Mirai and Network Attack
We have had 2 emails. The first saying we had something attached to our network infected with Mirai. I called in to VM and they couldn't tell me what time the attack was logged. It may have been my D...
Forum Discussion
I have also had this email and the advice given did not highlight any issues.
I have, however, managed to identify and rectify what I think was the problem using the following steps:
- Run Sniffnet sniffnet(dot)net: This identified a lot of Telnet traffic from an address on my network to random IP adresses. The IP address listed was not on my list of connected devices but by interrogating the traffic on SniffNet I was able to get the MAC address of the offending device which actually referred to a completely different IP address
- The offending device was my DLink ShareCentre which, if you Google DLink and Mirai will give lots of results stating that hackers are now using a backdoor into old DLink devices to run DDoS botnets. The only advice given was to remove any old DLink devices from the network with no workaround to remedy the problem so it looks like I'll be forking out for a new NFS
Hopefully this may help a few people as the advice given by Virgin does not identify or resolve the issue and merely states that they may terminate your service if you don't get it sorted.