The College Students Who Set Out to Hit One Minecraft Server and Stopped the Internet

In the summer of 2016, a college student in the United States sat down at his computer. The goal was modest. He wanted to take one Minecraft server offline.

Minecraft servers make money. A server where lots of people gather earns revenue from ads and sponsorships. So if a competing server goes down for a while, those people come to your server instead. That was the play.

The problem was that taking down a single server requires an enormous number of computers flooding it with connections all at once. No student has that many computers.

So he decided to borrow other people’s. More precisely, to borrow them without the owners knowing.

The Flimsiest Lock in the World

What he set his sights on wasn’t other people’s laptops. It was things like routers, CCTV cameras, and video recorders.

These machines have one thing in common. They all ship from the factory with the same password. The username is admin, and the password is admin too. It’s written somewhere in the manual, and most people never change it once.

It’s not that they decline to change it. They don’t know they can. Some products don’t even have a function to change it at all.

FACT So what this program did was simple. It picked internet addresses at random, and when it found a door open, it tried a pre-written list of usernames and passwords one by one. root/root, admin/admin, root/123456, admin/password… things like that.

There is nothing technically impressive about it. Knocking on the door and asking “excuse me, is your password admin?” is the whole of it. And it worked. Hundreds of thousands of machines opened up.

The program’s name was Mirai. It means future in Japanese.

The Irony

Here the story gets a little strange.

FACT The three people who built Mirai were running a DDoS protection business at the time. They were selling a service that blocks attacks while simultaneously building an attack tool.

It’s like driving the fire truck and setting the fires.

And Then They Released the Source Code

In the fall of 2016, one of the creators posted Mirai’s entire source code to an internet forum.

It’s understood to have been a calculation to evade investigation. If hundreds of identical programs are circulating in the world, it becomes hard to work out whose the original was.

The calculation was about half right. He was caught in the end. All three pleaded guilty in December 2017.

The other half missed completely.

FACT About three weeks after the source went public, on October 21, 2016, a company called Dyn was attacked and went down. This company served as the information desk that looks up internet addresses. When the information desk stopped, people could not reach sites like Twitter, Netflix, and Spotify.

The attack was estimated at 1.2 terabits per second. It was among the largest recorded at the time.

This attack was not carried out by those three. Somebody who had taken the published source code did it. That is the point. Once code is released, it cannot be recalled.

We made this story into a video as well. From the 1988 Morris worm to our own server this morning, it follows the whole thread from start to finish over 23 minutes.

Ten Years Have Passed

So is this a finished story now?

FACT We deliberately leave a poorly secured server open on the internet and record who comes in. Over the last 8 days, the most-used username and password in the login attempts against that server was admin / admin. It was number one all 8 days, and on many days 29 different sources simultaneously tried the same combination.

FACT Second and third place look familiar too. root/12345, root/1234, root/root, root/password, root/123456. Exactly the list Mirai was carrying around ten years ago.

FACT And for all 8 days without exception, the programs that came into our server were classified as the Mirai family.

INFERRED From the attacker’s side, it’s a rational choice. If a ten-year-old list still works, there’s no reason to build a new one. What hasn’t changed isn’t the attack — it’s our side.

So What Should You Do

The conclusion of this story is almost anticlimactically simple.

Change the passwords on the machines in your home. Routers, CCTV cameras, network storage (NAS), everything that connects to the internet. That password written in the manual is precisely the one on Mirai’s list.

And one more thing while you’re at it. Check whether your admin page is visible from outside. In your router settings, turn off items like “remote management” or “external access.” Most households don’t need this feature.

A program three college students built to hit one game server is still out there. If you don’t want your router to be its next recruit, start by deleting admin.