Voltar 
Overview
Mirai botnet has been used to infect IoT devices at large scale to perform unauthorized operations. Mirai botnet is formed by exploiting vulnerabilities, weak configurations, insecure authentication, etc. in the IoT devices. The compromised IoT devices are then used to nefarious operations such as launch Brute-force attacks, Distributed Denial of Service (DDoS) attacks, turning IoT device into a proxy server and others. Mirai botnet was the major source of launching DDoS against Dyn DNS solution provider. In this research note, WITL detected OMNI (Mirai variant) infected PolyCom video conferencing devices during in-house research and the devices are still infected with this botnet on the Internet.
The research was targeted against PolyCom HDX devices.
Analysis
It has been found that the PolyCom devices are shipped with BusyBox, Wget, and other binaries. Mirai (and variants) extensively use the binaries such as BusyBox, Wget, and other for performing different set of operations. OMNI (Mirai Botnet) has been used to infect