On the evening of September 20, 2016, somebody tried to delete a blog from the internet, and very nearly had the firepower to do it. The blog belonged to Brian Krebs, an investigative reporter who writes about cybercrime the way a crime beat reporter writes about a mob family: by name, with documents, and without much concern for whether the subjects enjoy the coverage. Days earlier he had published a long investigation into a pair of teenagers running a denial of service for hire business. The response arrived as traffic. Not angry email traffic. Six hundred and twenty three gigabits per second of it, according to Akamai, the company standing between KrebsOnSecurity and the flood.
To picture 623 Gbps in 2016 terms: the entire attack, sustained, was larger than the total internet capacity of many small countries at the time, and it was aimed at one man's WordPress site. Akamai had been defending Krebs for free, as a pro bono client on its Prolexic network, and it absorbed the first day of the assault. Then Akamai made the decision that turned a big attack into a landmark one. It let him go. The company concluded, reasonably and a little sadly, that defending one journalist at that scale would cost millions of dollars, and that it could not set the precedent of spending that kind of money on a free account. KrebsOnSecurity went dark.
That is the defense side of this story, and it is the side that matters. The attack on Krebs is usually filed next to its sibling, the Mirai attack on the DNS provider Dyn a month later, which is covered elsewhere in this pack as the offense: how the botnet was built, how the cameras and DVRs were conscripted, how a chunk of the internet fell over. This essay is about the other chair at the table. What does the defense actually look like when the incoming fire is made of thermostats? What did the defenders learn, what did they build, and why did the most durable counterweapon turn out to be, of all things, a California consumer protection statute about passwords?
The economics of standing in front of a flood
A denial of service defense is, at bottom, a capacity contest. The attacker needs enough aggregate bandwidth to drown the target's connection. The defender needs enough aggregate bandwidth, plus enough filtering intelligence, to separate the flood from the visitors and throw the flood away. For most of the internet's history, the defender won this contest by default, because generating huge traffic required owning or renting huge infrastructure, and huge infrastructure leaves paper trails and sends invoices.
Mirai broke the economics by stealing the infrastructure instead. The marginal cost of adding one more camera to the botnet was zero to the operator: the camera's owner paid for the electricity, the bandwidth, and the hardware, and did not even get a vote. Akamai's engineers noted something else unsettling in their postmortem. The Krebs attack barely used the classic tricks of amplification and reflection, where attackers bounce traffic off misconfigured servers to multiply it. The bots mostly sent traffic directly, including GRE floods, a protocol flavor that cannot be spoofed and is awkward to filter. This was honest traffic, in the narrow technical sense: real devices, real addresses, real requests, all of them hostile. The flood was not a forgery. It was a census.
And so the defense problem inverted. When Akamai walked away, it was not confessing technical defeat. Its network had held. It was making a business decision about an externality: the cost of defending a free customer against the entire planet's neglected webcams had exceeded any sane budget. Krebs himself understood, and said so at the time. He eventually got back online under Project Shield, a free service run by Jigsaw, a unit of Alphabet, built specifically to protect journalists and human rights organizations from exactly this kind of silencing. That detail deserves underlining. The durable defense for the most attacked journalist on the internet turned out to be a charity tier of a giant platform. The market did not produce a product a reporter could buy that would survive 623 Gbps. A patron absorbed it.
Every part of the modern defense industry since then can be read as an attempt to fix that economics problem. Anycast networks spread a target's presence across dozens of locations so no single pipe can be drowned by traffic aimed at one address. Rate limiting and filtering got smarter about distinguishing a camera that has never once asked for a web page from a browser that has. Cloud providers folded DDoS absorption into the rent, because they were the only ones with pipes fat enough to make the contest boring. Boring is the goal. The best outcome in defense is an attack that reads like a rounding error on a capacity graph.
But all of that is defense at the target, and defense at the target has a ceiling: the flood still exists, and it still costs somebody money to throw away. The Krebs attack raised the question nobody in the mitigation business could answer with a bigger pipe. Why were there 145,000 cameras available to be aimed in the first place?
An army that never reported for duty
The recruitment pitch for the Mirai botnet was a list. The malware scanned random internet addresses looking for an open Telnet port, the old remote login service that cameras, DVRs, routers, and a long tail of forgotten gadgets shipped with switched on. When something answered, Mirai tried logging in with its list of factory default username and password combinations, a little over sixty of them. admin/admin. root/12345. The password printed in the manual, identical for every unit that ever rolled off the line. If one pair worked, the device was conscripted. It kept recording video or routing packets exactly as before. Its owner noticed nothing, because there was nothing to notice. The camera was a soldier now, in its spare cycles.
Sit with the security model that makes this possible. A manufacturer ships a hundred thousand devices, every one of them answering to the same password, a password published in documentation anyone can download. The device is installed by a person who bought it to watch the driveway, not to administer a Linux system. There is no prompt demanding a new password at setup, no unique credential printed on a label, no update mechanism with any real reach. The device's security posture, forever, is whatever it was in the thirty seconds after it was plugged in. Mirai did not hack these devices in any cinematic sense. It knocked on doors with a ring of skeleton keys that the manufacturers themselves had cut, numbered, and helpfully listed in the manual.
The defenders who picked through the wreckage understood that this was not a user education problem. Telling a hundred million people to change the default password on their baby monitor had been the industry's strategy for years, and the Krebs attack was the strategy's final grade. The failure was upstream, at the loading dock. The only fix with any leverage was to change what ships.
The statute as a security control
On September 28, 2018, California's governor signed SB-327, and on January 1, 2020 it became the first law in the United States to regulate the security of connected devices directly. The operative idea fits on an index card. If a device can be logged into from outside the local network, then either its preprogrammed password must be unique to that individual device, or the device must force the user to create a new means of authentication the first time it is used. That is the whole trick. A skeleton key ring stops working when every door has a different lock. Mirai's recruitment list, applied to a world of unique passwords, gets nothing.
The law had real limits, and the defense side is more honest if it admits them. SB-327's broader requirement, that devices carry "reasonable security features," never defines reasonable beyond the password provision, and it gives enforcement only to government attorneys, with no right for harmed consumers to sue. Security writers at the time called parts of it vague to the point of vibes. All true. And yet the specific, checkable, unglamorous clause, unique password or forced setup, aimed precisely at the mechanism that built the biggest botnet then known. It was possibly the first cybersecurity statute written as an engineering specification, and it was aimed at a factory, not at users and not at hackers.
Other jurisdictions picked up the same tool. Oregon passed a similar connected device law. In December 2020, the federal IoT Cybersecurity Improvement Act made baseline security, including no hardcoded unchangeable passwords, a condition of selling devices to the US government, with NIST writing the standards. Britain went furthest: its Product Security and Telecommunications Infrastructure regime, enforced from April 29, 2024, bans universal default passwords on consumer connected products outright, adds duties to publish a vulnerability reporting route and a minimum security update period, and backs the rules with fines of up to 10 million pounds or 4 percent of a company's worldwide revenue, whichever is higher. A decade after Mirai, the humble password clause had become, in several major markets, simply the cost of selling a camera.
Meanwhile the botnet itself refused to die on schedule. Mirai's source code was posted publicly on September 30, 2016, ten days after the Krebs attack, an act of arson as community service, and variants have been forking it ever since. A decade on, security researchers are still cataloguing descendants of Mirai recruiting the same device categories with the same basic method, because the installed base of old, unchangeable, default password hardware is measured in the hundreds of millions and retires slowly. The laws govern what ships now. The cameras of 2016 will be knocking around closets and ceilings for years, still answering to admin.
What the defense actually learned
The Krebs attack is the best case study the defense side owns, because every layer of the answer is visible in it. At the target, absorb and filter, and make the capacity so large and so spread out that a flood becomes weather. In the middle, share the load among patrons and platforms, because no individual publisher can rent a fair fight against a stolen army. And at the source, upstream where the army is recruited, remove the condition that makes recruitment free. Two of those three layers are about money. The third is about a password printed on a label.
There is a lesson in that ordering for anyone who builds things that connect to networks, which now means everyone who builds things. The cheapest security control in this entire story was not a firewall, a scrubbing center, or an anycast empire. It was a manufacturer deciding, at production time, that unit number 40,001 would not share a password with unit number 40,002, and that the first boot would make the owner choose a secret of their own. That decision costs pennies per device and it cannot be retrofitted by prayer onto a hundred million installed gadgets. Security, like quality, is mostly decided before the box is sealed.
Defense is usually described as a wall. Mirai taught the industry it is closer to sanitation. You do not defeat a botnet the way you defeat an army, in a battle, on a day. You defeat it the way a city defeats a plague: clean water, closed sewers, boring standards enforced at scale, until the conditions that fed it are gone. Krebs got his site back within days, behind a patron's shield. The species of attack that hit him took a decade of statutes to even begin starving. Both facts are the defense story. The shield matters. But the sewer is what ends it.
Somewhere in a warehouse or a ceiling corner there is still a camera from 2016, patiently answering to the password in its manual, waiting for the next list to knock. The defense against it was never going to be a bigger wall around one blog. It was the slow, unglamorous work of making sure its grandchildren ship with a different password than their siblings, and that is exactly the work the defenders did.
Sources, for the record: Akamai's third quarter 2016 State of the Internet / Security report measured the September 20, 2016 attack on KrebsOnSecurity at 623 Gbps, against a previous record of 363 Gbps in June 2016, and Akamai's postmortem (covered by Engadget) estimated about 145,000 devices, mostly cameras and DVRs, behind the traffic. Brian Krebs reported the attack at 620 Gbps on KrebsOnSecurity, along with Akamai's withdrawal of its pro bono protection and his return under Project Shield. The Mirai source code was posted publicly on September 30, 2016. The text of California SB-327 (Civil Code section 1798.91.04), signed September 28, 2018 and effective January 1, 2020, is summarized by Jones Day and Threatpost. The federal IoT Cybersecurity Improvement Act of 2020 was signed December 4, 2020. The UK Product Security and Telecommunications Infrastructure regime has been enforced since April 29, 2024, with penalties up to 10 million pounds or 4 percent of worldwide revenue, per the UK government and Infosecurity Magazine. The persistence of Mirai variants a decade later is documented by Censys's 2026 retrospective on Mirai and its heirs.