IoT Botnet Propagation Simulator

Attack Parameters

Scan rate (attempts/s) 6

Weak-credential ratio 45%

Patch/reboot rate (devices/s) 2

Defenses

Network segmentation (VLANs) Auto firmware / credential updates

Live Readout

Compromised

1 / 64

Vulnerable left

—

Infections / s

0.0

Elapsed

0.0s

Legend

Secure — patched, unique credentials Vulnerable — default password, unpatched Compromised — recruited into botnet

How it works

This is a susceptible–infected (SI) epidemic model on a graph, tuned to reproduce how the 2016 Mirai botnet actually spread: it never exploited a software bug, it simply telnet/SSH'd into cameras and routers using ~60 hard-coded factory username/password pairs.

Device state ∈ {Secure, Vulnerable, Compromised}
Per scan attempt:
  source ← random Compromised device
  target ← random device reachable from source
  if target.state == Vulnerable → target.state = Compromised

Reachability:
  segmentation OFF → target drawn from all N devices (flat network)
  segmentation ON  → target drawn from source's VLAN with prob. 0.95,
                      from any VLAN with prob. 0.05 (a cross-segment
                      "leaky" service, e.g. a shared cloud API)

64 devices sit in 4 VLAN clusters. The weak-credential ratio sets how many start with factory-default logins (Vulnerable) versus already-hardened (Secure) — this is the "minimal privileges / unique credentials" principle from the article. Segmentation throttles the effective contact rate between clusters, the same way a real VLAN or firewall ACL blocks lateral movement. Patch/reboot represents both firmware updates (fixes the credential hole, Vulnerable → Secure) and the fact that Mirai's payload lives only in RAM — a reboot alone clears an infection (Compromised → Secure), though the device stays reinfectable unless its credentials were also changed.

Together the four controls trace the same defense-in-depth the article names: unique credentials shrink the Vulnerable pool, timely updates shrink it further and clear existing infections, and segmentation caps how far any single compromised device can reach.

Segmentation: on Auto-update: off

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.