Mirai (IoT botnet, 2016)
Malware that in 2016 enlisted hundreds of thousands of poorly secured cameras and routers into an attack network, and cut part of the internet off from major services by hitting a domain name provider.
Mirai appeared in the summer of 2016. It scanned the internet for connected devices, surveillance cameras, video recorders, home routers, and logged into them by trying a short list of default passwords their owners had never changed. Infected devices joined a remotely controlled network. In September 2016, it hit a large European hosting company and a specialist journalism site with denial-of-service attacks of then unprecedented power. On 21 October 2016, it targeted a US domain name resolution provider: for several hours, major services, social networks, video platforms, news sites, became unreachable for a large share of US and European users, without themselves being attacked. The authors, young Americans initially seeking to harm competitors in game server hosting, pleaded guilty in 2017; the code, published in the meantime, inspired many variants. For insurance, Mirai showed three things: an accumulation risk through millions of cheap devices no one updates, contingent business interruption among the customers of a single technical provider, and potential liability for manufacturers shipping products without minimum security, which recent connected-device laws have finally regulated.
Textbook case: an e-commerce platform loses six hours of sales during an attack on its domain name provider, as in the attack on Dyn of 21 October 2016, while its own servers are working. Its cyber policy covers the loss only if it includes dependent provider failure, which the Mirai episode led many companies to check.
Mirai, Mirai botnet, Dyn DDoS, Dyn attack
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.