Mirai Malware Vaccine AntbIoTic Is A White Worm to Protect IoT Devices

The Internet of Things (IoT) sounded like a great idea at first glance when it first began picking up steam. However, the problem with giving every single gadget that we come in contact with access to the internet is that no one really thought much about security, leaving many these things vulnerable to viruses and malware. The Mirai DDoS attack taught us a valuable lesson about IoT devices with poor security practices: they can be a huge threat to networks, with attacks involving nearly a million bots.

The big rub here is that many of those devices are still a threat, leaving security researchers looking for a way to prevent a Mirai-like attack from happening again. Some researchers have posed what they think might be a solution; they want to use the insecure nature of IoT devices to inject what they are calling a white worm with the ability to enhance its defenses. The idea is the same as a vaccine used on humans whereby exposing the system to a small amount of a virus you can develop an immunity.

This would allow for securing of IoT devices that are hard-coded with a backdoor and lack the ability to receive software updates. The team of researchers looking into this approach is comprised of researchers from Technical University of Denmark, Denmark; Orebro University, Sweden; and Innopolis University, Russian Federation. The idea for the white worm was outlined in a paper the team published called "AntibIoTic: Protecting IoT Devices Against DDoS Attacks."

Part of what scared researchers about Mirai was that the source code had been released into the wild allowing others to come up with nefarious software based on it, but that release also allowed the researchers to create their white worm. The white worm accesses these IoT devices and then injects them with code that acts like an antibiotic and then exploits the spreading efficiency of Mirai to spread itself around the world to different devices.

AntbIoTic would be able to take control of the IoT devices and once in control would notify the owner or even fix the device if a software or firmware update is available. AntbIoTic wouldn't be malicious so it would not be detected by ISPs and other carriers that have taken measures to stop Mirai. The white worm would also be able to sanitize devices of malicious code installed by other nefarious attackers. Interestingly, while AntbIoTic aims to do good, it would be seen as illegal and spreading it would be a prosecutable act in some countries.