SAsaagarjha·May 31, 2019
Presumably they were talking about this: https://github.com/jgamblin/Mirai-Source-Code/blob/master/mi...
In HiddenWasp Malware Stings Targeted Linux Systemsjgamblin
Mirai-Source-Code
C2016–2019
jgamblin / Mirai-Source-Code · Archived
Mirai-Source-Code
Leaked Mirai Source Code for Research/IoC Development Purposes
14Distinct people
14Mentions
0Explicit recommenders
9.6KGitHub stars
What to know before exploring
What it is
Leaked Mirai Source Code for Research/IoC Development Purposes
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month14 dated mentions
Observed mentions: 2016-10-03 14:34:35 UTC to 2019-05-31 08:30:30 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Oct 2016 | 2016-10-01 00:00:00 UTC | 2016-11-01 00:00:00 UTC | 8 | 2 | 6 |
| Nov 2016 | 2016-11-01 00:00:00 UTC | 2016-12-01 00:00:00 UTC | 4 | 2 | 2 |
| Dec 2016 | 2016-12-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2017 | 2017-01-01 00:00:00 UTC | 2017-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2017 | 2017-02-01 00:00:00 UTC | 2017-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2017 | 2017-03-01 00:00:00 UTC | 2017-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2017 | 2017-04-01 00:00:00 UTC | 2017-05-01 00:00:00 UTC | 1 | 0 | 1 |
| May 2017 | 2017-05-01 00:00:00 UTC | 2017-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2017 | 2017-06-01 00:00:00 UTC | 2017-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2017 | 2017-07-01 00:00:00 UTC | 2017-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2017 | 2017-08-01 00:00:00 UTC | 2017-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2017 | 2017-09-01 00:00:00 UTC | 2017-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2017 | 2017-10-01 00:00:00 UTC | 2017-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2017 | 2017-11-01 00:00:00 UTC | 2017-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2017 | 2017-12-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2018 | 2018-01-01 00:00:00 UTC | 2018-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2018 | 2018-02-01 00:00:00 UTC | 2018-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2018 | 2018-03-01 00:00:00 UTC | 2018-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2018 | 2018-04-01 00:00:00 UTC | 2018-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2018 | 2018-05-01 00:00:00 UTC | 2018-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2018 | 2018-06-01 00:00:00 UTC | 2018-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2018 | 2018-07-01 00:00:00 UTC | 2018-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2018 | 2018-08-01 00:00:00 UTC | 2018-09-01 00:00:00 UTC | 0 | 0 | 0 |
| Sep 2018 | 2018-09-01 00:00:00 UTC | 2018-10-01 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2018 | 2018-10-01 00:00:00 UTC | 2018-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2018 | 2018-11-01 00:00:00 UTC | 2018-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2018 | 2018-12-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2019 | 2019-01-01 00:00:00 UTC | 2019-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2019 | 2019-02-01 00:00:00 UTC | 2019-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2019 | 2019-03-01 00:00:00 UTC | 2019-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2019 | 2019-04-01 00:00:00 UTC | 2019-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2019 | 2019-05-01 00:00:00 UTC | 2019-06-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
14 sourcesI think it's pretty trivial to get around the edge sniffing..
You just need a bunch of pwned hops to go through first.. I mean.. Did you take a the infector code for mirai [0] when it was kicking about? It's beyond basic..
20 of those nodes (literally CCTV cameras with busybox netcat....) is enough. Want to go harder? Burner 3G sim before you even start proxying through them towards entering TOR is what, an afternoon's work?
Today the "Hajime" botnet [1] is reported at 300,000 infected internet connected nodes... Recon they're logging?
[0]: https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be6...
[1]: http://www.networkworld.com/article/3192925/security/next-ge...
In How Drugs and Paranoia Doomed Silk RoadThis is absolutely fascinating - and stunning that it only took ~90 seconds to be infected. Turns out the source code is... open source:
https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be6...
In New security camera compromised by worm within minutes of installationMirai BotNet source code released
1 points · Open discussionApparently the author of Mirai leaked the source code and even provided comments and build instructions. I found this a bit baffling.
He seems immature and vain, because his motive is apparently to taunt someone with how smart he is, but the code is indeed pretty awesome and educational. It's a little sad that commercial software is so ugly and that black hat software is elegant (though I guess it has to be, because it's under rather severe "environmental pressures").
https://github.com/jgamblin/Mirai-Source-Code/blob/master/Fo...
At first, I was also kinda shocked that it had this simplistic list of hard-coded user names and passwords (mentioned in the article). But I guess I've worked in the software industry long enough that it makes sense. Computers are so ubiquitous and on reflection it's not a surprise that you can pull down hun
Read the rest
dreds of thousands of machines with this technique!!!
Can anyone shed light on the economics of releasing source code? I would think this would make your botnet much less valuable. Apparently someone found a vulnerability in his HTTP parser, which I don't think would have happened without the source code.
So did the author shoot himself in the foot for reasons of pride, or is there something else going on?
https://github.com/jgamblin/Mirai-Source-Code/blob/master/mi...
// Set up passwords
add_auth_entry("\x50\x4D\x4D\x56", "\x5A\x41\x11\x17\x13\x13", 10); // root xc3511
add_auth_entry("\x50\x4D\x4D\x56", "\x54\x4B\x58\x5A\x54", 9); // root vizxv
...
>Part of me wonders if Mirai was meant as a grey hat warning since it's just showing what's possible only picking on low hanging fruit.
I would wager that is correct. I certainly took it that way, especially after the source code dump. [0] That seemed to be almost out of frustration.
[0] https://github.com/jgamblin/Mirai-Source-Code
In Of course smart homes are targets for hackersIt's UPnP [0]. It was always going to be UPnP. UPnP is the wrong set of trade offs and always was. And even making it 'off by default' won't solve the problem because the standard instructions for getting any multiplayer game or IoT gizmo to work are 'turn on UPnP'.
Not that this in any way absolves the OEM for the utter idiocy of including the telnet port in their forwards at all and the absolute negligence of having it active by default and 'secured' by a single or small combination of well known auth tuples.
But yeah, that's really what they did. Here's the section of Mirai's scanner.c that sets up the destination port. [1]
// Set up TCP header
tcph->dest = htons(23);
tcph->source = source_port;
tcph->doff = 5;
tcph->window = rand_next() & 0xffff;
tcph->syn = TRUE;
They really did just forward port 23. Temptin
Read the rest
g to call malfeasance but at best massive incompetence.
[0] https://www.us-cert.gov/ncas/alerts/TA16-288A
[1] https://github.com/jgamblin/Mirai-Source-Code/blob/master/mi...
The same backdoors that owned the devices as a botnet, should be used to brick the devices. And the courts should support that purchasers are entitled to refunds and damages. Your IoT refrigerator got bricked? You can sue for $500 worth of spoiled food. Encourage class action lawsuits and watch how fast this is fixed.
https://github.com/jgamblin/Mirai-Source-Code
In Why Friday's Massive DDoS Attack Should Be TerrifyingChange the default admin password.
The original Mirai program tried a little over 60 passwords and it would just brute force into an IoT device.[1]
From what I read, it seems that one specific manufacturer in China is the owner of a lot of devices used in the Mirai botnet attacks.[2]
1: https://github.com/jgamblin/Mirai-Source-Code/blob/master/mi...
2: (I cannot find the link, but it was an article from yesterday)
EDIT:
Found this when googling the strange '7ujMko0admin' password in Mirai: http://www.cam-it.org/index.php?topic=9396.0 So it looks like the Chinese manufacturer that they target is Dahua.
In Ask HN: How did Dyn fail to fend off DDOS?Mirai Botnet Client, Echo Loader and CNC source code
86 points · Open discussionHere the GitHub Link because it is hard to find:
https://github.com/jgamblin/Mirai-Source-Code
In Source Code for IoT Botnet ‘Mirai’ ReleasedLeaked Mirai Source Code for Research/IoC Development Purposes
1 points · Open discussionFor anyone wondering, the code is here:
https://github.com/jgamblin/Mirai-Source-Code
In Fears of massive net attacks as code shared online