The IoT threat landscape: Mirai, default passwords and real incidents
In short: IoT devices are attacked because they are numerous, always on and often poorly protected. Mirai showed in 2016 that default passwords alone could build a botnet big enough to disrupt major websites. Most IoT incidents still come from weak credentials, exposed services and devices that never receive updates.
Why attackers target IoT
A smart camera or home router is a small Linux computer with a permanent internet connection, decent bandwidth and, usually, nobody watching its logs. For an attacker that is an ideal resource. Compromised devices are used to:
- Launch DDoS attacks (distributed denial of service) by flooding a target from thousands of addresses at once.
- Hide other activity, by acting as residential proxies that make malicious traffic look like ordinary home users.
- Mine cryptocurrency or send spam using someone else's power and bandwidth.
- Get inside a network: a printer, badge reader or camera can be a stepping stone towards servers and data.
- Spy or cause harm: cameras and microphones leak privacy, and connected locks, vehicles or medical devices can affect physical safety.
Mirai: the botnet that changed IoT security
Mirai appeared in 2016. It scanned the internet for devices with Telnet open, then tried a short built-in list of factory usernames and passwords used by cameras and video recorders. Each success was reported to a central server, a loader installed the bot, and the new victim began scanning too. No software vulnerability was needed: the devices were simply using credentials printed in their manuals.
Within weeks Mirai was behind some of the largest DDoS attacks seen at the time, including an attack on the DNS provider Dyn in October 2016 that made many well-known websites hard to reach for parts of a day. The authors then published the source code, so dozens of variants followed. Later families added exploits for unpatched router and camera flaws, so devices with good passwords but old firmware became targets too.
Tip: Mirai is the reason laws such as the UK PSTI Act and ETSI EN 303 645 begin by banning universal default passwords. When an exam asks why that rule exists, Mirai is the example to give.
Other real incidents and patterns
| Pattern | Example | Lesson |
|---|---|---|
| Remote attack on a connected vehicle | Researchers showed in 2015 that a car's infotainment unit could be reached over the mobile network and used to affect driving functions, leading to a large recall | Separate safety systems from connected ones; plan for remote updates |
| Cloud admin access abused | In 2021 intruders used exposed administrator credentials at a cloud camera provider to view feeds from many customer sites | The cloud back end is part of the device's attack surface; protect admin accounts with MFA |
| Account takeover | Home camera accounts accessed with passwords leaked from other websites (credential stuffing) | Offer and encourage MFA; detect logins from unusual places |
| Exploiting old firmware | Botnets that exploit known router and NVR (network video recorder) flaws years after patches were released | Updates only help if they actually reach the device |
The wider attack surface
When you assess an IoT product, look at the whole ecosystem, not just the box. The mobile app may store tokens insecurely, the cloud API may let one user read another's data, and debug ports on the circuit board may give a root shell to anyone with physical access. Radio links such as Bluetooth Low Energy can leak data if pairing is weak.
Defenders can reduce most of this risk with a short list of habits: change or randomise credentials, disable Telnet and UPnP (Universal Plug and Play) where not needed, keep firmware updated, put IoT on its own network segment, and monitor for unusual outbound traffic such as a camera suddenly scanning other addresses.
Practice
What vulnerability did the original Mirai exploit?
Why is a compromised camera useful to an attacker even if it holds no valuable data?
Name two network signs that an IoT device may be part of a botnet.
Key takeaways
- IoT devices are attractive because they are numerous, always on and rarely monitored.
- Mirai built a huge botnet in 2016 using only default Telnet passwords.
- Later botnets add exploits for old firmware, so patching matters as much as passwords.
- The attack surface includes apps, cloud APIs, radio links and physical ports.
- Unique credentials, updates, segmentation and monitoring stop most attacks.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.