On Wednesday, December 11, 2024, several customers reported suspicious behavior on their Session Smart Network (SSN) platforms. These systems have been infected with the Mirai malware and were subsequently used as a DDOS attack source to other devices accessible by their network. The impacted systems were all using default passwords. Any customer not following recommended best practices and still using default passwords can be considered compromised as the default SSR passwords have been added to the virus database. 

Key Features of Mirai Malware

1. Device Exploitation: Mirai scans for devices that use default login credentials.
2. SSH Attacks: Once access is gained, it can execute commands remotely, enabling a wide range of malicious activities, including DDoS attacks.

Suspicious Network/TCP Activity Indicators

When monitoring for potential Mirai activity, here are some suspicious signs to look for:

1. Unusual Port Scanning: Mirai often scans for devices on common Layer 4 ports (e.g., 23, 2323, 80, 8080).
   • Example: A large number of connection attempts to TCP port 23 (Telnet) from a single source IP address.
2. Frequent SSH Login Attempts: Multiple failed login attempts on SSH services (default port 22) can indicate brute-force attacks.
   • Example: Logs displaying numerous "Failed password" entries within a short timeframe.
3. Increased Outbound Traffic: A sudden spike in outbound traffic volume, especially to unknown or unexpected external IP addresses.
   • Example: Network traffic monitoring shows data leaving the network, peaking at several Mbps towards a suspicious IP.
4. Unusual Device Behavior: Devices rebooting or behaving erratically might indicate they have been compromised.
   • Example: Router behaving differently than usual dropping off the network frequently.
5. Source IP Reputation: Connections from known malicious IP addresses can be a strong indicator of compromise.
   • Example: Checking against threat intelligence sources reveals an IP making multiple SSH attempts belongs to a known botnet.

Next Steps for Prevention

1. Strengthen Security Practices:
   • Change default credentials on all SSRs.
   • Implement strong, unique passwords across devices.
2. Monitor Logs:
   • Regularly review access logs for anomalies and set alerts for suspicious activity.
3. Keep Software Updated:
   • Apply the latest firmware updates to patch vulnerabilities.

By staying vigilant and implementing these best practices, organizations can reduce their risk of falling victim to Mirai and similar malware.

Resources:

Password help and best practices:

https://www.juniper.net/documentation/us/en/software/session-smart-router/docs/cc_fips_config_password_policies/#password-requirements

Please see above.

What to do if a system is infected:

If a system is found to be infected, the only certain way of stopping the threat is by reimaging the system as it cannot be determined exactly what might have been changed or obtained from the device.

• 2024-12-17: Initial Publication