On the morning of 21 October 2016, large parts of the internet simply stopped answering. Twitter would not load. Netflix stalled. Reddit, Spotify, GitHub, Airbnb, PayPal — all unreachable for millions of people across the United States and Europe.
Nothing had been hacked in the way most people imagine. No database was stolen, no password cracked. Instead, roughly a hundred thousand ordinary household devices — security cameras, baby monitors, digital video recorders, cheap home routers — had been quietly recruited into an army, and that morning they were all pointed at the same target.
The malware was called Mirai. It was written by three college-age students. And the reason it worked is embarrassingly simple.
The attack that hid in plain sight
Mirai did not exploit some exotic flaw. It scanned the internet for devices with an open Telnet port and then tried to log in using a list of about sixty username and password combinations.
admin/admin. root/root. root/123456. support/support.
These were not passwords anybody had chosen. They were the factory defaults burned into the firmware of budget cameras and recorders, mostly built around components from a handful of manufacturers, shipped to millions of homes, and plugged in by people who had no idea their camera was even reachable from the public internet — let alone that it was running a login service from 1969.
Once Mirai got in, it did something clever: it killed competing malware, closed the door behind it, and went quiet. It lived only in memory, so a reboot would clean the device — but within minutes the scanner would find it again and reinfect it. The owner would never notice. The camera kept showing the driveway.
From Minecraft servers to the front page
The origin story is smaller and stranger than the damage suggests. The authors — Paras Jha, Josiah White and Dalton Norman — were not state operatives. Their initial business was Minecraft.
Popular Minecraft servers make real money, and a server that goes offline loses its players to a competitor. A protection industry grew around this: firms selling DDoS mitigation to server owners, and attackers selling the DDoS attacks that made mitigation necessary. Jha was on both sides of that trade at once.
Mirai was the tool built to win that fight. It just turned out to be far more powerful than the fight required.
In September 2016 the botnet was aimed at the security journalist Brian Krebs, burying his site under roughly 620 gigabits per second of junk traffic — at the time, one of the largest attacks ever recorded publicly. His DDoS protection provider, which had been hosting him for free, could not justify absorbing it and dropped the site.
Then the source code was published on a hacking forum under the handle Anna-senpai, a standard move to muddy attribution: once everyone has the code, nobody can prove who wrote it. It also meant that every copycat on earth now had a working internet-scale weapon.
The 21 October attack did not target Twitter or Netflix directly. It hit Dyn, a company that ran DNS — the address book that turns twitter.com into a number your device can route to. Take out the address book and the sites remain perfectly healthy while nobody can find them. One well-chosen target, hundreds of casualties.
All three men eventually pleaded guilty. None went to prison; they received probation, fines and community service, much of it spent working with the FBI on exactly the kind of botnet they had built.
What Mirai actually proved
The interesting lesson is not that IoT devices are insecure. Everyone already suspected that. It is who pays when they are.
The camera owner suffered nothing. Their footage was not stolen, their bandwidth barely dipped. The cost landed entirely on strangers — a journalist, a DNS provider, and a few hundred million people who wanted to check Twitter. The incentives are completely broken: the manufacturer saves a few cents by shipping one default password across an entire product line, and the damage is exported to people who never bought the product.
That structure has not changed. Mirai variants are still active today, nearly a decade on, because the devices that hosted them are still plugged in. Firmware does not get patched. Nobody updates a doorbell.
What this means for your own network
You are not going to fix the global IoT supply chain. You can make your own connection a much smaller target.
Change the default credentials on anything that has them. Routers, cameras, network storage, printers. This single step would have made most of Mirai impossible.
Do not expose devices directly to the internet. If you have ever enabled port forwarding or UPnP so you could check a camera from work, that device is now being scanned by automated tools, continuously, forever. Reach it through an encrypted tunnel instead.
Keep your own traffic off networks you do not control. Mirai was about devices being attacked from the internet. The mirror-image risk is your laptop or phone talking over a network someone else runs — a hotel, an airport, a café — where the operator can see which servers you connect to and, on a badly configured network, interfere with them.
Assume your ISP and every hop in between is logging metadata. Not necessarily the content of what you do, but who you talk to and when. That record is routinely retained, sold and subpoenaed.
A VPN does not patch a vulnerable camera. What it does is collapse everything your device sends into a single encrypted stream to one endpoint, so the local network, the coffee-shop router and your ISP see an opaque pipe rather than a list of destinations. Combined with basic device hygiene, that removes you from the easy-target category — and the easy targets are the only ones automated scanners like Mirai ever cared about.
The most unsettling thing about 2016 was never the sophistication. It was that a weapon capable of unplugging Twitter was assembled from things people bought to watch their front doors, protected by a password the manufacturer never expected anyone to change.