Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai

Orcun Cetin, Carlos Hernandez Ganan, Lisette Altena, Takahiro Kasama, Daisuke Inoue, Kazuki Tamiya, Ying Tie, Katsunari Yoshioka, Michel van Eeten

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

33 Citations (Scopus)
1318 Downloads (Pure)


With the rise of IoT botnets, the remediation of infected devices has become a critical task. As over 87% of these devices reside in broadband networks, this task will fall primarily to consumers and the Internet Service Providers. We present the first empirical study of IoT malware cleanup in the wild -- more specifically, of removing Mirai infections in the network of a medium-sized ISP. To measure remediation rates, we combine data from an observational study and a randomized controlled trial involving 220 consumers who suffered a Mirai infection together with data from honeypots and darknets. We find that quarantining and notifying infected customers via a walled garden, a best practice from ISP botnet mitigation for conventional malware, remediates 92% of the infections within 14 days. Email-only notifications have no observable impact compared to a control group where no notifications were sent. We also measure surprisingly high natural remediation rates of 58-74% for this control group and for two reference networks where users were also not notified. Even more surprising, reinfection rates are low. Only 5% of the customers who remediated suffered another infection in the five months after our first study. This stands in contrast to our lab tests, which observed reinfection of real IoT devices within minutes -- a discrepancy for which we explore various different possible explanations, but find no satisfactory answer. We gather data on customer experiences and actions via 76 phone interviews and the communications logs of the ISP. Remediation succeeds even though many users are operating from the wrong mental model -- e.g., they run anti-virus software on their PC to solve the infection of an IoT device. While quarantining infected devices is clearly highly effective, future work will have to resolve several remaining mysteries. Furthermore, it will be hard to scale up the walled garden solution because of the weak incentives of the ISPs.
Original languageEnglish
Title of host publication Network and Distributed System Security Symposium (NDSS) 2019
Number of pages15
ISBN (Electronic)189156255X, 9781891562556
Publication statusPublished - 2019
EventNetwork and Distributed Systems Security Symposium 2019 - San Diego, United States
Duration: 24 Feb 201927 Feb 2019

Publication series

Name26th Annual Network and Distributed System Security Symposium, NDSS 2019


ConferenceNetwork and Distributed Systems Security Symposium 2019
Abbreviated titleNDSS 2019
Country/TerritoryUnited States
CitySan Diego


  • IoT
  • cybersecurity
  • Governance


Dive into the research topics of 'Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai'. Together they form a unique fingerprint.

Cite this