The call is coming from inside the house

### The Watershed Rise of IoT Botnets At 00:00, Steinthor Bjarnason and Jason Jones of Arbor Networks open by contextualizing the massive shift in Distributed Denial-of-Service (DDoS) attacks that occurred in late 2016. The sudden emergence of IoT-based botnets—most notably Mirai, alongside precursors and variants like Hajime and Leash—shattered previous traffic volume records. Botnets consisting of hundreds of thousands of compromised embedded devices launched terabit-scale floods against KrebsOnSecurity, hosting provider OVH, and DNS backbone provider Dyn.

### Anatomy of the Mirai Scanner and Propagation Engine At 06:12 and 11:45, the speakers dissect the source code and operational architecture of Mirai. Unlike traditional PC malware that relies on complex software exploits, Mirai achieved unprecedented scale through simplicity. The malware continuously executed high-frequency SYN scanning across IPv4 address space on TCP ports 23 (Telnet) and 2323. Upon discovering an open listener, it initiated automated brute-force attacks against a hardcoded dictionary containing just 62 default username and password combinations commonly hardcoded into CCTV cameras, digital video recorders (DVRs), and residential routers.

### Command-and-Control Infrastructure and Attack Vectors At 18:16, the presentation analyzes Mirai's command-and-control (C2) protocols and traffic generation mechanisms. Once recruited, bots received encrypted binary instructions to execute synchronized volumetric reflection attacks, including DNS amplification, SYN floods, ACK floods, and specialized GRE (Generic Routing Encapsulation) floods. Because embedded Linux systems generate line-rate network traffic with zero user productivity impact, compromised devices sustained high-bandwidth packet floods indefinitely without owners noticing device degradation.

### "The Call is Coming from Inside the House" At 24:30 and 29:15, Bjarnason and Jones explore the alarming operational reality that gave the presentation its title: infected IoT devices reside within residential subscriber networks behind consumer NAT routers. Internet Service Providers (ISPs) faced massive internal outbound packet floods, causing residential DSL and fiber aggregation routers to buckle under state-table exhaustion. The authors highlight how lack of BCP 38 ingress filtering allowed bots to spoof source IP addresses, turning consumer access networks into weaponized attack launchpads.

### Mitigating IoT Botnets and Coordinated Defenses Concluding from 32:00 to 34:59, the authors outline collaborative industry defense frameworks. They advocate for automated ISP edge filtering, proactive consumer device quarantine, and the enforcement of BCP 38 source address validation across transit providers. Furthermore, they call for strict IoT manufacturing standards, including mandatory unique device passwords and automated firmware patching, to eradicate the pervasive insecure default configurations fueling global botnet proliferation.

(AI summary — Gemini 3.8 Flash)