How difficult would it be to write a anti-mirai virus which disables the remote access on these IoT devices? Or at least warns the user in some way that this device is being used for DDoS.
Relatively trivial. Mirai didn't prevent future access as far as I know. But it would be illegal as well.
Warning the users would be much simpler. The hosts used to report infections are known. Destination port for the infection is known and normally not exposed.
I think that at this point ISPs should do the same thing with incoming port 23 as they did with outgoing 25. Disable by default, allow people to enable if they want to.
