|Router Security||Routers in the news||
Website by |
Routers in the news, pretty much means routers getting exploited by bad guys to do bad things. I am still waiting for a good news story about routers. The flaws that are exploited are documented on the Bugs page. Articles that offer security advice are listed on the Other router security advice page.
Hacker takes pity on MikroTik routers
A mysterious grey-hat is patching people's outdated MikroTik routers
by Catalin Cimpanu of ZDNet October 12, 2018
In fairness to MikroTik they have been patching reported bugs quickly. However, its no surprise, that their customers do not install the patches. A lone person has taken pity on unpatched MikroTik routers and is patching them so they can not be abused by bad guys. Using the name Alexey, this person has bragged about this on a Russian blogging platform. He adds firewall rules that block access to the router. On this site, the Test Your Router page links to many online services that test your router for open TCP/IP ports. The same for the Shodan page. The worst bug (CVE-2018-14847) was patched in April 2018. It lets a bad guy download the user database file. Once decrypted, this gives bad guys access to the username/password to log in remotely. Alexey claims to have patched over 100,000 MikroTik routers. To put this in perspective, there are over two million MikroTik routers in use and over 420,000 show signs of infection. Bad guys who are installing malware on these routers are not closing WAN side ports, so they can still be modfiied.
Xiongmai video surveillance devices are extremely insecure
Using a router to defend against Xiongmai video devices
by Michael Horowitz (me) October 10, 2018
OK, the Xiongmai devices in question are not routers. But, they are so terribly insecure that security firm SEC Consult recommends throwing them in the trash. In contrast, I suggest a number of ways to isolate them while continuing to use them despite their many security issues. My suggestions can apply not just to Xiongmai devices but to all insecure IoT devices.
MikroTik devices must be patched
October 7, 2018: RouterOS from MikroTik was patched with the latest bug fixes at the end of August and in September (they maintain different branches of their firmware). Four bugs that were just patched were found by Jacob Baines of Tenable Research. And, a bug that was patched back in April 2018 was much more serious than previously believed. Only 30% of MikroTik devices have been patched. Details are on the Bugs page. New attacks will surely follow.
Netgear sent me an email message, informing me of the availability of new firmware for the EX3800 range extender. The email included a link to How do I upgrade firmware on my NETGEAR WiFi Range Extender? Well done.
GhostDNS, yet another DNS changing router attack
70+ different types of home routers(all together 100,000+) are being hijacked by GhostDNS
by Netlab 360 September 29, 2018
Starting September 20, 2018, Netlab noticed an existing malware campaign ramp up its attacks with new scanners. Radware blogged about this campaign back in August (2018), but Netlab says it goes back even further. They call it GhostDNS and it now attacks more than 70 different routers. They have seen it infect over 100,000 routers, so far. Malicious DNS servers are used to send victims to fake/scam versions of websites. Rather than using a similar domain name (citibank.edu instead of citibank.com) users deal with the real domain name but are directed to a scam site nonetheless. They have observed GhostDNS targeting at least 52 domains so far, including major banks, telcos, ISPs, media outlets, Avira and Netflix. The GhostDNS malware campaign consists of: Shell DNSChanger, Js DNSChanger, PyPhp DNSChanger, a Phishing Web System, a Web Admin System and a Rogue DNS System. There are over 100 attack scripts. Routers are attacked from both sides, from the WAN and from the LAN. 88% of infected routers are in Brazil. Some companies making vulnerable routers are D-Link, Tenda, TP-Link, Roteador and (of course) MikroTik. The full list of known vulnerable routers is in the blog posting. Netlab 360 has been working to take components of GhostDNS off-line. The best defense against all types of DNS attacks is to be familiar with and look for indications that a website uses Extended Validation.
A sophisticated botnet with no obvious purpose
Torii botnet - Not another Mirai variant
by the Avast Threat Intelligence Team September 27, 2018
The Telnet honeypot of security researcher Vess On Security was attacked by a new botnet coming from Tor exit nodes. Hard to imagine that devices still leave themselves exposed to Telnet. The malware contains unprecedented levels of sophistication, yet it has has no obvious purpose. It can exfiltrate data in quite a few different ways and supports multiple layers of encrypted communication. While it phones home on TCP port 443, this is deceptive because it does not use TLS. While most IoT malware is flushed when the device reboots, Torii uses six different methods to maintain persistence. The malware is modular in design and can infect devices running MIPS, ARM, x86, x64, PowerPC, and SuperH, among others.
Still more about VPNfilter
Researchers find Russian VPNfilter malware was a Swiss Army hacking knife
by Sean Gallagher of Ars Technica September 26, 2018
Reminder of old news: VPNfilter had been detected on a half million routers in 54 countries. And, it is the rare malware that survives a reboot of the router.
New news: The VPNfilter router malware is worse than originally thought. New features were discovered that exploit the entire network connected to the infected router. Run for the hills. Or, better yet, run away from consumer grade routers. The newly discovered features are: inspect and redirect HTTP traffic passing through the router, SSH client, SSH server, file transfers using the SCP protocol, nmap port scanner, network reconnaissance from the hacked router, scan for Mikrotik devices, a firewall, port forwarding to an outside network, a SOCKS5 virtual private network proxy server that runs on TCP port 5380, a Reverse-TCP VPN that connects the hacked router to the bad guys over a VPN (used to both steal data and for remote command and control). Quoting: "VPNfilter was clearly built for long-term use as a network exploitation and attack platform." Keep in mind, that this is, in part, an advertisement for Talos themselves. These quotes illustrate my point:
"The sophistication of VPNFilter drives home the point that this is a framework that all individuals and organizations should be tracking. Only an advanced and organized defense can combat these kinds of threats, and at the scale that VPNFilter is at, we cannot afford to overlook these new discoveries."
"The sophisticated nature of this framework further illustrates the advanced capabilities of the threat actors making use of it, as well as the need for organizations to deploy robust defensive architectures to combat threats such as VPNFilter."
Also proving my point is that the blogs from Talos are very short on defensive measures. No mention of this website, you can be sure. Just new stuff for Snort and Clam. If you don't know how to use these tools, then I am sure Talos can help. They released a program to decrypt the Winbox protocol and failed to mention that Mikrotik fixed the bugs, so all anyone has to do is install the latest firmware. They did not offer the link below to test port 5380.
Buggy routers have an average of 186 bugs each. Not a typo.
You can't secure your network without securing your routers - and your users' routers
by David Braue of CSO Online September 27, 2018
Quoting: "The American Consumer Institute Center for Citizen Research conducted an audit of 186 Wi-Fi routers from 14 different manufacturers, using Insignary’s Clarity application to scan the embedded firmware for unpatched security vulnerabilities. Fully 83 percent of examined routers were found to have known vulnerabilities in their code, with an average of 186 vulnerabilities per router ... the report warned that vendors' frequent usage of open-source code had left many routers exposed." The article cites a trifecta of problems: lots of new vulnerabilities being discovered, router manufacturers often-slow response in fixing these bugs and, of course, router owners who typically don't update the router firmware. Testing was done in July 2018 on the latest firmware for each router, so the real world situation is certainly worse. Only 31 routers had no bugs and they were not identified. I don't know who the American Consumer Institute is and I am always skeptical of a report without an author. There is a chance that this is a disguised press release for Clarity. That they don't mention the good routers also points to this being an ad disguised as a study. And, in the days after the study was released, they blogged about every story in the media that mentioned the study. Just what you would do if the study was really an advertisement.
MikroTik routers attacked abusing bugs with available fixes
Unpatched routers being used to build vast proxy army, spy on networks
by Sean Gallagher of Ars Technica September 5, 2018
Researchers at Netlab 360 have discovered that thousands of MikroTik routers have been compromised by malware attacking a vulnerability first revealed April 2018. MikroTik issued a fix back in April, but more than 370,000 MikroTik devices are online and still vulnerable. Of those, more than 7,500 are actively being spied on by attackers. The spying is done by forwarding a copy of network traffic to a bad guy. This is done using the built-in packet-sniffing capabilities of MikroTik routers. The sniffer, which uses the TZSP protocol, can send a stream of packets to a remote system using Wireshark or other packet capture tools. The vast majority of the packet capture streams were being sent to an IP address in Belize. Also, 239,000 of MikroTik devices have been turned into SOCKS 4 proxies. The malicious proxy network is using the non-standard TCP port 4153. It is not clear what the proxies are being collected for, but they are continuously scanning for other vulnerable routers.
Lots of Cisco bugs
Cisco Releases 16 Security Alerts Rated Critical and High
by Ionut Ilascu of Bleeping Computer September 5, 2018
Cisco published 30 security advisories on vulnerabilities in its products. Half of the bugs are considered high or critical severity. Three are security problems with critical impact. One critical bug affects the RV-series firewalls and routers, specifically RV110W Wireless-N VPN Firewall, RV130W Wireless-N Multifunction VPN Router, and the RV215W Wireless-N VPN Router. The two routers and the firewall are also vulnerable to directory traversal (CVE-2018-0426), command injection (CVE-2018-0424) and information disclosure (CVE-2018-0425) bugs, all having a high severity.
Yet another botnet
New Hakai IoT botnet takes aim at D-Link, Huawei, and Realtek routers
by Catalin Cimpanu for ZDNet September 3, 2018
A new botnet, Hakai, was first spotted in June 2018. Then, in July, it started to exploit a vulnerability in Huawei HG352 routers (CVE-2017-17215). By mid-August it was targeting more devices and vulnerabilities. Hakai now goes after three different bugs in D-Link routers, one of which involves HNAP. D-Link routers that support HNAP do not let you disable it, but D-Link is moving away from HNAP so anyone with a D-Link router should look for new firmware as it might eliminate HNAP. It also targets Realtek routers and IoT devices using a vulnerable version of the Realtek SDK where the miniigd SOAP service allows remote attackers to execute arbitrary code on the device using a malicious NewInternalClient request. The article does not offer any way of detecting if a specific IoT device is vulnerable or not. The botnet also targets Telnet looking for devices with the port open and simple or default passwords. The Hakai codebase also seems to have leaked as there are two different Hakai-based botnets, Kenjiro and Izuku, spreading online. The article says nothing about what the botnet does to the routers that it infects. It also says nothing about what an infected router might do to the rest of us.
The NSA used hacked routers to help decrypt VPNs
NSA Cracked Open Encrypted Networks of Russian Airlines, AL Jazeera, and Other "High Potential" Targets
by Micah Lee of The Intercept August 15, 2018
The article is about VPNs, but it included a point about using compromised routers to assist in breaking VPN traffic: "In 2014, The Intercept reported on the NSA's plans, dated August 2009, to use an automated system called TURBINE to covertly infect millions of computers with malware. The revelations described a piece of NSA malware called HAMMERSTEIN, installed on routers that VPN traffic traverses. The malware was able to forward VPN traffic that uses the IPSec protocol back to the NSA to decrypt."
The March 2014 article by Ryan Gallagher and Glenn Greenwald referred to here, said this about routers: "The NSA has specifically tailored some of its implants to infect large-scale network routers ... By compromising routers ... the agency can gain covert access to monitor Internet traffic, record the browsing sessions of users, and intercept communications. Two implants the NSA injects into network routers, HAMMERCHANT and HAMMERSTEIN, help the agency to intercept and perform "exploitation attacks" against data that is sent through a Virtual Private Network..." The article also pointed out that the NSA uses hacked routers to deliver malware to targeted machines.
D-Link routers in Brazil hacked to change DNS servers
In-the-wild router exploit sends unwitting users to fake banking site
by Dan Gooding of Ars Technica August 10, 2018
A flaw or flaws in D-Link gateways (a gateway is a combination modem and router) allows bad guys to remotely change the DNS server that the routers tell connected devices to use. DNS translates domain names, such as RouterSecurity.org into numeric IP addresses. All computer communication is based on numeric IP addresses. A small number of techies may hard code DNS servers into their computing devices, but the vast majority of computing devices use the DNS servers assigned to them by the router. A malicious DNS server will translate the name of a bank into the wrong IP address, one that hosts a scam version of the banking website. If a victim logs in to the scam website, the bad guys learn their banking password. According to Radware, bad guys have been using malicious DNS servers to send potential victims to scam versions of two Brazilian bank websites, Banco de Brasil and Unibanco. The web browser will display the correct banking URL while at the scam website, but the use of extended validation certificates should indicate that the displayed site is a scam. I checked. Both banks do use EV certificates so an educated user would not be fooled. Also, the browser should issue a warning about the self-signed certificate used by the scam sites. Known vulnerable D-Link devices include the DSL-2740R, DSL-2640B, DSL-2780B, DSL-2730B, and DSL-526B. Also, the Shuttle Tech ADSL Modem-Router 915 WM. These attacks were first noticed by Radware on June 8, 2018. The bugs being exploited date back to 2015 and have since been fixed. Vulnerable devices can be hacked without any interaction from the end user. In large part the bugs stem from the web interface being available to LAN side devices without authentication. Finally, Goodin claims that specifying your own DNS servers on your computing device over-rides those in the router. This is not always true, certainly not true with my favorite router the Pepwave Surf SOHO.
The Sky is NOT falling
New Method Simplifies Cracking WPA/WPA2 Passwords on 802.11 Networks
by Lawrence Abrams of Bleeping Computer August 6, 2018
This story is sad. The news is trivial, so much so, as to be almost irrelevant. Yet, every outfit did a story that the sky is falling. Not even Steve Gibson was able to put this in perspective and point out how un-important it was. The tech press is truly disgraceful. Consider this statement from the normally reliable Bleeping Computer site "While previous WPA/WPA2 cracking methods required an attacker to wait for a user to login to a wireless network and capture a full authentication handshake, this new method only requires a single frame which the attacker can request from the AP...". The fact is that Wi-Fi attackers never had to wait, they could force any and all currently connected devices off the network. Pretty much any Wi-Fi device would then try to log back in automatically. In fairness, this was a rare article to mention that this newly discovered technique "does not make it easier to crack the password for a wireless network." Many articles outright lied about this. And, some articles mentioned that the new technique only works on routers that have a certain feature enabled. No one bothered to research which routers have that feature enabled. That's not sexy. Have any router companies commented on which, if any of their routers are vulnerable to this new attack? One article had a quote from Eero saying that none of their devices are vulnerable. No one bothered asking any other router vendors. Eero did not publish anything on their website. And, finally, to put this in perspective, let us not forget that Google knows nearly every Wi-Fi password in the world as I blogged back in 2013. And, if Google knows it, the US Government can compel them to turn it over. No hacking needed.
Back to bad news - MikroTik routers at ISPs hacked
Mass MikroTik Router Infection – First we cryptojack Brazil, then we take the World?
by Simon Kenin of Trustwave August 1, 2018
Quoting: "I noticed a huge surge of CoinHive in Brazil. After a quick look I saw that ... these were all MikroTik network devices ... all of these devices were using the same CoinHive sitekey, meaning that they all ultimately mine into the hands of one entity ... the attacker indeed mainly focused on Brazil ... MikroTik routers are used by Internet providers and big organizations, and in this case it seem that the Reddit post's author's ISP had their router compromised ... the exploit was for a vulnerability patched by MikroTik on April 23rd (2018) .... using this exploit you can get unauthenticated remote admin access to any vulnerable MikroTik router ... the attacker used the device's functionality in order to inject the CoinHive script into every web page that a user visited ... This is a warning call and reminder to everyone who has a MikroTik device to patch as soon as possible, this attack may currently be prevalent in Brazil, but during the final stages of writing this blog, I also noticed other geo-locations being affected as well ... Let me emphasize how bad this attack is. The attacker wisely thought that instead of infecting small sites with few visitors, or finding sophisticated ways to run malware on end user computers, they would go straight to the source; carrier-grade router devices. There are hundreds of thousands of these devices around the globe, in use by ISPs and different organizations and businesses ..." This is, to me, a new type of bad. Any website sitting behind a hacked MikroTik router may deliver malware. One thing does not makes sense in this report. Kenin says that all web page passing through an infected router get modified, but, TLS should protect web pages from being modified in-flight.
New thing here - some good news
OpenWrt 18.06 released (Linux OS for your router, first major update in years)
by Brad Linder of Liliputing August 1, 2018
Quoting: "OpenWrt is an open source, Linux-based operating system designed to run on hundreds of routers and other embedded devices. It can add new features to your networking gear and give you more control over the software running on the hardware in your home. This week the developers released OpenWrt 18.06, which is a big step for a couple of reasons." Some changes: Spectre and Meltdown mitigations, improved firmware upgrade procedure, auto rollback functionality, new Linux kernel, an updated toolchain, some type of support for Wireguard VPNs, and, of course, bug fixes.
Bank fails to use VLANs
Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M
by Brian Krebs in Krebs on Security July 24, 2018
Hackers used phishing emails to break into The National Bank of Blacksburg in Virginia bank - twice. In May 2016, "The email allowed the intruders to install malware on the victim’s PC and to compromise a second computer at the bank that had access to the STAR Network, a system ... that the bank uses to handle debit card transactions for customers. That second computer had the ability to manage National Bank customer accounts and their use of ATMs and bank cards. Armed with this access, the bank says, hackers were able to disable and alter anti-theft and anti-fraud protections, such as 4-digit personal identification numbers (PINs), daily withdrawal limits, daily debit card usage limits, and fraud score protections." This first break-in cost the bank $569,000. The second break-in was in January 2017. "This time not only did the intruders regain access to the bank’s STAR Network, they also managed to compromise a workstation that had access to Navigator, which is software used by National Bank to manage credits and debits to customer accounts ... the hackers used the bank’s Navigator system to fraudulently credit more than $2 million to various National Bank accounts." Most of the article is about a lawsuit between the bank and its insurance company. Boring. Clearly the problem here is network segmentation or VLANs. No employee should be reading email messages on a computer that has network access to the core banking systems.
Port 5555 being attacked
Open ADB Ports Being Exploited to Spread Possible Satori Variant in Android Devices
by Hubert Lin, Lorin Wu and Vit Sembera of Trend Micro July 23, 2018
Quoting: "... we found a new exploit using port 5555 after detecting two suspicious spikes in activity on July 9-10 and July 15 ... the activity involves the command line utility called Android Debug Bridge (ADB), a part of the Android SDK that handles communication between devices ... the first wave of network traffic came mainly from China and the US, while the second wave primarily involved Korea ... we determined that the malware spreads via scanned open ADB ports .... It attacks ADB by uploading the payload via TCP port 5555 ... It is reasonable to believe that the same author was behind this sample and Satori ... According to data from Shodan, over 48,000 IoT systems are vulnerable to ADB exploitations. Not all vulnerable systems are exposed as they are usually hidden behind routers with NAT ... However ... they can be made accessible either manually or via UPnP NAT traversal. All multimedia devices, smart TVs, mobile phones, and other devices without additional protection are easy targets for this malware regardless of the user's password strength."
Still more attacks on buggy routers
eSentire Observes an Increase in Exploitation Attempts Against Routers
by eSentire July 20, 2018
eSentire observed exploitation attempts targeting consumer routers made by Dasan and D-Link. The D-Link DSL-2750B with firmware 1.01 to 1.03 is susceptible to this attack. So, too are Dasan GPON routers utilizing ZIND-GPON-25xx firmware and some H650 series. Dasan never issued bug fixes. If these devices get attacked, it can result in remote code execution. An article about the D-Link routers appeared in Ars Technica in June (see below).
Huawei Router botnet built exploiting only one bug
Router Crapfest: Malware Author Builds 18,000-Strong Botnet in a Day
by Catalin Cimpanu of Bleeping Computer July 19, 2018
A bad guy built a botnet of over 18,000 routers in the span of a single day. The botnet has been spotted by NewSky Security, and their findings have been confirmed by Qihoo 360 Netlab, Rapid7, and Greynoise. It was built by exploiting a vulnerability in Huawei HG532 routers (CVE-2017-17215). The bug can be exploited via port 37215. This was no zero day, the bug is high profile and had been exploited by many previous botnets. Clearly no one patches their routers. Also, ISPs fail to block incoming connections on port 37215.
Hackers Breach Russian Bank and Steal $1 Million Due to Outdated Router
by Catalin Cimpanu of Bleeping Computer July 19, 2018
What was outdated about the router, no one said. The victim of the hack was PIR Bank. Their network was infiltrated in late May 2018 and the money transferred out on July 3, 2018. The hacker group is known as MoneyTaker, according to Group_IB, and the amount stolen this time was at least $920,000 in US dollars. Group-IB said: "The router had tunnels that allowed the attackers to gain direct access to the bank’s local network .. This scheme has already been used by this group at least three times while attacking banks with regional branch networks." Tunnels? As in VPN?
Press Release: new free Avira security product
Avira Home Guard: One out of every four routers is vulnerable to hackers
by Avira July 19, 2018
This is a press release for a new free product from Avira. It is software that runs on Windows and Android and does a LAN scan to find devices and security issues with them. The text says that many routers have open ports, bit its not clear if the product finds LAN side or WAN side open ports. Avira may be selling FUD. Don't know. Hope to kick the tires on this soon. I later learned that Trend Micro has a similar product that runs on Windows, MacOS, iOS and Android. Trend is upfront of the data that is sent to them, Avira says nothing about this.
Netgear FTP password flaw exploited to steal military documents
Year-old router bug exploited to steal sensitive DOD drone, tank documents
by Sean Gallagher of Ars Technica July 11, 2018
Quoting: "In May, a hacker perusing vulnerable systems with the Shodan search engine found a Netgear router with a known vulnerability - and came away with the contents of a US Air Force captain's computer. The purloined files from the captain - the officer in charge of the 432d Aircraft Maintenance Squadron's MQ-9 Reaper Aircraft Maintenance Unit ... included export-controlled information regarding Reaper drone maintenance. The vulnerability, which makes it possible for an attacker to remotely execute commands and gain access to the root directory of the router via FTP, was disclosed by Netgear over a year ago ... [it] allowed attackers to ... gain access to the local network. They could then either grab files passing over the network or gain access to devices on it." An article in SFGate, from February 2016, Netgear: Add a password or risk losing your data, says the flaw stems from the promise of convenience: "An owner can plug in a flash drive or a hard drive into a home router and access the data remotely. Turning a USB stick into a private cloud is an enticing perk - and one that’s becoming expected as people grow accustomed to accessing their information from anywhere ... When people attempt to remotely access their data, they are prompted to enter a user name and password. If customers have not established their own unique log-ins, Netgear routers grant access without requiring a password at all." Netgear's point of view was that users are responsible for preventing this. They should change the FTP password as the manual says. The article also says that Netgear did not respond to questions about the specific devices affected by the design flaw.
Many routers should be illegal
Those Harder to Mitigate UPnP-Powered DDoS Attacks Are Becoming a Reality
by Catalin Cimpanu of Bleeping Computer June 28, 2018
Every consumer router that I am aware of ships with UPnP enabled. Less tech support calls that way. But, UPnP can be abused to make Denial of Service attacks harder to defend. Quoting: "Security researchers are continuing to see DDoS attacks that leverage the UPnP features of home routers to alter network packets and make DDoS attacks harder to detect and mitigate ... " UPnP was designed for LAN side use only, but many routers are mis-configured and support it on the WAN side. Then too, routers implement it wrong. Specifically, UPnP supports port forwarding to open up a LAN side device directly to the Internet. But, some routers do not validate that the target IP address is really internal, so UPnP allows port forwarding to a public IP address - to a victim of DDos attack. This has been called UPnProxy. This also allows changing the source port number which makes DDoS attack mitigation much harder.
Old D-Link DSL gateways being hacked. No surprise.
Widely used D-Link modem/router under mass attack by potent IoT botnet
by Dan Goodin of Ars Technica June 20, 2018
Bad guys are exploiting a bug in very old D-Link DSL-2750B DSL gateways in an attempt to make them part of the Satori botnet. The bug has been known for roughly 2 years but the devices have been abandoned by D-Link and the ISPs that gave them out. If you have such a device, it needs to be replaced. This is yet another reason to not use any hardware from your ISP, when possible. The bug allows remote command execution without any authorization needed. The vulnerability can be exploited using the "cli" parameter that directly invokes the "ayecli" binary. Vulnerable firmwares are from 1.01 up to 1.03. It is also possible to retrieve the admin password, wifi password, etc. Attack code exploiting the bug was published last month. Netlab 360 first reported Satori was exploiting this bug on June 15th. They also found it exploiting a bug in a XiongMai router. D-Link representatives did not respond to Ars Technica seeking comment. No surprise there. There is no mention of the device on the D-Link website for the US. I know someone who had one of these from Verizon. As of August 2016, it was running firmware version 188.8.131.52.44.2.1 (not a joke) which was released Nov. 14, 2013.
MikroTik router serving as Command and Control
Chinese Cyber-Espionage Group Hacked Government Data Center
by Catalin Cimpanu of Bleeping Computer June 15, 2018
Further proof that VPNFilter was inevitable
VPNFilter's Potential Reach - Malware Exposure in SMB/Consumer-grade Devices
by Bob Rudis of Rapid7 June 7, 2018
Rapid7 scanned the Internet looking for devices from the 11 manufacturers whose routers are known to be vulnerable to VPNFilter. Of those, they counted the ones with an open Telnet port and found just over 453,000 devices. Quoting: "... poorly configured and maintained devices remain at-large just waiting for attackers to regain control ... To ... understand the potential scope of the problem (and not with just VPNFilter), Rapid7 Labs researchers used banner scan results from Project Sonar and Censys to try to get a count of the device families targeted by VPNFilter. The initial numbers for the spread of VPNFilter were in the 500,000 device range and ... the potential for exploitation of all types in these device families (VPNFilter and beyond) is much, much larger ... we picked the most egregious port - telnet - to see what is there since - if telnet is exposed, the devices are seriously, egregiously poorly configured and are likely already compromised in other ways, let alone potential victims for VPNFilter (in any form) ... While we cannot determine if these devices are, in fact, compromised by the latest round of VPNFilter exploits, their mere presence on this singular cleartext port is a clear indicator that we have a long way to go reduce the number of candidates for compromise."
VPNfilter router hack - an inevitable disaster
New VPNFilter malware targets at least 500K networking devices worldwide
by Talos division of Cisco May 23, 2018
If you own a crappy router, it is likely to get hacked. That is the lesson to be learned here. And, by crappy, I mean anything from your ISP or a consumer router. You can stop reading now.
The story: State sponsored bad guys, probably Russians, have hacked a lot of routers (at least 500,000 in 54 countries is the estimate) with really nasty malware. Talos, working with law enforcement and others, found devices from Linksys, Mikrotik, Netgear, TP-Link and QNAP (a NAS not a router) infected. They listed specific models but clearly said their list was incomplete. Nonetheless many articles left out the incomplete part, leaving the impression these were the only vulnerable models. In reality, every device from these vendors needs to be considered vulnerable. There is no easy way to tell if a device is infected with VPNFilter. The exact method of infection is not known and Talos has not completed its research. As shown on the Bugs page here, there are many router bugs just waiting to be exploited. Heck, being a bad guy targeting routers is like being a kid in a candy store. Talos said "...most devices targeted ... have known public exploits or default credentials that make compromise relatively straightforward." In other words, easy pickings. While the initial router infection may have been easy, the malware is, nonetheless, fairly sophisticated. For one thing, it is installed in sections, a main controller is installed first and it then downloads other components. The initial component learns the IP address of where it should download the rest of itself in a very clever way. It downloads an image, and looks in the image metadata for an IP address. Also, this is only the second router malware that can survive reboots of the router. The malware/botnet has been around for a couple years and grew slowly until May 8, 2018 when it increased 28 fold with almost all new infections in the Ukraine.
So what? The malware can do assorted bad things and Talos is not sure it has detected everything. It can certainly steal website credentials and brick the router it is running on. And, as with other router hacks from the last few months, it can be used to hide the true location of bad guys doing bad things. If the FBI breaks your door down thinking you did a bad thing on the Internet, it might be due to VPNFilter. Speaking of the FBI, they said VPNFilter can do "information collection, device exploitation, and blocking network traffic." Finally, it monitors modbus traffic on TCP port 502. Modbus is an Industrial Control Systems (ICS) protocol. A report from JASK said "Western Europe and North America may be at increased risk for a potential ICS attack against critical infrastructure."
Solutions offered: Reboot you router is the big headline everywhere. Good reporters note that all routers should be rebooted, bad reporters point to the few that have been verified as vulnerable. Rebooting is also called power cycling. Simply put, unplug a router from the electricity, wait a short bit and then plug it back in. What is sometimes missing is that this only removes part of the malware, not all of it. Specifically, it removes the add-on components, but not the initially installed component. The malware that is left is harmless in and of itself, but it still leaves the router open to re-infection. Fully removing the malware requires a hard reset to restore the router to a factory fresh state. The downside to this is that any changes made to the default configuration will need to be re-done and hardly anyone knows every change that was made. Some routers can save their current configuration which begs the question if this is restored after a reset, are you still safe? No one has addressed this. Certainly if the malware changed DNS servers, you do not want to restore the bad ones. Finally, a factory refresh may be a waste of time, if the bug that led to the infection in the first place is not fixed. And, again, we do not know how the initial infections are done. Everyone also says to update the firmware. No one points out that this may be useless. Many routers are abandoned and their firmware is not updated and bugs are not fixed. Other solutions are not solutions, just re-cycled words. For example: change default passwords and turn off Remote Management. Well, duh.
Solution not offered: Use a Pepwave Surf SOHO router. Steve Gibson was the only person to question whether a factory reset really removed the malware. He suggested installing new firmware as the best approach for removing existing corrupted firmware. But that begs the questions: if a router already is running the latest firmware, can you re-install it on top of itself? Which leads me to wonder, how long before the malware prevents any firmware updates? Infected devices did TCP scans on ports 23, 80, 2000 and 8080 which Talos wrote are indicative of Mikrotik and QNAP NAS devices. A secure router has no open ports. The Test Your Router page lists many tests you can run against your router looking for open ports. Rebooting a router every now and then is a good idea in general, nothing to do with VPNFilter specifically. There are many router hacks that are removed by rebooting. I recommend periodic reboots on the home page of this site.
Unknown: What does a factory reset of a router really do? Does it install new firmware from a read-only copy? If so, how old is this firmware? Or, does it simply reset the configuration options but make no changes to the installed firmware? NO ONE addressed this issue. Then too, why is it that 3 of the 4 affected companies say nothing about a factory reset in their instructions to their customers? Strange.
Mystery: Who owned toknowall dot com, the domain seized by the FBI? Did the bad guys register it or was an innocent website hacked?
Detecting an infection:
June 30, 2018: Symantec has a VPNFilter checker at www.symantec.com/filtercheck. Interestingly, it is only available via HTTP, not HTTPS. Exactly what it does is not explained, Symantec says only that it tests for the presence of the ssler plugin. How it tests or what exactly it tests is not explained. Also, the plugin is but one component of VPNFilter and Symantec is clear that a router that gets a clean bill of health on their test, "...may still be compromised by other threats or components of VPNFilter." On this page, Symantec says that a list of vulnerable routers is available in their blog. There are multiple mistakes with this. Depending on the release of firmware, a router may or may not be vulnerable. Also, the list of known vulnerable routers is wrong as it omits information from at least two vendors that know exactly the vulnerability that led to infection. They just copied a list from Talos.
June 9, 2018: It seems that you cannot detect the presence of the VPNFilter malware just by looking at your router. The second Talos report mentioned that the router does port forwarding of port 80 to 8888, but did not say if this was visible in the router interface. The report also mentioned that it disables gzip compression, but no one has said how to detect this. Likewise, it tries to downgrade HTTPS to HTTP which is perhaps the easiest means of detection, but many websites force HTTPS all the time. All the detection mentioned anywhere involves monitoring traffic leaving the suspect router, which means connecting the router to something other than a modem. In effect, doing a Man-in-The-Middle attack on the suspect router. The MiTM device could look for the use of http : / / api.ipify.org?format=json which the malware uses to learn its public IP address. It could also look for outgoing requests to the domain seized by the FBI, toknowall dot com. Talos has published many Indicators of Compromise.
Update June 2, 2018: I re-read the Talos blog and it clearly says that rebooted routers can be fully re-infected. Quoting: "If the attempt to the backup domain fails, stage 1 opens a listener that waits for a specific trigger packet to open a connection for the actor to connect interactively to the device ... when any packet arrives on any port, the listener performs a series of checks to identify a trigger packet. If the packet meets a predefined set of criteria, it will extract an IP address from the packet and attempt a stage 2 download." Surely the bad guys know the IP addresses of all infected routers, even those that were re-booted. They may lose track of some because the re-boot may assign a new public IP address, but still, they should be able to fully re-infect many of the rebooted routers. And, the malware listens for a trigger packet on all ports making it impossible to do port scans to find infected devices.
Bug in DrayTek routers is being both exploited and fixed
May 21, 2018: A bug in DrayTek routers was reported by the company and is in the process of being fixed by new firmware. Bad guys have been abusing the flaw to modify the DNS servers in the routers. Details are on the Router Bugs page.
WICKED botnet exploits known bugs in Netgear routers
A Wicked Family of Bots
By Rommel Joven and Kenny Yang of FortiGuard Labs May 17, 2018
If the WICKED botnet can connect to port 8080 on a router it will try to exploit a flaw in Netgear DGN1000 and DGN2200 v1 routers from October 2017. If it can connect to port 8443, it will try to exploit a command injection flaw in Netgear R7000 and R6400 routers from March 2017. If you have a Netgear router, you can test TCP port 8443 and test TCP port 8080. The best result is "Stealth." If one of the ports are open, make sure you have the latest firmware installed.
Harder to detect DDoS attacks thanks to UPnP
New DDoS Attack Method Demands a Fresh Approach to Amplification Assault Mitigation
by Avishay Zawoznik, Johnathan Azaria and Igal Zeifman of Imperva May 14, 2018
It was recently reported that routers with UPnP exposed on their WAN side (the Internet) were being abused by bad guys to make their own customized equivalent of the Tor network to hide their actual location. That was bad enough. Now, Imperva has found that bad guys are also abusing devices that expose UPnP, in DDoS attacks that are harder to detect because the source port is a scam. They searched Shodan and found over 1.3 million devices exposing UPnP on the Internet.
Dasan GPON routers being attacked
Vulnerabilities Affecting Over One Million Dasan GPON Routers Are Now Under Attack
by Catalin Cimpanu of Bleeping Computer May 4, 2018
The bug being exploited was disclosed in late April 2018. At first, I did not believe it, my reasons are on the Bugs page. Seems I was wrong and these are real router vulnerabilities. Over a million routers are said to be vulnerable. No article has yet addressed whether the bugs can be exploited remotely, locally or both. The bugs are CVE-2018-10561 and CVE-2018-10562. GPON (Gigabit Passive Optical Network) supports internet connections via fiber optics lines. Most of the vulnerable routers are in Mexico, Kazakhstan, and Vietnam.
Update May 21, 2018: These same routers appear to have another zero day flaw that bad guys are exploiting. See GPON Routers Attacked With New Zero-Day by Catalin Cimpanu for Bleeping Computer.
Hacking a home network
The Digital Vigilantes Who Hack Back
by Nicholas Schmidle for The New Yorker magazine May 7, 2018 issue
The article mentions a security company that got a request from the C.E.O. and general counsel of a multinational corporation. A employee who left the corporation had not returned their company laptop and was suspected of having shared proprietary information with a competitor. They wanted to know if the security company could "hack into the former employee's home network, assess whether the company laptop was connected to it, and, if so, erase any sensitive files." Doing so, would require access to the MAC address of the devices connected to the former employee's home network. That, in turn, requires router access. The security company said, for the article, that from a technical standpoint "such a hack would not be difficult."
Apple FINALLY comes clean, no more AirPort routers
Apple officially discontinues AirPort router line, no plans for future hardware
by Zac Hall of 9to5Mac April 26, 2018
"Apple is officially exiting the wireless router business and selling off its remaining inventory of AirPort products. This includes the AirPort Express, AirPort Extreme, and both models of AirPort Time Capsule." Why would anyone buy the remaining inventory? Especially since the last new model was released five years ago. Apple seems to hate their customers. Back in Nov. 2016, Bloomberg reported that Apple had disbanded the team responsible for developing Apple's routers. Yet, it took till now to make it official. And, even now, they have not lowered the price of remaining inventory. The article says that the router will be supported for years to come, but they are, after all, Apple fanboys. I doubt there will ever be another firmware update to the AirPort routers. As for replacements, needless to say, I recommend the PepWave Surf SOHO router. It is, however, a single device and Peplink does not offer a mesh router system. At the moment, I would recommend Eero, based on my experiences with tech support. However, I have only kicked the tires on Eero, Google Wifi and AmpliFi.
UPnProxy- the UPnP abuse will never die - no progress in 5 years
UPnProxy: Blackhat Proxies via NAT Injections
by Akamai undated (sometime this month)
UPnP was intended to be used on a LAN and, as such, all devices were considered trusted and the protocol has no security at all. It's an old protocol. Back in January 2013 it was discovered that millions of routers were exposing UPnP on their WAN side (the Internet) by mistake. For more on this see the Bugs page. Here we are, 5 years later and this is still true. It seems nothing was done about the millions of buggy/vulnerable routers from 2013. Last month, Symantec wrote about a cyber espionage group known as the Inception Framework abusing UPnP to forward traffic from one router to another to another to another, etc. This lets bad guys hide the true source of their bad deeds. The link and summary are on this page, under March 2018. Now, Akamai is reporting the same thing and they call it UPnProxy. Akamai says it detected over 4.8 million routers that expose various UPnP services via the WAN interface. Again, there should be none, UPnP was only intended for LAN side use. Of these exposed routers, Akamai says over 65,000 home routers are currently being abused. No need for a VPN or Tor when you bounce your Internet data through dozens of other people's routers. This is a gift to spammers, phishers, botnets and the like. It is a bit like having a dedicated bad-guy-only version of Tor. Akamai was kind enough to shame the buggy and vulnerable devices and their manufacturers. Asus is a disgrace, they have a large number of vulnerable devices. Some other manufacturers on the list are D-Link, Ubiquiti, Netgear and ZyXel. Peplink was not on the list. Akamai also blamed ISPs because they are in a position to block UPnP traffic that was never meant to traverse the Internet in the first place. Comcast deserves credit here, they block UDP port 1900. This story did not get nearly enough attention. My guess is that it is beyond the technical comprehension of the many Art History majors that cover technology. Steve Gibson's discussion of UPnProxy (link below) is the only one worth reading/hearing.
- - - -
WHAT YOU CAN DO: How can you tell if your router exposes UPnP to the Internet at large? Steve Gibson has the only test that I am aware of. It is part of his Shields Up! service, the link is below. Every consumer router that I have seen ships with UPnP enabled. So, first off, disable UPnP in your router and then test to see if it was disabled on the Internet/WAN side of the house. Akamai noted that UDP port 1900 is what makes a vulnerable router discoverable. Click here to test if UDP port 1900 is open on your router. Also, check if your router is doing any port forwarding at all. Nothing to do with UPnProxy, all forwarded ports are holes in the router firewall and thus potential security weaknesses. For an Asus router go to System Log, then the Port Forwarding tab. If you see nothing, then you are safe, at the moment. In this screen shot, we see five ports are being forwarded. These are normal forwarding rules in that the destination is a computer on the LAN - they all start with 192.168.1. Victims of UPnProxy would see a public IP address in the "Redirect to" column. I have no idea why UDP port 54051 is being forwarded on this Asus router. For a TP-Link router, go to the Advanced tab, then NAT forwarding, then UPnP. Again, nothing being forwarded is good. In this screen shot, we see two forwarding rules, both to an "Internal IP Address" (starting with 192.168.0). I don't know if any routers let you disable or delete a UPnP created forwarding rule. As we can see in these two screen shots, neither Asus nor TP-Link supports this. But, at least they do report on UPnP created port forwarding. I tried the emulator for a couple Linksys Smart routers and they do not seem to report on this at all. Exposing UPnP also opens up your router to attack which Akamai described in their report. It basically converts Remote Administration to Local Administration. To defend against this, change the port number(s) used for local administration and change the LAN side IP address of the router. And, of course, change the router admin password, and, when possible, the router admin userid too. All that said, the Defensive Computing thing to do is to replace a router exposing UPnP on the Internet. It shows the manufacturer is incompetent.
The Russians Are Coming, The Russians Are Coming
Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices
by the Department of Homeland Security, the FBI and the National Cyber Security Centre in the UK April 16, 2018
Russian cyber actors do not need to leverage zero-day vulnerabilities or install malware to exploit devices. Instead, they take advantage of: devices with legacy unencrypted protocols or unauthenticated services, devices insufficiently hardened before installation, and devices no longer supported with security patches. These factors allow access to both intellectual property and U.S. critical infrastructure that supports the health and safety of the U.S. population. Network devices are ideal targets. A malicious actor with presence on an organization’s gateway router has the ability to monitor, modify, and deny traffic to and from the organization. Whoever controls the routing infrastructure of a network essentially controls the data flowing through the network.
The Russians, like many others, are abusing Cisco Smart Install enabled devices. There is more about abusing Smart install below, dated April 6th. Details on the Smart Install flaws are on the Bugs page under March 2018. Also being attacked are Generic Routing Encapsulation (GRE) and Simple Network Management Protocol (SNMP). The National Cyber Security Centre (NCSC) is an arm of British intelligence agency GCHQ.
From my Defensive Computing perspective, there is nothing special about Russia, all Internet-facing devices are scanned all the time. I blogged about this last month, Routers are constantly being probed - examining a firewall log
Hacked routers with malicious DNS servers lead to Android malware
Roaming Mantis uses DNS hijacking to infect Android smartphones
By Suguru Ishimaru of Kaspersky Lab Securelist April 16, 2018
Android malware, dubbed Roaming Mantis, is distributed through router DNS hijacking. When a user attempts to access any website via a compromised router, they are redirected to a malicious website. For example, if a web browser tried to access www.securelist.com, it would be redirected to a rogue server that had nothing to do with the security research blog. The nature of the malicious website is hidden from the victim because the web browser displays the original URL. The malicious web page implores the victim to update to the latest version chrome. Victims that install the banking malware have their login credentials stolen. The malware can read SMS messages so it also steals the secret verification code used for two-factor authorization. The article goes into details on the malware, but says nothing about how the routers may have been hacked. It also offers bad advice: "If you have any concerns about the DNS settings on your router, please check the user manual and verify that your DNS settings haven't been tampered with, or contact your ISP for support." Better advice is to use the DNS server tester pages listed here to learn what your DNS servers are.
Hacking routers is the latest thing among bad guys
Cyber-Espionage Groups Are Increasingly Leveraging Routers in Their Attacks
By Catalin Cimpanu of Bleeping Computer April 12, 2018
According to Costin Raiu, director of the Global Research and Analysis Team at Kaspersky Lab, the number of Advanced Persistent Threats leveraging routers for attacks has gone steadily up in the past year, and the tactic has become quite widespread in 2018. Maybe I should put ads on this site. Their research uncovered the LuckyMouse APT which uses routers for hosting their command and control servers, which, Raiu said, is unusual. They believe that the routers were hacked through an SMB vulnerability which allowed the bad guys to upload CGI scripts. He also pointed out that the US government released a document saying that router attacks have been the preferred attack vector for a number of malicious actors for a number of years, yet, the number of reports about router malware and router attacks are few and far between. Thus, Raiu concludes that there's a lot going on that we don't see.
Looks like the Boston Red Sox need better computer nerds
The Red Sox clubhouse's Wi-Fi password does not rank high for creativity
by Nik DeCosta-Klipa of Boston.com April 12, 2018
Yankee manager, Aaron Boone, was being interviewed after a game at Fenway Park against the Boston Red Sox when the camera showed a bulletin board on the wall next to Boone. On the bulletin board was the Wi-Fi network name and password. This got some attention because the password was the miserably insecure - "baseball". The Red Sox could hardly have chosen a worse password. They took it well, however, tweeting "Guess we need a new WiFi password". As I explain here on the Wi-Fi encryption page, Wi-Fi passwords need to be at least 14 characters long to resist brute force attacks. However, for a high value target such as the visitors clubhouse at Fenway Park, I would certainly go with a longer password. When you consider all the schools near Fenway Park (Harvard and MIT come to mind), churning out fresh new techies, I would make the password still longer. The password was not their only mistake, an SSID of "clubhouse" gives away too much information. Why not call it "VisitorsClubhouse" and take away all mystery. Better network names would have been BlueSky or ColdWeather or JoesNetwork. See more about picking an SSID. Some of the suggestions on Twitter for new passwords, shown below, were not half bad.
ISPs keep customers ignorant
What most people think it looks like when you change router's admin password, apparently
by Kat Hall of The Register April 12, 2018
A survey, by the British comparison website Broadband Genie, reported that 82 per cent of responders have never changed their router password. The article is unclear however about whether it is referring to the router password or to a Wi-Fi password. The survey also found that 52 per cent have not changed their Wi-Fi network name (SSID). This advertises to bad guys that the owner of this network is technically clueless, which may invite attack. 48 per cent of responders said they were baffled as to why they would need to make these changes. A pessimist might assume that ignorant customers make fewer tech support calls. This article is just as guilty as the ISPs it is trying to shame. It notes that bad things can happen if the DNS servers in the router are changed, but fails to mention that you can test for this fairly easily. My Test Your Router page lists many websites that report on the currently used DNS servers.
Two router surveys by PC Magazine
April 11, 2018: PC Magazine just published their Readers' Choice Awards 2018: Routers and NAS Devices. Asus won the router award for the seventh straight year. Just days earlier, Akamai issued a white paper, UPnProxy: Blackhat Proxies via NAT Injections that detailed problems with UPnP. The Akamai paper listed buggy devices. Asus had quite a few buggy routers: DSL-AC68R, DSL-AC68U, DSL-N55U, DSL-N55U-B, MTK7620, RT-AC3200, RT-AC51U, RT-AC52U, RT-AC53, RT-AC53U, RT-AC54U, RT-AC55U, RT-AC55UHP, RT-AC56R, RT-AC56S, RT-AC56U, RT-AC66R, RT-AC66U, RT-AC66W, RT-AC68P, RT-AC68R, RT-AC68U, RT-AC68W, RT-AC87R, RT-AC87U, RT-G32, RT-N10E, RT-N10LX, RT-N10P, RT-N10PV2, RT-N10U, RT-N11P, RT-N12, RT-N12B1, RT-N12C1, RT-N12D1, RT-N12E, RT-N12HP, RT-N12LX, RT-N12VP, RT-N14U, RT-N14UHP, RT-N15U, RT-N16, RT-N18U, RT-N53, RT-N56U, RT-N65R, RT-N65U, RT-N66R, RT-N66U, RT-N66W, RTN13U, SP-AC2015 and the WL500. Peplink, my preferred router vendor, was not on the radar screen of PC magazine readers.
Throwing salt on the wound, two days later the magazine came out with their Business Choice Awards for routers, which also recommended Asus. This is crazy, Asus does not make Business class routers. The magazine claimed to have surveyed admins and IT folks, maybe they should use Facebook to find real IT folks. Then again, maybe it tells us more about PC Magazine than it does about Asus.
Cisco devices are being hacked all over the world
What happened to the Internet: attack on Cisco switches
by Kaspersky April 6, 2018
At the end of March 2018 Cisco released 34 bug fixes of which three were deemed critical. Details are on the Router Bugs page. By April 6th, there was a massive attack against Cisco switches. These devices are used in data-centers across the globe. The attacks are exploiting a bug in the Cisco Smart Install Client software. The Smart Install protocol does not require authentication and should not be exposed to the Internet. Yet, there it is. Kaspersky blames the nerds working in datacenters for failing limit access to TCP port 4786. Or, they should have disabled Smart Install altogether. A simple command tests if Smart Install is running and another command can disable it. Hackers have attacked networks in a number of countries including Iran where they left the image of a U.S. flag on screens along with a warning: "Don't mess with our elections." Some hackers claimed to have fixed the bug on vulnerable devices in the U.S. and UK. One report said the flaw apparently affected 200,000 router/switches. Talos found 168,000 devices exposed by the Cisco Smart Install Client. Motherboard reported 166,000. Attackers are able to reset the devices back to their default configuration and display a message to the victims. The attack on some ISPs cut off Internet access for their subscribers. Talos observed hackers exploiting the vulnerability to target critical infrastructure. Joseph Cox of Motherboard said that the attack seems relatively unsophisticated. Taols, which is owned by Cisco, believes that some of the attacks are from nation-state actors. Sounds better than a bunch of 14 year old kids.
The better to spy on you, my dear
Chinese city shops ordered to start using government-approved routers
by Shannon Liao of The Verge April 5, 2018
MikroTik routers used in DDoS attacks
Mirai-Variant IoT Botnet Used to Target Financial Sector in January 2018
by Priscilla Moriuchi and Sanil Chohan of the Insikt Group. April 5, 2018
In late January 2018, three European financial institutions were hit by DDoS attacks powered by a new variant of the Mirai botnet. The botnet that hit the first company consisted of at least 13,000 devices. The Insikt Group used IP geolocation, service banners from Shodan, and additional metadata to analyze the composition of the botnet and found that the attack was 80 percent comprised of compromised MikroTik routers, with the remaining 20 percent composed of various IoT devices ranging from vulnerable Apache and IIS web servers, to routers from Ubiquity, Cisco, and ZyXEL. All of the compromised MikroTik devices had TCP port 2000 open, which is usually reserved for MikroTik’s bandwidth test server protocol. This port is usually enabled by default in new MikroTik devices. No MikroTik devices with TCP 2000 disabled (a recommended security measure in production environments) were discovered within the botnet.
Multiple reports of DNS hijacking on Asus routers
Asus RT-AC66U DNS hacking
by Mpuk7 at the SmallNetBuilder forum March 10, 2018
Because I maintain this website, someone emailed me asking about their Asus router that had its DNS hijacked. As we both looked into it, there seems to be a lot of that going around. The person who posted this claimed to have the latest Asus firmware, a long password and they had even changed the default router userid. Of course, the latest firmware, at least with consumer routers, always includes old software with known bugs. I am not qualified to review the Asus router log, but this one made it obvious the router was running some old software with known bugs. The router had remote administration enabled, which is almost always a mistake. Two interesting quotes from these reports: "I tried Asus support but they were immensely useless" and another person said Asus was as helpful as a chocolate teapot :-) Two of the bad DNS servers were 184.108.40.206 and 220.127.116.11.
Update March 16, 2018: David Redekop suggested this might be the flaw that was abused here: ASUS Patches Root Command Execution Flaws Haunting Over a Dozen Router Models. Routers enabled for Remote Administration using HTTP rather than HTTPS would be vulnerable to this.
MikroTik routers hacked to infect Windows PCs
Kaspersky Lab uncovers Slingshot, the spy that came in from the router
by Kaspersky March 9, 2018
It is not known how the MikroTik routers were hacked. Currently routers are configured using either a web interface or a mobile app. In the previous century they were administered with Windows software. The hacked routers were administered with Windows software known as Winbox. Winbox, for whatever reason, downloads some Windows executable files (DLLs) from the router. The hacked routers had malicious DLLs that infected the Windows computer used to configure the router. This was professional spyware of the highest caliber. The infections seem to be very targeted, with only around 100 PCs known to be infected. The spyware was extremely effective at stealthy information gathering, hiding its traffic in marked data packets that it can intercept without trace from everyday communications. Operation slingshot seems to have started in 2012 and was still active in February 2018. The MikroTik router firmware no longer installs software on Windows computers. Winbox is still a thing, but they also have a web interface. Kaspersky software can defend against this. So too, can a Chromebook.
Ellen Nakashima, of the Washington Post, wrote Russian spies hacked the Olympics and tried to make it look like North Korea did it. Quoting: "Apart from accessing the computers, GRU cyber-operators also hacked routers in South Korea last month ... according to Western intelligence agencies. Such access could enable intelligence collection or network attacks..." The article also has a quote from security expert Jake Williams of Rendition Infosec: "Anyone who controls a router would be able to redirect traffic for one or more selected targets or cause total disruption in the network by stopping the routing entirely."
An old D-Link HNAP flaw exploited by a new botnet
Masuta : Satori Creators' Second Botnet Weaponizes A New Router Exploit.
by Ankit Anubhav, Principal Researcher, NewSky Security January 23, 2018
Quoting: "We analyzed two variants of an IoT botnet named 'Masuta' where we ... discovered a router exploit being weaponized for the first time in a botnet campaign ... The weaponized bug introduced in PureMasuta botnet is in the HNAP (Home Network Administration Protocol) which itself is based on the SOAP protocol. It is possible to craft a SOAP query which can bypass authentication by using hxxp://purenetworks.com/ HNAP1/GetDeviceSettings. Also, it is feasible to run system commands (leading to arbitrary code execution) because of improper string handling. When both issues are combined, one can form a SOAP request which first bypasses authentication, and then causes arbitrary code execution."
MikroTik and Ubiquiti Routers defaced due to default passwords
Tens of Thousands of Defaced MikroTik and Ubiquiti Routers Available Online
by Catalin Cimpanu of Bleeping Computer January 10, 2018
If you don't change the default password, you get what you deserve. It seems that, as a prank, someone has been changing the names of routers. Ankit Anubhav of cyber-security company NewSky Security, first ran across this back in July. He estimates that over 40,000 Ubiquiti routers have been defaced along with 7,300 MikroTik routers. The names given to the routers are "HACKED FTP server," "HACKED-ROUTER-HELP-SOS-WAS-MFWORM-INFECTED," and "HACKED-ROUTER-HELP-SOS-HAD-DEFAULT-PASSWORD."
Satori botnet abusing routers
Warning: Satori, a Mirai Branch Is Spreading in Worm Style on Port 37215 and 52869
by Li Fengpei of Qihoo 360 Netlab December 5, 2017
Quoting: "About 12 hours ago ... we noticed a new version of Satori (a mirai variant which we named Satori), starting to propagate very quickly on port 37215 and 52869. Two new exploits ... have been added ... during last recent 12 hours we have seen 263,250 different IPs scanning port 37215, and 19,403 IPs scanning port 52869." They have not yet disclosed information on the flaw involving port 37215. The bug being exploited on port 52869 is derived from CVE-2014-8361. It is not clear, to me at least, if this is the same botnet that Dan Goodin wrote about below.
UPDATE: Script Kiddie Responsible for Large Satori Botnet by Lucian Constantin in Security Boulevard December 22, 2017. Security researchers at Check Point Software believe that the Satori botnet of more than 250,000 routers was created by an amateur hacker with limited skills. The botnet abuses a known bug in the Miniigd UPnP SOAP service on port 52869 and a new bug in Huawei HG532 home gateways on port 37215. Huawei exposed a configuration service intended to only be used on the LAN side to the Internet. It is scary that a relatively unskilled attacker can build a large botnet capable of devastating attacks. It highlights the poor state of router and IoT security across the internet.
Starbucks Wi-Fi hacked in Buenos Aires
Starbucks Wi-Fi hijacked customers' laptops to mine cryptocoins
by Lisa Vaas of Sophos December 14, 2017
A botnet spreads by attacking un-named flaws in Huawei Home Gateways
100,000-strong botnet built on router 0-day could strike at any time
by Dan Goodin of Ars Technica December 5, 2017
First off, clickbait. There are many botnets that could strike at any time. It is, sadly, the new normal. The buggy devices are the Huawei EchoLife Home Gateway and the Huawei Home Gateway. The bug was first disclosed by Check Point Software on Nov. 27, 2017. The botnet spreads both by abusing a bug and also by guessing 65,000 different userid/password combinations. It does not abuse Remote Administration. This is the second botnet, after Reaper, to spread by abusing flaws in routers. There is much we do not know:
--There are multiple Huawei Home Gateway models and it is not clear if some or all are buggy
--What firmware versions have the bug?
--What userid/passwords is the botnet guessing
--Defense. The article says nothing at all about defending against the flaw. Typical of clickbait.
--Does Huawei know about the bug? Acknowledge it? Have they issued a fix?
In June 2017, it came to light that the CIA has been hacking routers for many years. In covering the story
More abuse of TR-069
Thousands of Hacked Home Routers are Attacking WordPress Sites
by Mark Maunder of Wordfence April 11, 2017
We have seen this story before. ISPs leave the TR-069 port, number 7547, open to the world at large rather than restricting access to themselves. Just more support for my recommendation to avoid using a router from an ISP. Wordfence reports that Shodan found over 41 million devices are listening on port 7547.
In October 2016, Brian Krebs wrote about malware that targeted Asus and Linksys routers. The software turned the routers into SOCKS proxies, which help bad guys hide their location, much like Tor. Bad guys were using these hacked routers for "or a variety of badness, from proxying Web traffic destined for cybercrime forums to testing stolen credit cards at merchant Web sites." Plus, access to these hacked routers was being sold in exchange for Bitcoin.
This is why Router Security matters
IoT Home Router Botnet Leveraged in Large DDoS Attack
by Daniel Cid of Sucuri September 1, 2016
This is a blog post about a DDoS attack that Sucuri fought off for a client. The attack used three different botnets, one of them composed of routers. Sucuri detected over 11,000 compromised routers from eight different vendors. Quoting: "The largest number of routers being exploited came from Huawei-based routers. They varied between versions: HG8245H, HG658d, HG531, etc." Other routers were from MikroTik, Ubiquiti, NuCom, Dell SonicWall, VodaFone, Netgear, and Cisco-IOS.
Building router hacked
Building automation systems
are so bad IBM hacked one for free
by Darren Pauli of The Register Feb 11, 2016
Quoting: "An IBM-led penetration testing team has thoroughly owned an enterprise building management network in a free assessment designed to publicize the horrid state of embedded device security ... they found exposed administration ports ... gaining access to a D-Link panel enabled to allow remote monitoring ... by adding an extra carriage return after the page request it was possible to bypass the router's authentication. They found command injection vulnerabilities in the router and found a list of commands in the firmware source code. They found a cleartext password in the router's var directory that not only granted more router pwnage but, thanks to password-reuse, allowed them to compromise the building management system." No mention of who made the router, let alone a model number.
In August 2015, Jeff Atwood blogged about how two people he knew fell victim to compromised routers (see Welcome to The Internet of Compromised Things). In one case, the infected router inserted ads onto all HTTP web pages. Quoting:
It's becoming more and more common to see malware installed not at the server, desktop, laptop, or smartphone level, but at the router level ... I write about this because it recently happened to two people I know ... This is way more evil genius than infecting a mere computer. If you can manage to systematically infect common home and business routers, you can potentially compromise every computer connected to them. Router malware is the ultimate man-in-the-middle attack ... [bad guys] can direct you to phishing websites at will - if you think you're on the "real" login page for the banking site you use, think again.
In May 2015, Scott Hanselman wrote about an infected router at his local sandwich shop that "... started to redirect me to a fake 'update your flash' and download a 'Install flashplayer_10924_i13445851_il345.exe' malware file..... This affects their PoS (Point of Sale) system, tablets, iPhones ... It's a MitM attack (Man in the Middle) where x number of HTTP GETs work fine and then every few hundred the router returns it's own HTML."
Victims don't have do anything to have their computing devices infected with malware. A hacked router can corrupt the self-update mechanism of either the operating system or a specific application. In June 2015 a case like this got a lot of publicity; the pre-installed Swift keyboard on Samsung smartphones self-updated in an insecure way that could be corrupted by anyone able to modify network traffic. A hacked router is one source, so too is a malicious ISP, a bad guy on the LAN or malware running on another LAN-resident device. Because the keyboard software ran with very high system privileges there was almost no end to what malware it was tricked into installing could do.
When visiting popular websites, the router can install malware by prompting users to install a plug-in. Here is a screen shot of this from 2012 in Brazil. See also Info Stealer Poses as Google Chrome Installer from Trend Micro written in May 2012.