Hajime vs Mirai vs Carna

Introduction

IoT botnet are networks of IoT devices that have been infected by malware and can be controlled either through a centralized or decentralized approach. These devices are often highly vulnerable because they have weak or default credentials. IoT devices are specially in high demand for those attacks simply by the nature that so many of such devices exist.

Estimated number of IoT Devices

In this article, we will examine and compare three well-known IoT botnets: Mirai, Hajime, and Carna.

Mirai

Mirai is a botnet that specifically targets IoT devices and uses them for large-scale Distributed Denial of Service (DDoS) attacks. Mirai spreads by scanning the internet for devices that are easy to compromise — typically those that still use default usernames and passwords like "admin:admin" or "root:root". There are large databases available that contain millions of such credentials, making it easy for attackers to gain access. Mirai consists of three main components: a C&C server, a scanner, and a loader that installs the malware onto vulnerable devices.

Hajime

Hajime differs from Mirai because it uses a peer-to-peer architecture, which means there is no central server in control. This makes it much harder for authorities to take down the whole botnet since there isn’t a single point of failure. This architecture is more advanced compared to using a C&C server. Interestingly, Hajime does not conduct DDoS attacks like Mirai. Instead, it appears to protect the compromised devices by blocking certain ports. Despite this, it remains a potential threat because it still maintains unauthorized control over IoT devices.

Carna

Carna is quite unusual. It was created as part of the Internet Census 2012 project to find unsecured IoT devices and map the global IoT landscape. Unlike Mirai and Hajime, Carna wasn’t designed for malicious purposes. Instead, it used infected devices to collect data about the internet — without conducting any known attacks like DDoS. Carna was a research initiative to demonstrate how many IoT devices were exposed and lacked proper security. It was designed to perform multiple censuses and then delete itself from the devices. Its data was used in many research papers, but overall, the census was illegal, and the results need to be treated therefore with caution.

Carna Clients in 2012

Comparison of the Botnets

Differences between Mirai, Hajime, and Carna

Botnet	Architecture	Main Objective	Special Features
Mirai	Centralized (C&C)	DDoS attacks	Uses default logins for infiltration
Hajime	Peer-to-peer	Protection of infected devices	No centralized control, blocks ports
Carna	Centralized	Research purposes	Developed for mapping global IoT security, no destructive activities

Conclusion

Mirai, Hajime, and Carna have different goals and architectures. Mirai is used for large-scale DDoS attacks, Hajime attempts to protect the devices it infects from other threats, and Carna was primarily a research project highlighting the security issues in IoT devices. What's interesting is that despite having very different objectives, these botnets often use similar methods to spread and compromise devices.

References

• Mirai: Cloudflare - Mirai Botnet
• Hajime: The Register - Hajime IoT Botnet
• Carna: Complex1 - Carna Botnet History
• Internet Census 2012 - Carna Botnet Paper