NEWSWEEK.COM 21
of the first day, he had appropriated 65,000 devices;
by some estimates his zombie army reached 600,000.
The attack, nicknamed “Mirai” (“the future”) after
a Japanese television series, was so powerful that Jha
wasn’t content with taking down his small-fry Mine-
craft rivals. He also trained the new weapon on the
huge French telecom provider OVH, which hosted a
popular tool that his rivals relied on to defend them-
selves against his attacks. Eventually, the cops took
notice. Jha was fined $8.6 million and 2,500 hours
of community service working for the FBI.
Cui, now the 36-year-old founder and CEO of
Red Balloon Security, often gives talks at hacker
conferences wearing a tee-shirt, a bead necklace,
and a man bun and makes a good living advising
companies how to protect themselves in a hostile
cyber-world. He continues to marvel at how little
has been done to patch not just the vulnerabilityhijack them with malware and instruct them to
send torrents of unwanted messages and data to
the machines of their rivals, overwhelming them
and hopefully shutting them down—known as a
Distributed Denial of Service Attack (DDoS). Un-
suspecting customers, frustrated by the “unreliable”
service, were then easy targets for poaching.
In 2016, Jha and two Minecraft friends he’d met
online decided to do his rivals one better. They hacked
not only desktop computers but also the myriad se-
curity cameras, wireless routers, digital video record-
ers, household appliances and other IoT devices. Like
Cui before him, Jha and his friends wrote a program
that scanned the internet to locate vulnerable devices.
But unlike Cui, they actually planted malware on the
machine and took control of them. Leveraged by the
proliferation of smart devices, Jha’s zombie bot army
grew faster than he could have imagined--by the endZOMBIE ARMY
The Mirai attack of 2016
showed how vulnerable
the Internet of Things can
be to hacking. It started
as a Distributed Denial
of Service attack on
small-time servers used
for playing the video game
Minecraft (above), and
escalated to an attack
on OVH, a big French
internet company (left). By
some estimates, hackers
managed to build an army
of 600,000 zombie devices.“But there’s a lot of VC MONEY, and they want to very quickly roll out a
thing that has an IoT feature that they think the market might like.”
)^5
20
/
()
7
3 +
,/
,^3
3 (
+
8 *
8 (
1 ʔ
$)
3 ʔ
*(
77
<
*
(^2
5 *
:
(^1
'^7
ʔ^3
,&
78
5 (
$
//
,$
1 &
(ʔ
*(
77
<