumb\|Carna Clients in 2012<ref name="carna">https://census2012.sourceforge.net/images.html</ref>]]		[[File:carna420.jpg\|center\|thumb\|Carna Clients in 2012<ref> name="carna">https://census2012.sourceforge.net/images.html</ref>]]

	== Stages of Botnet Attacks ==		== Stages of Botnet Attacks ==

JWildauer at 14:17, 16 December 2024

2024-12-16T14:17:25Z

← Older revision		Revision as of 14:17, 16 December 2024
Line 5:		Line 5:

	In this article, we will examine and compare three well-known IoT botnets: Mirai, Hajime, and Carna.		In this article, we will examine and compare three well-known IoT botnets: Mirai, Hajime, and Carna.

			== A Short History Of Botnets ==
			The term ”botnet” refers to a network of compromised devices controlled by a single operator. Early examples like EarthLink Spammer in2000, one of the first large botnets, highlighted the potential of automated malicious activities.ZeuS, emerging in 2007, marked a turning point by enabling banking credential theft on a massive scale. The Carna botnet (2012) conducted the Internet Census, revealing systemic security issues in IoT devices. Modern botnets like Mirai and Hajime have showcased the immense power of leveraging vulnerable IoT devices for Distributed Denial of Service (DDoS) attacks.

	== Mirai ==		== Mirai ==
Line 13:		Line 16:

	Hajime differs from Mirai because it uses a peer-to-peer<ref name="PeerToPeerReference">https://www.researchgate.net/publication/345805408_Botnet_Fingerprint_Using_Bro-IDS</ref> architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.<ref name="HajimeReference">https://www.infopoint-security.de/media/Botnet_Hajime_Radware_Analyse.pdf</ref>		Hajime differs from Mirai because it uses a peer-to-peer<ref name="PeerToPeerReference">https://www.researchgate.net/publication/345805408_Botnet_Fingerprint_Using_Bro-IDS</ref> architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.<ref name="HajimeReference">https://www.infopoint-security.de/media/Botnet_Hajime_Radware_Analyse.pdf</ref>
			[[File:carna420.jpg\|center\|thumb\|Generic P2P Attack Communication<ref name="P2P Attack Communication">https://census2012.sourceforge.net/images.html</ref>]]

	== Carna ==		== Carna ==
Line 19:		Line 23:
	[[File:carna420.jpg\|center\|thumb\|Carna Clients in 2012<ref name="carna">https://census2012.sourceforge.net/images.html</ref>]]		[[File:carna420.jpg\|center\|thumb\|Carna Clients in 2012<ref name="carna">https://census2012.sourceforge.net/images.html</ref>]]

			== Stages of Botnet Attacks ==

			# '''Scanning:''' Identifies vulnerable devices via open ports or default credentials.
			# '''Infection:''' Installs malicious payload or backdoor.
			# '''Command and Conquer:''' Establishes connection to the botnet operator.
			# '''Attack Execution:''' Launches attacks such as '''DDoS''', data theft, or lateral movement.

	== Comparison of the Botnets ==		== Comparison of the Botnets ==
Line 34:		Line 44:
	\|}		\|}
	</center>		</center>

			== Ethical Debate Around Botnets ==
			While some botnets, like Carna, claim to serve research purposes, their legality and ethical implications are heavily debated. Unauthorized access, even for non-malicious intentions, raises questions about privacy and consent, underscoring the need for stricter security practices.

	== Conclusion ==		== Conclusion ==

JWildauer: JWildauer moved page User:Hajime vs Mirai vs Carna to Hajime vs Mirai vs Carna

2024-12-16T14:06:53Z

JWildauer moved page User:Hajime vs Mirai vs Carna to Hajime vs Mirai vs Carna

← Older revision	Revision as of 14:06, 16 December 2024
(No difference)

JWildauer at 14:01, 16 December 2024

2024-12-16T14:01:45Z

← Older revision		Revision as of 14:01, 16 December 2024
Line 46:		Line 46:
	<references />		<references />

	[[Category:~~Basics~~]]		[[Category:Basic]]

JWildauer at 13:59, 16 December 2024

2024-12-16T13:59:54Z

← Older revision		Revision as of 13:59, 16 December 2024
Line 45:		Line 45:
	* [https://census2012.sourceforge.net/paper.html Internet Census 2012 - Carna Botnet Paper]		* [https://census2012.sourceforge.net/paper.html Internet Census 2012 - Carna Botnet Paper]
	<references />		<references />

			[[Category:Basics]]

JWildauer: JWildauer moved page User:JWildauer/HajimeVSMiraiVSCarna to User:Hajime vs Mirai vs Carna

2024-12-16T13:57:58Z

JWildauer moved page User:JWildauer/HajimeVSMiraiVSCarna to User:Hajime vs Mirai vs Carna

← Older revision	Revision as of 13:57, 16 December 2024
(No difference)

JWildauer at 13:56, 16 December 2024

2024-12-16T13:56:13Z

← Older revision		Revision as of 13:56, 16 December 2024
Line 8:		Line 8:
	== Mirai ==		== Mirai ==

	Mirai<ref name="MiraiReference">https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Mirai.html</ref> is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service ([https://wiki.elvis.science/index.php?title=Denial_of_Service_Attacks DDoS]) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.		Mirai<ref name="MiraiReference">https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Mirai.html</ref> is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service ([https://wiki.elvis.science/index.php?title=Denial_of_Service_Attacks DDoS]) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.<ref name="MiraiReference2">https://ieeexplore.ieee.org/document/8170867</ref>

	== Hajime ==		== Hajime ==

	Hajime differs from Mirai because it uses a peer-to-peer architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.		Hajime differs from Mirai because it uses a peer-to-peer<ref name="PeerToPeerReference">https://www.researchgate.net/publication/345805408_Botnet_Fingerprint_Using_Bro-IDS</ref> architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.<ref name="HajimeReference">https://www.infopoint-security.de/media/Botnet_Hajime_Radware_Analyse.pdf</ref>

	== Carna ==		== Carna ==

	Carna is quite unusual. It was created as part of the Internet Census 2012 project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers<ref>https://dl.acm.org/doi/pdf/10.1145/2656877.2656893</ref>, but overall, the census was illegal, and the results need to be treated therefore with caution.		Carna is quite unusual. It was created as part of the Internet Census 2012<ref name="CarnaReference">https://census2012.sourceforge.net/paper.html</ref> project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers<ref>https://dl.acm.org/doi/pdf/10.1145/2656877.2656893</ref>, but overall, the census was illegal, and the results need to be treated therefore with caution.
	[[File:carna420.jpg\|center\|thumb\|Carna Clients in 2012<ref name="carna">https://census2012.sourceforge.net/images.html</ref>]]		[[File:carna420.jpg\|center\|thumb\|Carna Clients in 2012<ref name="carna">https://census2012.sourceforge.net/images.html</ref>]]


	== Comparison of the Botnets ==		== Comparison of the Botnets ==
			<center>
	{\| class="wikitable"		{\| class="wikitable"
	\|+ Differences between Mirai, Hajime, and Carna		\|+ Differences between Mirai, Hajime, and Carna
Line 33:		Line 33:
	\| Carna \|\| Centralized \|\| Research purposes \|\| Developed for mapping global IoT security, no destructive activities		\| Carna \|\| Centralized \|\| Research purposes \|\| Developed for mapping global IoT security, no destructive activities
	\|}		\|}
			</center>
	== Conclusion ==		== Conclusion ==

JWildauer at 17:36, 3 December 2024

2024-12-03T17:36:19Z

← Older revision		Revision as of 17:36, 3 December 2024
Line 1:		Line 1:
	~~== Table of Contents ==~~

	* [[#Introduction\|Introduction]]
	* [[#Mirai\|Mirai]]
	* [[#Hajime\|Hajime]]
	* [[#Carna\|Carna]]
	* [[#Comparison_of_the_Botnets\|Comparison of the Botnets]]
	* [[#References\|References]]

	== Introduction ==		== Introduction ==

	IoT [[Botnets\|botnet]] are networks of IoT devices that have been [[IoT_Malware\|infected by malware]] can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. IoT devices are specially in high demand for those attacks simply by the nature that so many of such devices exist.[[File:IoT_devicesNumber.png\|center\|thumb\|Estimated number of IoT Devices]]		IoT [[Botnets\|botnet]] are networks of IoT devices that have been [[IoT_Malware\|infected by malware]] and can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. IoT devices are specially in high demand for those attacks simply by the nature that so many of such devices exist.[[File:IoT_devicesNumber.png\|center\|thumb\|Estimated number of IoT Devices<ref name="IoTDevices">[https://www.researchgate.net/figure/Global-active-IoT-devices-over-the-years-1_fig1_360765945 ResearchGate - Global Active IoT Devices Over the Years]</ref>]]


Line 17:		Line 8:
	== Mirai ==		== Mirai ==

	Mirai<ref name="MiraiReference">https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Mirai.html</ref> is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service (DDoS) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.		Mirai<ref name="MiraiReference">https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Mirai.html</ref> is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service ([https://wiki.elvis.science/index.php?title=Denial_of_Service_Attacks DDoS]) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.

	== Hajime ==		== Hajime ==

	Hajime differs from Mirai because it uses a peer-to-peer architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.		Hajime differs from Mirai because it uses a peer-to-peer architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.


	== Carna ==		== Carna ==

	Carna is quite unusual. It was created as part of the Internet Census 2012 project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers, but overall, the census was illegal, and the results need to be treated therefore with caution.		Carna is quite unusual. It was created as part of the Internet Census 2012 project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers<ref>https://dl.acm.org/doi/pdf/10.1145/2656877.2656893</ref>, but overall, the census was illegal, and the results need to be treated therefore with caution.
	[[File:carna420.jpg\|center\|thumb\|Carna Clients in 2012]]		[[File:carna420.jpg\|center\|thumb\|Carna Clients in 2012<ref name="carna">https://census2012.sourceforge.net/images.html</ref>]]


Line 46:		Line 36:
	== Conclusion ==		== Conclusion ==

	Mirai, Hajime, and Carna have different goals and architectures. Mirai is used for large-scale DDoS attacks, Hajime attempts to protect the devices it infects from other threats, and Carna was primarily a research project highlighting the security issues in IoT devices. What's interesting is that despite having very different objectives, these botnets often use similar methods to spread and compromise devices.~~Which~~		Mirai, Hajime, and Carna have different goals and architectures. Mirai is used for large-scale [https://wiki.elvis.science/index.php?title=Denial_of_Service_Attacks DDoS] attacks, Hajime attempts to protect the devices it infects from other threats, and Carna was primarily a research project highlighting the security issues in IoT devices. What's interesting is that despite having very different objectives, these botnets often use similar methods to spread and compromise devices.

	== References ==		== References ==

JWildauer at 15:43, 3 December 2024

2024-12-03T15:43:01Z

← Older revision		Revision as of 15:43, 3 December 2024
Line 10:		Line 10:
	== Introduction ==		== Introduction ==

	IoT ~~botnets~~ are networks of ~~infected~~ IoT devices that can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. In this article, we will examine and compare three well-known IoT botnets: Mirai, Hajime, and Carna.		IoT [[Botnets\|botnet]] are networks of IoT devices that have been [[IoT_Malware\|infected by malware]] can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. IoT devices are specially in high demand for those attacks simply by the nature that so many of such devices exist.[[File:IoT_devicesNumber.png\|center\|thumb\|Estimated number of IoT Devices]]


			In this article, we will examine and compare three well-known IoT botnets: Mirai, Hajime, and Carna.

	== Mirai ==		== Mirai ==

	Mirai is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service (DDoS) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.		Mirai<ref name="MiraiReference">https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Mirai.html</ref> is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service (DDoS) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.

	== Hajime ==		== Hajime ==

	Hajime differs from Mirai because it uses a peer-to-peer architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.		Hajime differs from Mirai because it uses a peer-to-peer architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.


	== Carna ==		== Carna ==

	Carna is quite unusual. It was created as part of the Internet Census 2012 project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers, but overall, the census was illegal, and the results need to be treated with caution.		Carna is quite unusual. It was created as part of the Internet Census 2012 project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers, but overall, the census was illegal, and the results need to be treated therefore with caution.
			[[File:carna420.jpg\|center\|thumb\|Carna Clients in 2012]]


	== Comparison of the Botnets ==		== Comparison of the Botnets ==
Line 46:		Line 52:
	* Mirai: [https://www.cloudflare.com/de-de/learning/ddos/glossary/mirai-botnet/ Cloudflare - Mirai Botnet]		* Mirai: [https://www.cloudflare.com/de-de/learning/ddos/glossary/mirai-botnet/ Cloudflare - Mirai Botnet]
	* Hajime: [https://www.theregister.com/2017/04/27/hajime_iot_botnet/ The Register - Hajime IoT Botnet]		* Hajime: [https://www.theregister.com/2017/04/27/hajime_iot_botnet/ The Register - Hajime IoT Botnet]
	* Carna: [https://www.c0mplex1.com/blog/carna-botnet-history/ Complex1 - Carna Botnet History], [https://census2012.sourceforge.net/paper.html Internet Census 2012 - Carna Botnet Paper]		* Carna: [https://www.c0mplex1.com/blog/carna-botnet-history/ Complex1 - Carna Botnet History]
			* [https://census2012.sourceforge.net/paper.html Internet Census 2012 - Carna Botnet Paper]
			<references />

JWildauer: Created page with "== Table of Contents == * Introduction * Mirai * Hajime * Carna * Comparison of the Botnets * References == Introduction == IoT botnets are networks of infected IoT devices that can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. In this article, we will examine..."

2024-12-03T14:47:29Z

Created page with "== Table of Contents == * Introduction * Mirai * Hajime * Carna * Comparison of the Botnets * References == Introduction == IoT botnets are networks of infected IoT devices that can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. In this article, we will examine..."

New page

== Table of Contents ==

* [[#Introduction|Introduction]]
* [[#Mirai|Mirai]]
* [[#Hajime|Hajime]]
* [[#Carna|Carna]]
* [[#Comparison_of_the_Botnets|Comparison of the Botnets]]
* [[#References|References]]

== Introduction ==

IoT botnets are networks of infected IoT devices that can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. In this article, we will examine and compare three well-known IoT botnets: Mirai, Hajime, and Carna.

== Mirai ==

Mirai is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service (DDoS) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.

== Hajime ==

Hajime differs from Mirai because it uses a peer-to-peer architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.

== Carna ==

Carna is quite unusual. It was created as part of the Internet Census 2012 project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers, but overall, the census was illegal, and the results need to be treated with caution.

== Comparison of the Botnets ==

{| class="wikitable"
|+ Differences between Mirai, Hajime, and Carna
|-
! Botnet !! Architecture !! Main Objective !! Special Features
|-
| Mirai || Centralized (C&C) || DDoS attacks || Uses default logins for infiltration
|-
| Hajime || Peer-to-peer || Protection of infected devices || No centralized control, blocks ports
|-
| Carna || Centralized || Research purposes || Developed for mapping global IoT security, no destructive activities
|}

== Conclusion ==

Mirai, Hajime, and Carna have different goals and architectures. Mirai is used for large-scale DDoS attacks, Hajime attempts to protect the devices it infects from other threats, and Carna was primarily a research project highlighting the security issues in IoT devices. What's interesting is that despite having very different objectives, these botnets often use similar methods to spread and compromise devices.Which

== References ==

* Mirai: [https://www.cloudflare.com/de-de/learning/ddos/glossary/mirai-botnet/ Cloudflare - Mirai Botnet]
* Hajime: [https://www.theregister.com/2017/04/27/hajime_iot_botnet/ The Register - Hajime IoT Botnet]
* Carna: [https://www.c0mplex1.com/blog/carna-botnet-history/ Complex1 - Carna Botnet History], [https://census2012.sourceforge.net/paper.html Internet Census 2012 - Carna Botnet Paper]