Routers in the news, pretty much means routers getting exploited by bad guys to do bad things. I am still waiting for a good news story about routers. The flaws that are exploited are documented on the Bugs page. Articles that offer security advice are listed on the Other router security advice page.

YEARS:   2023   2022   2021   2020   2019   2018   2017   2016   2015   2012

2024

APRIL 2024

TP-Link Routers being hacked

Multiple botnets exploiting one-year-old TP-Link flaw to hack routers
by By Bill Toulas of Bleeping Computer   April 17, 2024
At least six malware botnets are hunting for buggy TP-Link Archer AX21 (AX1800) routers. The bug that is being exploited was reported to TP-Link in January 2023 and fixed in March 2023. Yet, a year later, many of the vulnerable routers have not been updated. Clearly updating firmware on TP-Link routers is too hard for many people that own them. To me, THE BIG ISSUE HERE is not the AX1800 model but the 38 other routers that TP-Link sells. Are any of them also buggy? The article says nothing about this. TP-Link also says nothing about this. This is reason enough to avoid TP-Link devices.

• Official Statement on Archer AX21 Remote Code Execution Vulnerability (CVE-2023-1389) The Security Advisory from TP-Link. Last Updated April 27, 2023.

MARCH 2024

Old Asus routers hacked

TheMoon malware infects 6,000 ASUS routers in 72 hours for proxy service
by Bill Toulas of Bleeping Computer   March 26, 2024
Quoting: "A new variant of TheMoon malware botnet has been spotted infecting thousands of outdated ... routers and IoT devices ... TheMoon is linked to the Faceless proxy service, which uses some of the infected devices as proxies to route traffic for cybercriminals who wish to anonymize their malicious activities ... Black Lotus Labs researchers ... have observed 6,000 ASUS routers being targeted in under 72 hours ... The researchers do not specify the exact method used to breach the ASUS routers, but given that the targeted device models are end-of-life, it is likely that the attackers leveraged known vulnerabilities in the firmware." We have seen this many times before, bad guys do bad things online, but make it appear as if their bad things came from your router.

• Thousands of phones and routers swept into proxy service, unbeknownst to users by Dan Goodin for Ars Technica. March 26, 2024. Security firm Lumen Labs, reports that roughly 40,000 routers have been drafted into a criminal enterprise that anonymizes illicit Internet activities. The malware dates back to at least 2014 when it only infected Linksys E1000 series routers. Now, it targets Asus WRTs, Vivotek Network Cameras, and multiple D-Link models.
• The Darkside Of TheMoon by Black Lotus Labs March 26, 2024. Original report. Infected devices being enrolled into a proxy service is a growing trend.

FEBRUARY 2024

Quite a month for hacking routers

Hackers backed by Russia and China are infecting SOHO routers like yours, FBI warns
by Dan Goodin of Ars Technica   February 27, 2024
The article provides some context: "Nation-state-backed groups have used routers to obfuscate attacks since at least 2018, when researchers from Cisco’s Talos security group detected more than 500,000 SOHO routers that had also been compromised ... [to] install sophisticated malware Talos dubbed VPNFilter to carry out a range of activities. Hundreds of router models from nearly a dozen manufacturers were affected..." Russians have been using infected routers since at least 2022 to facilitate covert operations against governments, militaries, and organizations around the world, including in the Czech Republic, Italy, Lithuania, Jordan, Montenegro, Poland, Slovakia, Turkey, Ukraine, the United Arab Emirates, and the US. Besides government bodies, industries targeted include aerospace and defense, education, energy and utilities, hospitality, manufacturing, oil and gas, retail, technology, and transportation. Ubiquiti EdgeRouters make an ideal hideout for hackers. They are cheap and run Linux that can run hidden behind-the-scemes malware. Bad guys use hacked routers to do bad stuff because their activity seems to come from benign-appearing devices hosted by addresses with trustworthy reputations. Earlier this month, the FBI revealed that it had removed Russian malware from routers but they only temporarily blocked the Russians. The FBI did not patch any bugs in the routers or remove default passwords.

The Russians will try again to hack Ubiquiti Edge Routers

That home router botnet the Feds took down? Moscow's probably going to try again
by Simon Sharwood of The Register   February 28, 2024
The FBI issued a somewhat useless advisory on behalf of the US, Belgium, Brazil, France, Germany, Latvia, Lithuania, Norway, Poland, South Korea, and the UK. It was a warning that Russia may try again to hack Ubiquiti EdgeRouters and owners of these things better patch and re-configure. The cheapie boxes can not self update and they all ship with the same default password, which is disgraceful. A reader comment noted that when Ubiquiti did try to force people to invent their own passwords they made two mistakes in their implementation. Disgraceful again. All the advice from the FBI is for nerds and some of it is vague. Non techies should buy new routers. The original Ubiquiti router hacks were by Russia's GRU military intelligence unit. They build a 1,000-strong botnet and used it for power phishing, spying, credential harvesting, and data theft.

• From the FBI: Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations. February 27, 2024. Ubiquiti EdgeRouters have a user-friendly, Linux-based operating system that makes them popular for both consumers and malicious cyber actors. EdgeRouters are often shipped with default credentials and limited to no firewall protections ... Additionally, EdgeRouters do not automatically update firmware unless a consumer configures them to do so.

FBI boots Russian hackers out of Ubiquiti routers

Feds dismantle Russian GRU botnet built on 1,000-plus home, small biz routers
by Jessica Lyons of The Register   February 15, 2024
The US government today said it disrupted a botnet that Russia's GRU military intelligence unit used for phishing expeditions, spying, credential harvesting, and data theft against American and foreign governments and other strategic targets. The botnet was "well over a thousand" baby routers that had been infected with malware. The hacked routers were all from Ubiquiti running their Edge OS. Any child could have hacked these routers as they were using publicly known default passwords. Drunk driving. The Russians targeted US and foreign governments and military, security, and corporate organizations. The FBI removed the malware and modified the routers' firewall rules to block remote management of the routers.

• Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation's Main Intelligence Directorate of the General Staff (GRU) February 15, 2024 Press Release from the US Justice Department. There are lots of talking tough quotes here but it is useless drivel. The FBI says nothing about preventing this in the future. Nothing about changing the rules we live by so this does not happen again. Also, they say nothing about how to tell if your Ubiquiti router has been hacked.

JANUARY 2024

This was big

FBI disrupts Chinese botnet by wiping malware from infected routers
by Sergiu Gatlan of Bleeping Computer   January 31, 2024
This was covered everywhere. In brief:
--Chinese bad guys hack shitty home routers, typically those where the software is no longer updated. Newly found bugs in the abandoned router software makes these routers sitting ducks. They use these as the launching point for attacking critical US infrastructure. Since the attacks and/or scans seem to come from innocent locations, they don't raise as many red flags. The FBI was allowed to hack the hacked routers to remove the malware.
--What is not said is that US ISPs must be forced to provide security updates to any and all routers they provide to their customers. As things stand in the US, most ISPs are monopolies (in practice) so they can get away with providing the cheapest routers. In addition, private companies (Cisco, Netgear for example) must be forced to do something when they stop providing updates to their installed routers. And some minimum levels of security need to be enforced. But, due to the failed nature of the US Congress, no relevant law will ever happen, so the US will forever be vulnerable. That is the real news. One instance of malware on some routers is a grain of sand on the beach.
--Details about this grain: The FBI has disrupted the KV Botnet used by Chinese Volt Typhoon state hackers. Hacked routers included Netgear ProSAFE, Cisco RV320s, and DrayTek Vigor routers, as well as Axis IP cameras. The Chinese hacked roughly 30% of all Cisco RV320/325 devices in a month. The FBI director said the Chinese used the hacked routers to hit communications, energy, transport and water sectors. He also said that U.S. cyberdefense is badly outnumbered. Others reported this was part of a larger effort to compromise critical infrastructure, including naval ports, ISPs and utilities. In a useless statement, CISA and the FBI asked router vendors to please have their devices self-update and to only allow access to the web interface from the LAN by default. Oh, and make better software. Ha ha. Yes, they really said this. On a technical level, the FBI action was temporary, when the infected routers reboot, they will again be infected. No article discussed how a router owner can tell if their router is infected. And, not one of the articles listed below mentioned this website.

• FBI says it’s shut down sources of recent Chinese infrastructure hacks by Cate Cadell and Joseph Menn January 31, 2024.
• Exclusive: US disabled Chinese hacking network targeting critical infrastructure by Christopher Bing and Karen Freifeld for Reuters. They had the story first. updated February 1, 2024
• China's Hackers Have Entire Nation in Their Crosshairs, FBI Director Warns from the FBI. January 31, 2024. The FBI needs more money to fight hackers. Nothing about the need for new laws and new standards.
• U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure January 31, 202l Press release from the US Justice Department. We are doing good stuff. Nothing about the need for new laws and new standards.
• CISA: Vendors must secure SOHO routers against Volt Typhoon attacks by Sergiu Gatlan for Bleeping Computer. January 31, 2024. CISA asks vendors to please make better router software.
• Secure by Design Alert from CISA January 31, 2024. CISA asks vendors to please make more secure router software. Also, to make secure defaults and be transparent about bugs. Sadly, this is a useless plea from an agency with no enforcement power. Secure defaults means more tech support calls, so that will not happen without new and enforced laws. And being more transparent means a company with a router flaw in one model will have to test if the flaw is in their other 35 models. That too, will not happen just because CISA asks for it, sadly.
• Chinese malware removed from SOHO routers after FBI issues covert commands by Dan Goodin. Jan 31, 2024. Traffic passing between the hackers and the compromised devices was encrypted using a VPN module KV Botnet installed.

2023   top

OCTOBER 2023

If you don't patch your router firmware, bad guys are coming for you

IZ1H9 Campaign Enhances Its Arsenal with Scores of Exploits
by Cara Lin of Fortinet   October 9, 2023
Discovered by FortiGuard Labs, a Mirai variant they call IZ1H9, infects Linux-based networked devices turning them into remote-controlled bots for large-scale network attacks. Included in the targets of the malware are D-Link and Zyxel gear which remain vulnerable despite the availability of patches for the bugs being exploited. The malware has added new targets; Netis wireless routers, TP-Link Artcher, Totolink routers and others. The D-Link bugs being targeted for exploitation are CVE-2015-1187, CVE-2016-20017, CVE-2020-25506, and CVE-2021-45382. The TP-Link Archer AX21 bug being exploited is CVE-2023-1389. There is also a large range of related vulnerabilities that focus on TOTOLINK routers.

D-Link employee falls for scam

D-Link clears up 'exaggerations' around data breach
by Connor Jones of The Register   October 18, 2023
On October 1, a post on a hacking forum claimed to be selling 3 million lines of customer information. D-Link's public disclosure confirmed it became aware of the incident on October 2 and with the help of external investigators the company determined the actual number of stolen records to be around 700. D-Link says the data was not stolen from the cloud but instead originated from a test lab environment via a phishing attack on an employee. The stolen data was used for registration purposes. Assuming the best, assuming everything D-Link says is true, it still means that a D-Link employee fell for a scam. Makes me wonder about their employees competence.

• (Non-US) D-Link Corporation Provides Details about an Information Disclosure Security Incident from D-Link Oct 2, 2023

SEPTEMBER 2023

Chinese hackers target Cisco

People's Republic of China-Linked Cyber Actors Hide in Router Firmware
by the CISA department of the US government   September 27, 2023
A hacking group that CISA calls BlackTech has been modifying router firmware without detection and then exploiting the domain-trust relationships in the victim router to pivot from international subsidiaries to the headquarters of companies in Japan and the U.S. Targeted organizations include government, industrial, technology, media, electronics, telecommunication, and defense. The article makes it sound like the hacking comes from the LAN side and on the Security Checklist page on this site are a number of ways to lock down access to the router from the LAN side. The bad guys know so much about Cisco routers that they can conceal configuration changes, hide commands, and disable logging while doing their dirty work.

• US, Japan say 'BlackTech' Chinese government hackers exploiting routers during attacks by Jonathan Greig for The Record. September 27, 2023. The bad guys have exploited several brands of routers.

JULY 2023

Zyxel devices are not being patched, so they are being hacked left and right

Zyxel users still getting hacked by DDoS botnet emerge as public nuisance No. 1
by Dan Gooding of Ars Technica   July 21, 2023
Zyxel patched a bug on April 25th. But ... devices are still being hacked because network nerds are not installing the patch. The bug was rated 9.8 which translates to really bad. So many Zyxel devices are being hacked and used by bad guys that this bug is now considered public nuisance No. 1.

Botnet discovered consisting of thousands of infected routers

Routers from the Underground: Exposing AVrecon
by Danny Adamitis and Steve Rudd of Black Lotus Labs   July 12, 2023
Black Lotus Labs (a division of Lumen) discovered a large botnet targeting small-office/home-office routers. Which routers are being infected? They do not say. They claim this is a multi-year campaign involving compromised routers across the globe. The botnet deploys a Linux-based Remote Access Trojan (RAT) they call "AVrecon." The malware has been operating undetected for more than two years in part because owners of infected devices are not likely to notice a service disruption or a loss of bandwidth. They suspect that the botnet network exists to enable a range of criminal activities from password spraying to digital advertising fraud. By one measure, there are 70,000 infected machines. Looking at persistent infections, they found the malware at more than 40,000 IP addresses in more than 20 countries. While they don't say anything about which routers are infected, they have taken network level defenses: null-routing the command and control nodes and impeding traffic through the proxy servers. This renders the botnet inert across the Lumen backbone. What it does for the rest of the world, they do not say. They say the malware uses port 48102, but they not say if its TCP or UDP. And, they do not say if finding the port open is a reliable way to detect an infected device. So, this blog is perhaps more press release than useful information.

JUNE 2023

Now everyone sees the need for better router security

CISA Order Highlights Persistent Risk at Network Edge
by Brian Krebs of Krebs on Security   June 15, 2023
Quoting: "The U.S. government agency in charge of improving the nation’s cybersecurity posture is ordering all federal agencies to take new measures to restrict access to Internet-exposed networking equipment ... The order requires federal departments to limit access so that only authorized users on an agency's local or internal network can reach the management interfaces of these devices." Translation: better router security. This mandate follows a slew of high profile security bugs from Barracuda Networks, Fortinet (which makes Fortiguard products) and file transfer appliances from Forta (GoAnywhere) and Progress Software (MOVEit Transfer).

A black eye for Barracuda

CVE-2023-2868: Total Compromise of Physical Barracuda ESG Appliances
by Caitlin Condon of Rapid7   June 8, 2023
This is stunning. Background: The Email Security Gateway (ESG) from Barracuda Networks is software for filtering inbound and outbound email and (hopefully) protecting customer data. The Email Security Gateway can exist as a physical or virtual appliance, or in a public cloud on AWS or Azure. The hack described below (May 2023) turns out to be hard or impossible to mitigate with a patch. Thus, Barracuda is urging their ESG customers to immediately decommission and replace all ESG physical appliances irrespective of their patch level. Shocking. Quoting: "The pivot from patch to total replacement of affected devices is fairly stunning and implies the malware the threat actors deployed somehow achieves persistence at a low enough level that even wiping the device wouldn’t eradicate attacker access." As bad as this looks, Barracuda handled it better than HP handled the printers they broke with a firmware update. HP just put its head in the sand. Barracuda did not. Still, customers paid for security with ESG and got hacked instead.

• Barracuda Urges Replacing - Not Patching - Its Email Security Gateways by Brian Krebs June 8, 2023.
• Barracuda Email Security Gateway Appliance (ESG) Vulnerability from Barracuda. May 30, 2023. Updated June 7, 2023.

MAY 2023

What does 'security' really mean?

Critical Barracuda 0-day was used to backdoor networks for 8 months
by Dan Goodin of Ars Technica   May 30, 2023
This story does not involve a router, but it did let bad guys steal data via the network. Barracuda Networks is an IT security company. The bug was in their Barracuda Email Security Gateway and was due to incomplete input validation of user-supplied .tar files. In other words, lazy programming. The bug let bad guys install multiple pieces of malware for stealing sensitive data. A patch has been issued. In this case, having the Email Security Gateway installed, made you less secure.
Note: See above for an update on this.

• Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) from Barracuda. Issued May 19, 2023. Updated May 30, 2023.

Hack the routers, Hack the world

Chinese hackers breach US critical infrastructure in stealthy attacks
by Sergiu Gatlan of Bleeping Computer   May 24, 2023
Lots of router hacks in this story. Quoting: "Microsoft says a Chinese cyberespionage group it tracks as Volt Typhoon has been targeting critical infrastructure organizations across the United States ... since at least mid-2021. Their targets and breached entities span a wide range of critical sectors, including government, maritime, communications, manufacturing, information technology, utilities, transportation, construction, and education." The attacks start by hacking Fortinet FortiGuard devices, exploiting an unknown zero-day vulnerability. The hacked Fortinet devices give the bad guys Windows credentials through LSASS. This, in turn, lets the bad guys deploy web shells for stealing data and keeping a persistent presence on the hacked systems. And then, "To ensure that their malicious activity blends with legitimate network traffic to evade detection, Volt Typhoon employs compromised small office and home office (SOHO) network equipment from ASUS, Cisco, D-Link, Netgear, FatPipe, and Zyxel, such as routers, firewalls, and VPN appliances." So, there we have it. Shitty consumer routers are helping the Chinese hack critical US infrastructure. Ouch.

• Volt Typhoon targets US critical infrastructure with living-off-the-land techniques by Microsoft Threat Intelligence May 24, 2023.
• People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection This is a joint advisory from the FBI, NSA, CISA and cybersecurity agencies in Australia, New Zealand, the United Kingdom and Canada. The most common routers being hacked include ASUS, Cisco RV, Draytek Vigor, FatPipe IPVPN/MPVPN/WARP, Fortinet Fortigate, Netgear Prosafe, and Zyxel USG devices.

F--k Asus

Asus router outage is solved
by Dan Goodin of Ars Technica   May 19, 2023
Quoting: "Asus router users around the world took to the Internet to report that their devices suddenly froze up for no apparent reason and then, upon rebooting repeatedly, stopped working every few minutes as device memory became exhausted. Two days later, the Taiwan-based hardware maker has finally answered the calls for help. The mass outage, the company said, was the result of 'an error in the configuration of our server settings file.'" Let me translate: Exactly how they screwed up is none of your business. Quoting again: "After fixing the glitch, most users needed to only reboot their devices. In the event that didn't fix the problem, the company’s support team advised users to save their current configuration settings and perform a factory reset ... Asus still hasn’t provided details about the configuration error." So much went wrong here. (1) Why are Asus routers dependent on the configuration of an Asus server? (2) How did the problem happen? (3) Why did they not find the problem sooner? (4) What will they do so this does not happen again? (5) What exactly is the problem? (6) Which models are affected? Which feature(s) are causing the problems? Which firmware versions are susceptible to the bug? etc. etc. (7) the two day delay in saying anything and the corporate double-speak is insulting.
On the upside, anyone shopping for a router in the future now has a good feeling for just who and what Asus is, as a company.

• What Asus has to say for themselves: Interruption in Router Product Connectivity and Urgent Mitigation Measures May 18, 2023
• ASUS routers knocked offline worldwide by bad security update by Bill Toulas of Bleeping Computer. May 19, 2023

Yet again, a high end router (Fortinet) is vulnerable to attack

New Cactus ransomware encrypts itself to evade antivirus
by Ionut Ilascu of Bleeping Computer   May 7, 2023
Most of the article is focused on the Windows-based malware. But, it does include this: A new ransomware operation called Cactus has been exploiting vulnerabilities in VPN appliances for initial access to networks of 'large commercial entities.' Kroll believes that Cactus obtains initial access into the victim network by exploiting known vulnerabilities in Fortinet VPN appliances. It is not known which Fortinet bug the bad guys are exploiting. Perhaps new, perhaps old.

APRIL 2023

Yet another LAN-only protocol being abused on the Internet

SLP: a new DDoS amplification vector in the wild
by Alex Forster and Omer Yoachimik of Cloudflare   April 25, 2023
Quoting: "Service Location Protocol (SLP) is a "service discovery" protocol invented by Sun Microsystems in 1997. Like other service discovery protocols, it was designed to allow devices in a local area network to interact without prior knowledge of each other. SLP is a relatively obsolete protocol and has mostly been supplanted by more modern alternatives like UPnP, mDNS/Zeroconf, and WS-Discovery. Nevertheless, many commercial products still offer support for SLP." Just-published research by Pedro Umbelino at Bitsight and Marco Lux at Curesec documents a new DDoS reflection/amplification attack vector leveraging SLP. The bug is tracked as CVE-2023-29552. Since SLP has no method for authentication, it should never be exposed on the Internet. However, they discovered that upwards of 35,000 on-line devices have their SLP service exposed and accessible to anyone. Devices that speak SLP have two open ports: UPD port 427 and TCP port 427.

• New high-severity vulnerability (CVE-2023-29552) discovered in the Service Location Protocol (SLP) Written by Noah Stone, Research by Pedro Umbelino (Bitsight) and Marco Lux (Curesec). April 25, 2023.
  In February 2023, we detected more than 54,000 SLP-speaking devices. They were spread across more than 670 different product types and over 2,000 global organizations. Among the devices were VMware ESXi Hypervisor, Konica Minolta printers, Planex Routers, IBM Integrated Management Module (IMM), Supermicro IPMI servers, a ton of IBM gear and many others.
• CVE-2023-29552 Service Location Protocol-Denial of Service Amplification Attack by Marco Lux of Curesec. April 25, 2023. Not every SLP listening service is affected in the same way. During our research we have found different behaviors, depending on product, vendor or version. Early numbers in February 2023 showed 54.000 devices. Research of todays device alive revealed that at least 34.000 systems available with SLP and prone to the attack.
• Test TCP port 427 in your router
• Test UDP port 427 in your router

Cisco routers are being hacked by Russians abusing a bug fixed in 2017

US, UK warn of govt hackers using custom malware on Cisco routers
by Lawrence Abrams of Bleeping Computer   April 18, 2023
Russian hackers are targeting malware against Cisco IOS routers that are still being used despite their owner having walked away from them. The Russians are exploiting an SNMP flaw (CVE-2017-6742) that was patched in June 2017. This from a joint report from the UK National Cyber Security Centre (NCSC), US Cybersecurity and Infrastructure Security Agency (CISA), the NSA, and the FBI. SNMP is a protocol that lets network administrators monitor and configure network devices remotely. Not only are the hacked routers not being patched, but the flaw also requires poor configuration of SNMP itself. Makes me ashamed to be a computer nerd.

• APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers April 18, 2023. From CISA.
• Jaguar Tooth a PDF about the malware from NCSC
• Threat Actors Exploiting SNMP Vulnerabilities in Cisco Routers by Omar Santos of Cisco.

Used Enterprise Routers give away the keys to the Kingdom

Used Routers Often Come Loaded With Corporate Secrets
by Lily Hay Newman for Wired   April 18, 2023
Researchers from the security firm ESET bought 18 used routers made by Cisco, Fortinet, and Juniper Networks. They found nine were just as their previous owners had left them and fully accessible. Only five had been properly wiped. All nine of the unprotected routers contained credentials for the organization's VPN, credentials for another secure network communication service, or hashed root administrator passwords. All nine included enough identifying data to determine the previous owner. Eight of the nine included router-to-router authentication keys and information about how the router connected to specific applications used by the previous owner. Four devices exposed credentials for connecting to the networks of other organizations. Other security companies have repeatedly seen the same thing. Red Balloon Security was specifically mentioned in the article. A shit show. ESET tried to contact all the vulnerable organizations and some would not give them the time of day. There is said to be a resale market with millions of enterprise level networking devices. ESET will present a report on this at the RSA security conference in San Francisco next week.

How does this happen? Do networking techies not know how to reset the devices and they can't be bothered to look it up? Are they over-worked and too busy to spend the time resetting devices? Are they angry at their bosses and this is retribution? Or, has the job been farmed out to a third party that is supposed to reset the routers?

• Recycled Core Routers Expose Sensitive Corporate Network Info by Kelly Jackson Higgins of Dark Reading. April 18, 2023. An excellent article. Quoting: "Among the organizations whose information was exposed were a manufacturing company, a US law firm, managed services providers, an open source software firm, an events company, a telecommunications equipment supplier, a global data company, and a creative services company. The Silicon Valley software vendor was quick to respond ... The other organizations didn't have processes or even people available to handle the disclosure information..."
• Discarded, not destroyed: Old routers reveal corporate secrets by Cameron Camp and Tony Anscombe of ESET. April 18, 2023. A blog about their research. Quoting: "A concerning element of this research was the lack of engagement from companies when we attempted to alert them to the issue(s) ... Some were receptive to the contact, a few confirmed the devices had been passed to companies for secure destruction or wiping ... and others just ignored the repeated contact attempts."
• How I (could’ve) stolen your corporate secrets for $100 a 21 page PDF by Cameron Camp and Tony Anscombe of ESET. April 18, 2023.
• The Wired story was re-published by Ars Technica: Used routers often come loaded with corporate secrets by Lily Hay Newman April 19, 2023

Wi-Fi Design Flaw

Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues
by Domien Schepers, Aanjhan Ranganathan and Mathy Vanhoef from assorted universities   April 2023
The link is to PDF of a research report. The flaws described here are not in any one router or firmware, rather they are the result of omissions from the design specs for Wi-Fi itself. How serious this is is beyond my ability to judge. Quoting: "Wi-Fi devices routinely queue frames at various layers of the network stack before transmitting, for instance, when the receiver is in sleep mode. In this work, we investigate how Wi-Fi access points manage the security context of queued frames. By exploiting power-save features, we show how to trick access points into leaking frames in plaintext, or encrypted using the group or an all-zero key. We demonstrate resulting attacks against several open-source network stacks. We attribute our findings to the lack of explicit guidance in managing security contexts of buffered frames in the 802.11 standards." Traffic that is not encrypted is most at risk, that would be HTTP and old DNS. This offers a great chance to judge the company that made your router. The problems have to be fixed on their end. Do they say anything? Do they offer any suggested work-around? Will they update their firmware?

• This is the type of response you want from your router vendor:
  Vulnerabilities Announcement - Bypassing Wi-Fi Encryption by Manipulating Transmit Queues from Peplink. April 11, 2023. "Peplink has identified vulnerabilities in some of its products related to the manipulation of transmit queues in the 802.11 standards, regarding the Framing Frames research paper ... Stay tuned to this post as we will provide a list of affected models. To better prevent this attack, we recommend separating trusted and untrusted WLAN clients by using different SSIDs and VLAN networks and, enabling the 'Management Frame Protection'. "
• Researchers claim they can bypass Wi-Fi encryption (briefly, at least) by Paul Ducklin of Sophos Naked Security. April 3, 2023. The article offers an explanation of the two problems in simpler terms. The two issues both have to due with a Wi-Fi device that disconnects temporarily from the network, perhaps because it went out of range or it specifically tells the router that it is going to sleep. When this happens, routers save up any data for requests that were unanswered at the time the device went off-line. Turns out that this queued-up data is stored in decrypted form (decrypted in terms of WPA2 or WPA3, not in terms of HTTPS or secure DNS). This is done because when the offline device returns, there will be a new session key negotiated between the Wi-Fi device and the router. The researchers figured out various ways of tricking some routers into releasing those queued-up network packets to bad guys. It turns out that anyone can tell the router that you are going to sleep. Anyone. A bad guy scamming the router about your being asleep does not even need to know the Wi-Fi network password. Then, bad guys can pretend that they are the victim and tell the router the victim woke up from sleeping and they get sent any queued-up traffic left over from before. Numerous routers don't care that queued data that was originally requested in an encrypted format was now being released in unencrypted form. Then too, this research found another attack. The second attack requires that bad guys know the Wifi network password so its only good at public networks that publish it. The bad guys sent out spoofed packets to force the victim to disconnect from the network. Then, they quickly set up a spoofed new connection as the victim. Here they might be able to decrypt a few reply fragments queued up at the time of the disconnection.

New Router Checklist

13 Things You Should Do After Plugging In Your New Router
by Jason Fitzpatrick of How To Geek   April 11, 2023
On the whole not a bad article. But I disagree with a couple points targeted at people who have a combination modem/router from their ISP. It says "...you need to put your ISP’s combo unit into bridge mode." This is not true. Then it says "...you need to turn off the Wi-Fi radio in the ISP’s Wi-Fi router combo unit." Also not true. I would do neither of these things, at first. For one reason, they are not technically required. For another thing, it is best to live with the new router for a while before changing anything in the combination box.

MARCH 2023

Sonicwall devices infected with malware

Suspected Chinese cyber spies target unpatched SonicWall devices
by Jessica Lyons Hardcastle of The Register   March 9, 2023
"Suspected Chinese cyber criminals have zeroed in on unpatched SonicWall gateways and are infecting the devices with credential-stealing malware that persists through firmware upgrades, according to Mandiant ... It's unclear whether this malware campaign is related to earlier ransomware infections, which targeted some of these same devices in 2021." The vulnerable devices are the SonicWall Secure Mobile Access (SMA) 100 Series. So, not so secure after all. It is not known how the gateways (aka routers) were infected. A recent firmware release added more defensive features, stuff a "secure" device should have already had.

• SonicWall devices infected by malware that survives firmware upgrades by Bill Toulas of Bleeping Computer. March 9, 2023. The bad guys showed an intimate knowledge of how the buggy devices work.

Old DrayTek routers infected, but how?

DrayTek VPN routers hacked with new malware to steal data, evade detection
by Bill Toulas of Bleeping Computer   March 6, 2023
An ongoing hacking campaign called 'Hiatus' targets old DrayTek Vigor routers (models 2960 and 3900) that are end-of-life. The malware steals data from infected rotuers and builds a covert proxy network. This was discovered by Lumen's Black Lotus Labs and they are unable to determine how the DrayTek routers were initially compromised. Ugh. Black Lotus says that as of mid-February 2023, there were about 4,100 models 2960 and 3900 exposed on the internet. Of these, Hiatus had compromised approximately 100.

• New HiatusRAT router malware covertly spies on victims from Black Lotus Labs March 6, 2023

2022   top

DECEMBER 2022

Many routers hacked at the PWN2OWN contest

Multiple consumer routers were hacked by many different groups. One highlight is that Synology seems to have gotten the worst of it, the RT6600ax was hacked by many different groups. The contest involved hacking multiple types of devices, only the router exploits are shown below. All the routers were running the latest firmware. To me, the take-away from this is to avoid consumer routers.

• PWN2OWN TORONTO 2022 - DAY ONE RESULTS by Dustin Childs   December 6, 2022.
  1. Tri Dang and Bien Pham from Qrious Secure were able to execute a two bug (authentication bypass and command injection) attack against the WAN interface of the TP-Link AX1800
  2. Gaurav Baruah was able to execute a command injection attack against the WAN interface of the Synology RT6600ax
  3. Computest was able to execute a command injection root shell attack against the LAN interface of the Synology RT6600ax
  4. Interrupt Labs was able to execute two bugs (SQL injection and command injection) against the LAN interface of the NETGEAR RAX30 AX2400
  5. DEVCORE became the first team to successfully execute two different Stack-based buffer overflow attacks against a Mikrotik RB2011 router and a Canon printer in the SOHO SMASHUP category.
  6. Claroty Research was able to execute five different bugs in an attack against the LAN interface of the NETGEAR RAX30 AX2400 router
  7. Neodyme executed an attack using three bugs against a NETGEAR router and an HP printer
  8. NCC Group EDG was able to execute a command injection attack against the LAN interface of the Synology RT6600ax. However, the exploit they used was seen earlier in the competition.
  9. Tri Dang from Qrious Secure exploited the LAN interface of the NETGEAR RAX30 AX2400 using a bug that had been seen earlier in the contest
  
  
• PWN2OWN TORONTO 2022 - DAY TWO RESULTS by Dustin Childs   December 7, 2022.
  1. PHPHooligans executed two exploits against the WAN interface of the NETGEAR RAX30 AX2400. The exploits they used were previously used in the competition.
  2. Bugscale was able to successful launch an attack against the Synology router and HP Printer
  3. Team Viettel was able to execute a Command Injection, Root Shell attack against the LAN interface of the TP-Link AX1800 router
  4. Summoning Team was able to execute a command injection attack against the LAN interface of the Synology RT6600ax. The exploit they used was used earlier in the competition.
  5. NCC Group EDG was able to successfully launch an attack against the WAN interface of the NETGEAR RAX30 AX2400 using one unique bug and another N-day.
  
  
• PWN2OWN TORONTO 2022 - DAY THREE RESULTS by Dustin Childs   December 8, 2022
  1. STAR Labs was able to execute their SOHO SMASHUP attack ... against the Synology RT6600ax and the Canon printer. The exploits they used were seen previously.
  2. Team Viettel launched a successful attack with one unique and one known bug against the Cisco C921-4P router
  3. Qrious Secure launched a successful attack with 2 unique and 1 N-day bug against the WAN interface of the NETGEAR RAX30 AX2400.
  
  
• PWN2OWN TORONTO 2022 - DAY FOUR RESULTS AND MASTER OF PWN by Dustin Childs   December 9, 2022
  1. The NCC Group was able to execute an RCE attack against the WAN interface of the Synology RT6600ax router. The exploit they used was previously used in the contest.
  2. The Sonar team successfully demonstrated an exploit of the WAN interface of the Synology RT6600ax. The bug they used had been previously demonstrated.

OCTOBER 2022

TP-Link does it wrong

TP-Link network equipment hijacks some DNS requests
by Daniel Aleksandersen   October 15, 2022
Non techies trying to get at the web interface of a router often have to address the router by its IP address, which can be too difficult for them. As a result, many hardware vendors offer names for their LAN-resident routers. For example, Asus uses router.asus.net and Netgear uses www.routerlogin.com. Everyone but TP-Link offers this feature using DNS which is fine. TP-Link implemented this feature using deep packet inspection. They intercept everything on UDP port 53 in a kernel module, which is asking for trouble. When they find one of their easy-to-use names, such as tplinkwifi.net, they return the LAN side IP address of their router or Access Point. But, the kernel module is configurable so a bad guy can permanently use it for domain hijacking. And, this is just wrong.

AUGUST 2022

Eero is such a privacy invasion that expert does not want to even review it

Your Router and Online Privacy Risks: Be Aware of that Hidden Potential Danger
by Dong Ngo of Dong Knows Tech   August 9, 2022
Mr. Ngo regularly reviews routers. Quotes from the article: "... I tend to mention the "online privacy risks" in increasing instances in the past couple of years. And the case of the eero Pro 6E must have been the crescendo on this front ... I was so concerned about the privacy risks that, for the first time, I didn't even want to test it. ... Your Wi-Fi router ... can keep tabs on everything you do online, all the websites you’ve visited, and your other activities, such as shopping, streaming, chatting, texting, and so on. If you use a router that doesn’t allow direct access to how it works or limited access, you don’t know what it really does with your information. And if you use a router made by a company that forces you to log in via an account before you can manage your network, your privacy is generally at the mercy of that company. In this case, it’s like you actively report your every move to a third party. And this is the scariest part: That happens completely without your direct knowledge. There’s no visual, warning, or ID checking, not a fist bump or a wink. It’s total unawareness. ... popular networking vendors like Asus, Netgear, TP-Link, Ubiquiti, etc., are independent and relatively small companies. Consequently, their data collection and the collected data are somewhat limited in scope and pervasiveness. ... On the other hand, eero is owned by Amazon, which already has lots of data on its users ... So if you’re an Amazon prime user and use an eero router, your exposure (to Amazon) is much higher than if you have a router from another networking vendor. Come to think about it, the only reason Amazon bought eero in early 2019 might have been because it wanted the user data the then-boutique networking company had designed its routers to collect. It wanted to hook deeper into the home, so to speak."
Not mentioned in this article, Mr. Ngo has also suggested avoiding Google routers for the same privacy reasons.

JULY 2022

DD-WRT and Asus can not be bothered fixing bugs

Vulnerability Spotlight: How a code re-use issue led to vulnerabilities across multiple products
by Francesco Benvenuto of Cisco Talos   July 27, 2022
Talos found three vulnerabilities in open-source router firmware packages. The root cause in each case was a piece of code that had been taken from an open-source library owned by Broadcom. In each case, a specially crafted HTTP request can lead to memory corruption. All three router firmware vendors were contacted on April 11, 2022. FreshTomato issued a patch on May 6th. DD-WRT has not yet issued a patch. The bug also exists in Asus routers, both those running ASUSWRT (factory installed firmware) and the open-source firmware alternative known as Asuswrt-Merlin.

• As per this forum posting this has been fixed in AsusWrt-Merlin as of version 386.7.

JUNE 2022

New malware targeting routers

ZuoRAT Hijacks SOHO Routers To Silently Stalk Networks
by Black Lotus Labs   June 28, 2022
The malware seems to be using existing, known bugs to infect the routers. The routers are being hacked from the LAN side by malware running on Windows PCs. Some routers can limit the LAN side devices that are allowed to communicate with the web interface. If yours can, its worth looking into. They found infections in these routers: Cisco RV 320, 325 and 420, Asus RT-AC68U, RT-AC530, RT-AC68P and RT-AC1900U, DrayTek Vigor 3900 and some unspecified NETGEAR devices. The malware does not survive a re-boot of the router, so just as the home page of this site has suggested for a long time, periodic reboots are a good idea. The malware does lots of bad stuff. Black Lotus Labs is the threat intelligence division of Lumen Technologies. They "have a narrow view" of the full extent of what the malware can do. That said, they are sure that it does DNS and HTTPS hijacking. Only routers with a MIPS processor are vulnerable. One defense: The malware tries to learn the public IP address of an infected router by calling out to whatsismyip.akamai.com, ident.me, myipdnsomatic.com and ipecho.net. If these calls fail, the malware deletes itself under the assumption that it is being run in an isolated sandbox. If you can, block these websites in your router.

• A wide range of routers are under attack by new, unusually sophisticated malware by Dan Goodin for Ars Technica June 28, 2022

More Kaspersky on router security

The hidden threats of router malware
by Leonid Grustniy of Kaspersky   June 8, 2022
Discusses some things that bad guys do with an infected router, such as: joining it to a botnet for DDoS attacks, steal your data and redirect you to pages with ads or malicious sites instead of the ones you want to visit.

Kaspersky on router security

Router security in 2021
by Maria Namestnikova of SecureList   June 8, 2022
Quoting: "According to cve.mitre.org, the number of vulnerabilities discovered in various routers, from mobile to industrial, has grown over the past decade. However, with the mass shift to remote working, it went off the scale. During 2020 and 2021, more than 500 router vulnerabilities were found. The nvd.nist.gov website presents different figures, but they too show a significant increase in the number of router vulnerabilities found in 2020 and 2021 ... Unfortunately, not all vendors are rushing to fix even critical vulnerabilities. At the time of writing, of the 87 critical vulnerabilities published in 2021, more than a quarter remain unpatched and unreported by the vendor...

APRIL 2022

WatchGuard can not be trusted to do the right thing

WatchGuard waited 11 months to explicitly disclose critical flaw exploited by Sandworm
by Dan Goodin of Ars Technica   April 6, 2022
You buy the hardware for increased security, and it ends up lowering your security. A critical bug in WatchGuard firmware was fixed in May 2021 without a warning to customers of just how important it was. Quoting: "...the company made only the most oblique of references to the vulnerability". Months after the fix was released, the FBI told WatchGuard that their devices were being hacked. Still, no critical notice went out to WatchGuard customers. The company did not disclose the flaw until it became known that Russian hackers exploited it en masse to assemble a massive botnet.

FBI fights back against Russian bad guys

Companies were slow to remove Russian spies' malware, so FBI did it for them
by Dan Goodin of Ars Technica   April 6, 2022
There is a story below (March 2022) about Russian malware called Cyclops Blink infecting Asus routers. It also infected WatchGuard network firewalls, months before the Russians started hacking Asus routers. In February 2022 this became public, but not many WatchGuard devices were cleaned up or updated with new firmware. So, to disrupt the botnet the FBI killed the Command and Control servers. This article makes it sound like the FBI cleaned up infected WatchGuard devices. They did not.

• Justice Department Announces Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate April 6, 202
• Feds take down Kremlin-backed Cyclops Blink botnet by Jessica Lyons Hardcastle of The Register April 6, 2022

New bugs in TOTOLINK routers exploited immediately

Beastmode botnet boosts DDoS power with new router exploits
by Bill Toulas of Bleeping Computer   April 1, 2022
Botnet operators make money both by selling DDoS services and by launching attacks against firms and asking for a ransom to stop. The Beastmode botnet added five new exploits within a month, three of them targeting various TOTOLINK routers. TOTOLINK has released updated firmware for the buggy routers. Good thing too as the bugs are rated critical (CVSS v3 score of 9.8), enabling bad guys to take full control of vulnerable devices which are the A800R, A810R, A830R, A860R, A950RG, A3000RU, A3100R, A3600R, A7100RU N600R, T6, and T10. The botnet also takes candy from a baby - targeting EoL D-Link products (DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L and DIR-836L) that are vulnerable and will never be updated. It also tries to abuse the Huawei HG532 router using a bug from 2017. The botnet also picks on TP-Link Tapo C200 IP camera and the Netgear ReadyNAS line.

• Fresh TOTOLINK Vulnerabilities Picked Up by Beastmode Mirai Campaign by Joie Salvio and Roy Tay of FortiGuard Labs April 1, 2022

MARCH 2022

Critical bug in Sophos Firewall

Resolved RCE in Sophos Firewall (CVE-2022-1040)
by Sophos   Last Updated April 5, 2022
The Sophos Firewall is for the big boys, as such I have never even seen one. But, it has had its share of security flaws and this one was a doozy. An authentication bypass flaw allows bad guys to get remote code execution. It has been fixed. Interestingly, the firmware has an "Allow automatic installation of hotfixes" feature that is enabled by default. It causes the firewall to check for critical bug fixes every 30 minutes. Cool. To their credit, Sophos updated some firmware that was End of Life. They also informed some of their customers that they had been hacked.

• Critical Sophos Firewall vulnerability allows remote code execution by Ax Sharma of Bleeping Computer March 27, 2022. The article details earlier bugs in Sophos software.
• Chinese APT groups targeting India, Pakistan and more with Sophos firewall vulnerability The Record June 17, 2022

This is why VLANs matter

Wyze patches serious flaws on its security cameras, but not its oldest one - what you need to know
by Paul Wagenseil of Toms Guide   March 29, 2022
Wyze cameras are buggy and the company took a very long time to issue fixes. Heck, for months Wyze would not even communicate with BitDefender, which reported the problems. The oldest version of the camera (version 1) was released in 2017 and will not be fixed (EoL). Details aside, this is exactly why VLANs are so important. It is probably best to keep any camera in its own VLAN, isolated from everything else in your home/office. Also, a router with outbound firewall rules can block the camera from phoning home, keeping the video in your home/office. Or, maybe, restrict where the camera is allowed to communicate on the Internet. As for details, BitDefender found three bugs: an Authentication bypass, a Remote control execution flaw and Unauthenticated access to contents of the SD card. If you have a Wyze Cam check the bottom of the camera. Version 2 units say "v2" while the EoL version 1 says nothing.

• Wyze Left Some Security Cameras Vulnerable to Hackers - But Its Complicated by Andrew Heinzman of Review Geek March 31, 2022
• Wyze Cam flaw lets hackers remotely access your saved videos by Bill Toulas March 29, 2022
• Vulnerabilities Identified in Wyze Cam IoT Device by Bitdefender March 29, 2022

Russian bad guys targeting Asus routers

ASUS warns of Cyclops Blink malware attacks targeting routers
by Bill Toulas of Bleeping Computer   March 17, 2022
Russia has plenty of bad guys. Even with many of them killing Ukrainians, they still have enough left over to hack Asus routers. 18 different ASUS models are vulnerable to hacking by the Cyclops Blink malware which comes from a well known group of Russian bad guys known as Sandworm. If Cyclops Blink installs itself, it will persist as it gets written into flash memory. Factory reset does nothing. The malware was discovered infecting Asus routers by Trend Micro which warned: "If it is suspected that an organization’s devices have been infected with Cyclops Blink, it is best to get a new router." Asus has not issued bug fixes. Three buggy Asus routers will not get fixes because they are too old (EoL) to bother with: RT-AC87U, RT-AC66U and RT-AC56U. As is often the case, one defense is to disable remote administration. Trend Micro said "...the spread of Cyclops Blink appears indiscriminate and widespread". Just like Russian bombing in Ukraine. They also warn that the bad guys can adapt their malware for other routers. One defense not suggested is to block the Google DNS server at 8.8.8.8 because the malware uses it.

• Asus security advisories The first advisory was dated March 17, 2022. That no longer exits. The latest advisory on this subject is dated April 1, 2022.
• Cyclops Blink Sets Sights on Asus Routers by: Feike Hacquebord, Stephen Hilt and Fernando Merces of Trend Micro March 17, 2022. The report includes a list of more than 150 current and historical command-and-control servers of the Cyclops Blink botnet.

A great reason to avoid TP-Link routers

Newer TP-Link Routers send ALL your web traffic to 3rd party servers
by Reddit user ArmoredCavalry   March 11, 2022
The Wire Cutter loves TP-Link routers. They are children playing a game meant for adults. This is a great reason to avoid TP-Link routers. Not only the initial find, but also the delay in dealing with the issue and the responses from the company which deal with a third of the issue. TP-Link embeds security software from Avira in some (many?) of their routers. The system is, ironically, called Safe Things and Home Shield. It was discovered that a TP-Link router sent 80,000 DNS requests in 24 hours to Avira Safe Things subdomains. The router was not configured to use the Avira software. Yet.... TP-Link has known about the bug since at least May 2021 but no fix had been issued. Then, this got some traction on Reddit and now TP-Link has beta software. The new software has not been verified to fix any of the three real issues (why call Avira at all, why call Avira so many times, what privacy issues are there with letting Avira spy on router activity). Asus includes security software from Trend Micro and they too had privacy issues.

• TP-Link Deco X68 Review: A good mesh router ruined by bizarre software by Corbin Davenport of XDA developers. May 25, 2021. He found the same issues. The Deco X68 was sending network requests to domains owned by Avira almost every minute. There was no explanation in the app that this is happening, nor was there an option to turn off the data transmissions. Of course not. The router also sent over 20,000 of requests to ifconfig.me, a website for identifying your public IP address.
Advisory for Frequent DNS Requests on Related Routers from TP-Link. Updated March 23, 2022. Barely explains the issues. Clearly focuses on the looping problem and conveniently saying nothing about two other issues. Their attitude is that their customers don't need to know details.
• Avira SafeThings from Avira
• Beware: TP-Link routers apparently sending customer data to Avira without user consent by Sayan Sen of NeoWin March 12, 2022
• Avira and TP-Link Join Forces to Offer Wi-Fi Routers with IoT Security for the Smart Home Avira press release. September 2019

MikroTik problems linger

Microsoft creates tool to scan MikroTik routers for TrickBot infections
by Bill Toulas of Bleeping Computer   March 17, 2022
Microsoft released a forensics tool named 'routeros-scanner' that network administrators can use to scan MikroTik devices for signs that it was compromised by TrickBot malware. It has been several years since MikroTik warned about the existence of critical flaws, yet hundreds of thousands of MikroTik routers are still vulnerable to malware botnets. One thing to look for is open ports 449 and 8291.

• Uncovering Trickbot's use of IoT devices in command-and-control infrastructure by the Microsoft Defender for IoT Research Team March 16, 2022
• Trickbot is using MikroTik routers to ply its trade. Now we know why by Dan Goodin for Ars Technica March 17, 2022

The Dutch do Router Security Right

Russian state hackers target Dutch routers: Volkskrant
by DutchNews.nl   March 3, 2022
The two most interesting aspects of this story to me: (1) The Dutch told victims about their routers having been hacked and (2) they advised that the hacked routers should be thrown away. Well done. A Russian hacking group known as 74455, Sandworm and BlackEnergy, has been targeting Dutch routers belonging to private individuals and small and medium sized businesses. The bad guys are part of the Russian intelligence service. It is not clear if the hacking is linked to the war in Ukraine. The number of hacked routers is not known. All this came to light due to an investigation by the Dutch military intelligence agency MIVD. The malware on the routers communicates with other Russian controlled computers in a network which is used for sabotage, spying and the spread of fake news. And, of course, routers that allow outside access are particularly vulnerable.

FEBRUARY 2022

Wuddya Know? Routers spy on you

Your Router Is Collecting Your Data. Here's What to Know, and What You Can Do About It
by Ry Crist of CNET   February 25, 2022
First of all, my router is not collecting any data about me. CNET lives in the fishbowl of consumer routers. There is a bigger world. Crist reviewed the privacy policies for D-Link, Netgear, Asus, TP-Link, Eero, Google Nest and Arris (really CommScope). Every one confirmed that the company in question collected personal data for the purpose of marketing. All the companies also acknowledged that they share user data with third parties for marketing purposes. Such are consumer routers, one reason to look into secure routers. Crist wasted much of the article looking into whether a router tracks web activity. There is no one answer to that question as parental controls and assorted security features require the inspection of web traffic. Points of note:
 --Asus and Google Nest were the only companies that let you opt out of data collection
 --D-Link refused to answer questions about privacy
 --best for opting out of data collection: The Motosync app for Motorola routers (run by Minim) has a very clear option
 --worse: D-Link and TP-Link, which do not offer any direct means of opting out
 --worst: Eero. The only way to stop Eero devices from gathering data is to not use them.
The Asus instructions for opting out in the article are wrong. The correct path to the option is Advanced Settings -> Administration -> Privacy tab. This is what it looks like. The defensive steps in the article are incomplete. The most obvious omission is to use a VPN or Tor. Both hide activity from the router, just as they do from the ISP. Another option is to use a router with a web interface rather than a mobile app.

Watch out for WatchGuard routers

New Sandworm malware Cyclops Blink replaces VPNFilter
by UK National Cyber Security Centre   February 23, 2022
Once upon a time there was a bug in WatchGuard routers. The company fixed it in May 2021. Still un-patched routers are being infected by bad guys in Russia, specifically part of Russia's GRU military intelligence agency. Not only have the nerds in charge of administering the boxes not installed bug fixes, they also left the buggy routers open to unrestricted remote administration without any of the available security options that WatchGuard provides for restricting remote access to the boxes. You could make a case that the techies doing defense are just as much, if not more, at fault that the Sandworm malware authors. The malware was first seen about three years ago and has been dubbed Cyclops Blink. It abuses the firmware update mechanism to allow it to remain running even if the box is re-booted. Currently only WatchGuard devices have been infected, but the NCSC warns that it could be adapted to other platforms.

• Cyclops Blink from WatchGuard
• Cyclops Blink FAQs from WatchGuard
• Russia’s most cutthroat hackers infect network devices with new botnet malware by Dan Goodin for Ars Technica Feb 23, 2022
• Russia’s Sandworm Hackers Have Built a Botnet of Firewalls by Andy Greenberg Feb 23, 2022.

JANUARY 2022

UPnProxy Follow-Up - still bad

UPnProxy: Eternal Silence
by Chad Seaman of Akamai   January 27, 2022
Discovered by Akamai, a bug called UPnProxy is still alive and well, six months after they first publicized it. When abused, it attempts to expose TCP ports 139 and 445 on devices connected to the targeted router. Out of 3,500,000 UPnP routers found online, 277,000 are vulnerable to UPnProxy, and 45,113 of them have already been infected by hackers. This is yet another reminder that consumer routers ship with UPnP enabled by default to cut down on tech support requests. Peplink and pcWRT routers ship with UPnP disabled. Many devices were found vulnerable, including some from Asus, D-Link, Belkin, DrayTek, Edimax, HP, Monoprice, Netis, Netgear, Ubiquiti, SMC, ZyXel, ZTE. Also versions of OpenWRT are vulnerable.

• UPnProxy: Blackhat Proxies via NAT Injections by Akamai. A 20 page PDF.
• Hundreds of thousands of routers exposed to Eternal Silence campaign via UPnP by Pierluigi Paganini of Security Affairs. January 31, 2022

Hacking an Optilink fiber router

The Story of How I Hacked my ISP’s Cheapo Standard Issue Router
by secnigma   January 2, 2022
Hacking an Optilink 91001w ONU (Optical Network Unit) in India. Optilink is a rebrand of C-DATA which proved helpful. The webserver running in the router was Boa which was mainly used in embedded devices back in the 2000’s. Development stopped on the software back in 2005. You can't make this stuff up. He found a command injection flaw using the back tick character to execute Linux system commands. The vendor does not share the firmware to the public. To upgrade, the customer has to contact the vendor directly, and they arrange a remote session to upgrade the router. Wow. He eventually found a password file and cracked the hash to reveal two hardcoded backdoor credentials.

2021   top

DECEMBER 2021

Support for Google OnHub routers being discontinued

Google is killing off its OnHub routers, easing the pain with Nest Wifi discounts
by Taylor Kerns of Android Police December 20, 2021
On December 19, 2022 support for Google OnHub routers is ending. The routers will still function, but owners will not be able to make any configuration changes, such as changing the Wi-Fi password. Google is offering owners of an OnHub router a 40 percent discount on their latest routers. The good news is that Google is being up-front and honest about this which is probably better than most consumer routers. And, roughly 7 years of bug fixes is not bad, as routers go. To me, the important issue is that it shows how important it is to be able to configure a router locally without depending on a cloud service. Fewer and fewer routers offer a full LAN side web interface. Mobile apps are the fashion. Another issue some cloud dependent routers have is that they kill LAN side communication when they are off-line.

• Support for OnHub routers ending in 2022 by Google
• Google will kill OnHub routers next year - what you need to do by Paul Wagenseil for Toms Guide Dec. 23, 2021
• Google OnHub router will join Google’s list of dead products next December by Ars Technica Dec. 21, 2021

Netgear is removing the remote administration feature

Quietly, Netgear Kills Web-based Remote Management, Pushing Mobile Apps
by Dong Ngo in his own blog   Dec 21, 2021
I once returned a Netgear router because it only supported HTTP (and not HTTPS) for remote administration. So, clearly, they never cared much about it. Judging by the screen shot in this article, it seems this is still the case, although they do let you change the port and limit the source IP address. If remote administration (Netgear calls it remote management) is disabled, then a firmware update may remove the feature altogether. And, the latest routers don't have remote administration at all. Quoting: "The company didn’t make any announcements or provide any guidelines. Instead, it simply excludes the feature from its new routers starting this year". This is not what you want from your router company. Without the feature, Netgear customers have to use a Netgear mobile app which requires a Netgear account. Ngo writes: "... Netgear is the only one who stands to benefit from this development. The more users who use the apps, the more ... valuable data it can collect from its users ..." Perhaps this is the real motivation.

Vulnerable un-patched MikroTik routers

300,000 MikroTik routers are ticking security time bombs, researchers say
by Dan Goodin of Ars Technica   December 9, 2021
Security firm Eclypsium has found roughly 300,000 on-line un-patched and vulnerable routers made by Latvia-based MikroTik. The three missing patches were discovered and fixed in the past three years. It is as if these routers were abandoned. Needless to say, MikroTik routers do not auto-update. See also a September 2021 item below.

• When honey bees become murder hornets. The original report from Eclypsium. December 9, 2021

OCTOBER 2021

Hacked routers used by Russians to attack US Government

Russian Hackers Used Home Networks to Evade Detection
by William Turton of Bloomberg   October 26, 2021
The term "Home Networks" in the title of the article refers to hacked routers. So A "residential IP proxy" is a hacked router. Bad guys hack routers and then sell access to the routers. The victimized routers are modified in a way that they forward data packets. Thus, a hacking attempt by the Russian Foreign Intelligence Service, that starts in Russian, appears to come from 123 Main Street in Denver, Colorado. This simple concept is hidden behind the terminology used in the article.When it comes to guessing passwords, access to hacked routers is doubly important. Rather than make many guesses from the same public IP address, bad guys can scatter their guesses across a range of locations. To be a broken record, I recommend avoiding any router from an ISP and also avoiding consumer routers.

Proof that Wi-Fi passwords need to be long

70% of Wi-Fi networks are easy to hack - how to protect yourself
by Paul Wagenseil of Toms Guide   October 28, 2021
Ido Hoorvitch1 of CyberArk walked around his neighborhood and sniffed information from 5,000 thousand Wi-Fi networks. He took this data back to his office and, using hashcat, was able to calculate the password for 70 percent of the Wi-Fi networks. He used a relatively new Wi-Fi attack on WPA2 Personal. He did not say if it the attack will work on WPA2 Enterprise or WPA3. The attack is based on recording the SSID, the hash of the PMKID, the MAC address of the router and the MAC address of a router client. A PMKID is used for roaming between Access Points. If you have a single router, there is no need for a PMKID, yet it was often present. He offered no advice on determining if your router is broadcasting a PMKID. The cracked passwords were often just numbers or just lower case letters. The lesson to be learned is that longer passwords and varied (not random) password are more resistant to this type of brute force attack.

• Cracking WiFi at Scale with One Simple Trick the original research by Ido Hoorvitch. October 26, 2021.
• More technical details on the bug that was exploited: New attack on WPA/WPA2 using PMKID by Atom. August 4, 2018
• My advice on choosing Wi-Fi passwords

Asus AX56U router hacked twice

Windows 10, iOS 15, Ubuntu, Chrome fall at China's Tianfu hacking contest
by Catalin Cimpanu of The Record   October 17, 2021
The Tianfu Cup is the largest and most prestigious hacking competition in China. At the event, the ASUS AX56U router was hacked by two different teams. I could not find anything on what the bug was and whether Asus will ever fix it or not.

• Asus RT-AX56U router. It looks nice, with a bit of a Darth Vader feel to it.
• The ASUS Product Security Advisory is a list of security bugs in Asus products. As of October 28, 2021, the last posting for any router was May 2021.

A TP-Link router was hacked for years

Botnet abuses TP-Link routers for years in SMS messaging-as-a-service scheme
by Catalin Cimpanu of The Record   October 7, 2021
Since at least 2016, bad guys have hijacked the 4G-capable TP-Link MR6400 router. The problem came to light when a large number of outgoing SMS messages sent from the SIM card in the router caused high phone charges. The theory is that the bad guys organized the hacked routers into a botnet, and made a business of sending cheap SMS messages. It is thought that the routers were compromised using a vulnerability disclosed in 2015 that provided access to the files on the router. The bug was fixed but many of the routers remain unpatched, even to this day. This research was done by Robert Neumann of Acronis and Gergely Eberhard of Search-Lab. Abuse of the botnet peaked in 2018 and is still ongoing but at a reduced level.

• TP-Link MR6400 router
• From match fixing to data exfiltration - a story of Messaging as a Service (MaaS) a conference presentation by Robert Neumann and Gergely Eberhardt

SEPTEMBER 2021

Hacked MikroTik routers used in HUGE botnet

Meet Meris, the new 250,000-strong DDoS botnet terrorizing the internet
by Catalin Cimpanu of The Record   September 10, 2021
The Meris botnet broke the record for the largest volumetric DDoS attack twice this summer. It is estimated that the botnet consists of around 250,000 infected devices, most from MikroTik. MikroTik is a small Latvian company that sells routers, IoT gateways, WiFi access points, switches and the like. It seems like the bug being abused is old. The company said: "As far as we have seen, these attacks use the same routers that were compromised in 2018, when MikroTik RouterOS had a vulnerability, that was quickly patched. Unfortunately, closing the vulnerability does not immediately protect these routers. If somebody got your password in 2018, just an upgrade will not help. You must also change password ... We have tried to reach all users of RouterOS about this, but many of them have never been in contact with MikroTik and are not actively monitoring their devices ...There are no new vulnerabilities in these devices."

• Mēris botnet, climbing to the record by Qrator (a security firm) September 9, 2021
• Meris Botnet blog by MikroTik (Sept 15, 2021). Quoting: "As far as we have seen, these attacks use the same routers that were compromised in 2018, when MikroTik RouterOS had a vulnerability, that was quickly patched ... closing the old vulnerability does not immediately protect these routers. If somebody got your password in 2018, just an upgrade will not help. You must also change password, re-check your firewall if it does not allow remote access to unknown parties, and look for scripts that you did not create."

JULY 2021

Hacked routers used to attack French organizations

Home and office routers come under attack by China state hackers, France warns
by Dan Goodin of Ars Technica   July 21, 2021
The French National Agency for Information Systems Security (abbreviated as ANSSI) warned that China state hackers are compromising large numbers of routers for use in a vast and ongoing attack against organizations in France. The compromised routers give the attackers anonymity and are used while carrying out reconnaissance and attacks. One defense of a router is to periodically restart it, since most router malware is unable to survive a reboot.

• Indicators of Compromise from ANSSI Juillet 21, 2021

Asus router fails to get online

by me   July 1, 2021
I am setting up and configuring an Asus AC1900P router. I started in early May and was forced to chose between beta firmware and known buggy firmware. I blogged about this here: Asus router firmware: How do you prefer your bugs? New or Old?. By the end of June there was new firmware (version 3.0.0.4.386_43129) which I installed. As I suggest on the New Router page, the router was not directly connected to the Internet, instead it was on my LAN. Specifically, its WAN port was connected to a LAN port of my existing router. The problems began immediately and I will not bother with most of the details. What I thought was a minor thing, turned out to be, I think, the one problem from which all others stemmed: the router incorrectly thought it was off-line. Eventually, it occurred to me to validate this using the tools built into the firmware, specifically at Network tools -> Network analysis. First, I pinged a couple websites and all was well. Then I ran a couple nslookup commands and, again, all was well. As expected, the DNS server was that of my existing router. Then, I tried netstat. Just after a cold boot, with no device connected to the router (other than a computer on my LAN that logged into it via Ethernet Remote Access) this screen shot shows the router was very much involved with a.applovin.com. Applovin does mobile app advertising and because of this, a.applovin.com was blocked on my LAN. The previous firmware (beta version 9.0.0.4.386.41994) ran just fine on the same LAN. The firmware history shows that the current firmware (version 3.0.0.4.386_43129) is twice the size of the previous firmware. A lot must have changed.
I posted a question about this on Reddit and got no response. I also posted a question about it on the SmallNetBuilder forum, and got no useful response. Asus has no forum (that I could find).
Update July 2, 2021: The router is not involved with applovin.com. The domain a.applovin.com was blocked via DNS, specifically, a query for that sub-domain returned an IP address of zero. Many domains on my LAN are blocked this way, a.applovin.com is the first when sorted alphabetically. After testing again today, I ran netstat with the option to resolve names disabled. This showed many connections to IP address zero. When trying to get a name for IP address zero, netstat must have been given a.applovin.com by the main/outer router. Still, the router thinks it is off-line. The main page displays its LAN IP address (192.168.1.something) for a second, then complains about being disconnected. My testing today included a log of all outgoing packets from the router. The log showed that the router made a UDP request to port 19302 at IP address 172.217.215.127 which belongs to Google. A previous log of all router activity as it starts up also showed a UDP request to port 19302, but that time, the IP address was 108.177.122.127. This too is Google. In each case, these were the only requests the router made to the Internet. Researching the UDP port, I learned that it is used by Google STUN servers and can provide the client (the Asus router) with its public IP address. In both instances, the router made these Google STUN requests 8 seconds after it was assigned a LAN side IP address by the other router. The Asus router log file includes this message "WAN Connection: ISP's DHCP did not function properly." Clearly there is a bug in how the router determines if it is online or not. What to do? I changed the WAN type from DHCP to Fixed IP address and assigned it the same LAN-side IP address it was already using. After a reboot, all was well. What a pain.

JUNE 2021

Some vague Zyxel problem

Hackers are using unknown user accounts to target Zyxel firewalls and VPNs
by Dan Goodin of Ars Technica   June 24, 2021
Vague, vague vague. My take-away from this article is that no one knows what is going on. What does "access a device" mean? Bypass what authentication? My guess is that this issue, whatever it is, is very bad, and the vague explanation is designed to hide this. Smells like there are backdoor accounts in the vulnerable devices. Maybe. Glad that they sent a SOP to all registered users. What's a SOP?

MAY 2021

Article by Dong Ngo

Router Management: Web Interface vs. App and the Trend Linksys Typifies
by Dong Ngo   May 29, 2021
Interesting article. Ngo sees and tests many more routers than I do, so he has a good perspective. Quoting:
 => There’s been a trend in home networking that forces or coerces users into signing up for a login account with the vendor and associate their home network with it. It all started with the eero. Nowadays, you’ll find this type of practice common in many vendors, though not all ... Asus is one of a few vendors that provide a mobile app that works without a login account.
 => ... the [mobile] app itself is not inherently bad. Rather it’s the intention behind the app that can be problematic. That’s especially true when a vendor attempts to turn you into a product via the app. Have you ever wonder how exactly the app on your phone is linked to the router at home? There’s no magic. You likely pay for that with your personal information. In fact, the mining of personal information is so lucrative that many vendors - such as Google or Amazon - have gone as far as taking the web interface entirely out of their home networking devices and make the app the only option. Others try to coerce users into the app artificially ... ever wonder why a vendor would like to collect data from your network, the answer is, among other things, advertising. Your online habits reveal a lot about what you have bought and are going to buy. This type of information, collected over time, is a gold mine for the receiving end. In other words, you become the product.
 => On top of that, there are also security risks. That’s because the vendor itself can be hacked, and when that happens, you have no idea who gets a hold of the data collected from your home network and what they’re going to do with it.
He explains how to use avoid creating a Linksys account while still being able to configure a Linksys router using the web interface.

An Asus router offers nothing but bugs

Asus router firmware: How do you prefer your bugs? New or Old?
by Michael Horowitz (me)   May 11, 2021
I am looking to update the firmware on an Asus RT-AC1900P router and I end up with a very bad choice. I am manually reviewing the latest firmware (dated February 1, 2021) because the automatic check for updates in the router failed. No matter. The most recent firmware is in Beta status which no normal router user/administrator would normally want any part of. But, this Beta software has a large number of security bug fixes. So, the choice is either to install firmware with old, known bugs or new untested Beta firmware with new bugs. Router firmware should not remain in Beta status for over three months. Makes you wonder if Asus is even working on testing it.
Update: Firmware version 3.0.0.4.386.43129 was released May 21, 2021 with fixes for seven known bugs (aka CVEs).

Why its hard to trust any Asus router

CVE-2021-32030: ASUS GT-AC2900 Authentication Bypass
by Chris Bellows of Atredis Partners   May 6, 2021
There is a bug in the ASUS GT-AC2900 router (aka RT-AC2900). It currently sells for about $170 and was released around January 2018. The bug has to do with validating the cookie that governs the current state of the web interface. Bugs in the validation can let someone get at the router without knowing the password. In techie lingo, its an authentication bypass vulnerability. Asus was informed of the problem March 16, 2021 and issued patched firmware April 28, 2021. That's the dull and boring part. The interesting part is the reaction from Asus. Sure, they fixed the bug in the RT-AC2900 but what about the many other Asus router models? It is very likely they share the same bug. But, Asus never issued a security advisory, so we have no way to know if their other routers are also buggy. It's none of our business.
Update: I mis-understood the flaws because in listing them, Bellows did not use either "and" or "or". I read it as three different flaws, which was wrong. All three conditions have to be true to trigger the flaw, not any one of them.

• Asus - GT-AC2900 - Authentication Bypass an advisory from Atredis partners
• Asus Security Advisories Nothing to see here, the last advisory was March 9, 2021.
• Asus RT-AC2900 router tech support page
• Asus RT-AC2900 router sales page

Here we go again - lots of old and vulnerable routers

Which? warns that more than 2 million Brits are on old and insecure routers – wagging a finger at Huawei-made kit
by Gareth Corfield for The Register   May 6, 2021
That millions of routers run old buggy software is not news. This time, the report is out of England from consumer organization Which? (the question mark is part of their name). In December 2020 Which? surveyed more than 6,000 UK adults, asking them which routers they were using at home. From this, they identified 13 older routers that are still commonly used and had them evaluated by security specialists at Red Maple Technologies. Nine of the 13 routers did not meet modern security standards. ISP-branded routers are typically white-label devices from China. Recent vendors to UK ISPs have been Huawei and ZTE. One big issue was the lack of firmware (router software) updates. They estimate that 6 million Britons are using routers that were last updated in 2018, and, of those, 2.4 million routers have not been updated for five years. The worst offenders were the Sky SR101 and SR102, the TalkTalk HG523a, HG635 and HG533 and the Virgin Media Super Hub and Super Hub 2. This came up because England is considering a law that would require phone, tablet, and IoT vendors to publish a drop dead date for security updates on new devices. Another issue was weak default passwords that can be easily guessed by attackers from anywhere in the world. Routers with weak passwords were from Sky, TalkTalk, Virgin Media and Vodafone. Perhaps the worst router was the TalkTalk HG533 made by Huawei and released in 2013. Huawei was warned in 2013 of a vulnerability involving UPnP. They claimed it was fixed in 2014, but they never actually fixed it. The same vulnerability was re-discovered in 2017 by a different group of security researchers. The current evaluation found that the HG533 has weak passwords and is not being updated. The worst ISP seems to be Virgin Media because they "... told Which? to stuff off when its researchers came wagging their fingers disapprovingly". In other words: go away kid, don't bother me. Virgin Media "... did not recognise or accept the findings of the Which? research ..." The only good news is that old routers from both BT and Plusnet had received recent updates and had no security issues.

• Millions of people in the UK at risk of using insecure routers by Hollie Hennessy of Which? May 6, 2021
• Millions of older broadband routers have these security flaws, warn researchers by Daphne Leprince-Ringuet of ZDNet May 6, 2021

APRIL 2021

F**k Microsoft - they removed this site from Bing and DuckDuckGo and Yahoo and AOL

April 23, 2021. Microsoft does not want you to see this website.
This site is not promoted in any way. There are, for example, no ads for it. And, for whatever reason, no articles about Router Security ever mention this site, let alone link to it. So, when it disappears from a search engine, it disappears. Do a search for "router security" on Google and this site is currently, the top hit. The same is true at Startpage, Yandex and Baidu. Yet, it is nowhere to be found on either DuckDuckGo or Microsoft's Bing. By this, I do not mean that it is on the second page of search results, it does not exist at all. DuckDuckGo says: "We also of course have more traditional links in the search results, which we also source from multiple partners, though most commonly from Bing (and none from Google)." Elsewhere they say: "We get our results from various sources but mostly Bing, Yahoo and Yandex ...". I forgot Yahoo existed. Sure enough, this site is also missing from a Yahoo search for "router security". I don't think Yahoo really has their own search engine, I think they partner with Bing. So, my guess is that Bing is the real culprit. If a site is removed from Bing, it will probably not appear in DuckDuckGo or Yahoo. Granted, I am no expert on this. Could someone have reported this site as bad to Bing? Microsoft makes it pretty easy to ask for a site to be removed. I doubt they notify the site owner. I also doubt they do much Due Diligence.
April 24: Someone emailed me today saying that this site is the top hit for him at DuckDuckGo. Yet, I don't see it at all and I tried DuckDuckGo on multiple computers with multiple browsers and, thanks to a VPN, from multiple IP addresses. Additional testing showed that this site only appears for him with the Lynx text-based browser on Linux. When he uses normal Firefox, the site does not appear. I can not explain this.
April 25: I did some digging through history and found some referrals from cn.bing.com. So, whatever it is about this site that Bing considers bad, illegal or offensive, does not apply to China. I could not determine when the ban took place. But, in looking at the old server logs, I also saw referrals from search.aol.com. The AOL search is also powered by Bing.
April 27: I'm back ... it seems that feedback I submitted to Bing and DuckDuckGo had an effect.
May 6: Demoted again. This site is no longer the top site on Bing when searching for "router security". It remains the top site on Google. The top results, in sequence, are: Norton, TomsGuide, BestBuy (wow what a screw-up), Microsoft, BestBuy again, Wired, pcworld, foxnews, lifewire, zdnet on recent news, welivesecurity also on recent news, usatoday, and then the Test Your Router page on this site. Foxnews for router security? BestBuy? USA Today? Is Microsoft screwing with me or can they really be that bad at this?
May 15: Adding insult to injury. Not only does Bing rank this site lower than it used to, but the top "router security" web page is just awful. It is one of the worst articles on router security that I have ever seen. More on my blog: Bing prefers miserable Router Security advice
May 16: It seems that Bing treats the last date on a page as the Last Updated date. On this site, the last date is usually the page creation date, so, perhaps Bing is ranking the pages low because it thinks they are old. I am doing a test. The last date that physically appears on each page is now May 14, 2021. Time will tell . . .

Still more misery with IoT

100 Million More IoT Devices Are Exposed - and They Won't Be the Last
by Lily Hay Newman of Wired   April 13, 2021
I consider this router news because it is yet another reason to segment your home network (LAN). For more on this concept, see the VLAN page. Over the last few years, researchers have found a large number of vulnerabilities in the software that underpins how devices communicate, both within a LAN and on the Internet. The communication software is known as a TCP/IP stack. This article is about the latest group of bugs, a set of nine vulnerabilities that are estimated to affect 100 million devices, including internet-of-things (IoT) devices and IT management servers. The bugs are in four different, and popular, TCP/IP stacks. The most famous of the four is included in FreeBSD, which underlies routers running both pfSense and OPNsense. The other three TCP/IP stacks are Nucleus NET (from the industrial control firm Siemens), IPnet and NetX. Exploiting the bugs, an attacker can either crash the vulnerable device or, perhaps, take control of it. Patches have been issued for all nine bugs but many devices will not and/or can not be updated. Similar flaws in other TCP/IP stacks have exposed hundreds of millions of devices to potential hacking. Why are there so many bugs in such fundamental software? An expert is quoted saying "A lot of it is about lack of economic incentives to really focus on the quality of this code."

• Forescout and JSOF Disclose New DNS Vulnerabilities, Impacting Millions of Enterprise and Consumer Devices by Forescout Research Labs April 12, 2021
• NAME:WRECK Forescout Research Labs, partnering with JSOF Research, disclosed NAME:WRECK, a set of Domain Name System (DNS) vulnerabilities that have the potential to cause either Denial of Service or Remote Code Execution, allowing attackers to take targeted devices offline or to gain control over them. The widespread use of these TCP/IP stacks and often external exposure of vulnerable DNS clients lead to a dramatically increased attack surface.

Portable Verizon 4G hotspot is a fire hazard

Verizon Recalls 2.5M Ellipsis Jetpack Mobile Hot Spots Over Fire Hazard
by Allen St. John of Consumer Reports   April 8, 2021
To the public, its a 4G hotspot, but to me, its a router. Verizon is recalling about 2.5 million Ellipsis Jetpack mobile hot spot devices with lithium-ion batteries that have overheated. The specific models are: MHS900L, MHS900LS and MHS900LPP. Verizon is offering a free exchange, replacing the Jetpacks with an Orbic Speed hot spot.

No Cisco for me

Cisco Will Not Patch Critical RCE Flaw Affecting End-of-Life Business Routers
by Ravie Lakshmanan of Hacker News   April 9, 2021
There are many instances, documented in both the News and Bugs pages of this site, of critical flaws in Cisco software. There have been so many huge security flaws in Cisco software that I don't bother including them all here. The concept became clear long ago - they are not trustworthy. Cisco just issued fixes for still more critical bugs (Cisco fixes bug allowing remote code execution with root privileges) but the point here is about a bug they did not fix. Specifically, the bug identified as CVE-2021-1459, which exists in the web-based management interface of the Cisco Small Business routers RV110W, RV130, RV130W, and RV215W. The bug is as severe as severe gets, an unauthenticated bad guy can execute arbitrary code on a vulnerable device. But, these devices are too old to bother with. Quoting the company: "Cisco has not released and will not release software updates to address the vulnerability ... The Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers have entered the end-of-life process ... Customers are encouraged to migrate to the Cisco Small Business RV132W, RV160, or RV160W Routers." I agree that owners of buggy devices need to buy new hardware, but at this point, you could not pay me to use hardware from Cisco (or Ubiquiti for that matter). It is interesting to note that when a bug is really bad, as this one is, Microsoft will make an exception, and issue a patch for no-longer-supported software.

• Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability by Cisco April 7, 2021

MARCH 2021

Bombshell revelation about Ubiquiti

Whistleblower: Ubiquiti Breach Catastrophic
by Brian Krebs of KrebsOnSecurity.com   March 30 ,2021
Quoting: "On Jan. 11, Ubiquiti Inc.... disclosed that a breach involving a third-party cloud provider had exposed customer account credentials. Now a source who participated in the response to that breach alleges Ubiquiti massively downplayed a 'catastrophic' incident to minimize the hit to its stock price, and that the third-party cloud provider claim was a fabrication ... It was catastrophically worse than reported, and legal silenced and overruled efforts to decisively protect customers. The breach was massive, customer data was at risk, access to customers' devices deployed in corporations and homes around the world was at risk." And, more details: "The whistleblower claims that 'attacker(s) had access to privileged credentials ... and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies. Such access could have allowed the intruders to remotely authenticate to countless Ubiquiti cloud-based devices around the world. " At times like this, you might expect a company to force all users to change their password the next time they logon. Instead, Ubiquiti sent out emails, that were flagged as SPAM, so some users never saw them, that suggested changing their password. I spent 10 years as a Database Administrator so this point really hit home: Ubiquiti had no logging configured for the critical databases that the attacker(s) gained access to. Thus, they have no clue what the bad guys did. This is malpractice and is a great reason not to trust them going forward. Ubiquiti took a full day to respond to these charges and their response was half-hearted and did not fully deny all these charges. Oh, and the attackers also provided proof they had stolen Ubiquiti's source code. Some points:

1. Ubiquiti has many different product lines (UnifI, AmpliFi, Alien, EdgeRouter) and there was no mention here about which ones are affected. It seems likely that anything using a Ubiquiti cloud service was at risk.
2. There was disagreement in the comments as to whether the use of Ubiquiti cloud services was required. It seems to vary both by product and by software release. Over time, more Ubiquiti products do require their cloud service.
3. No mention of their online stores. Are they involved in the breach? I have an account at store.amplifi.com and it is impossible to change the password.
4. The UniFi Dream Machine requires cloud services. Take it or leave it.
5. The Edge routers do not require Ubiquiti cloud services according to comments made on the article.

Update: April 4, 2021. Ubiquiti All But Confirms Breach Response Iniquity by Brian Krebs. Four days after the above disclosure, the company issues a public statement that confirms and reinforces the claims in the first article. Nothing was denied.

From other sources

• Ubiquiti is accused of covering up a 'catastrophic' data breach - and it’s not denying it by Mitchell Clark for The Verge March 31, 2021. Quoting: "When Ubiquiti finally issued a statement this evening, it wasn't a reassuring one - it's wildly insufficient. The company reiterated its point that it had no evidence to indicate that any user data had been accessed or stolen. But as Krebs points out, the whistleblower explicitly stated that the company does not keep logs, which would act as that evidence, on who did or didn’t access the hacked servers ... The other thing you'll notice is that Ubiquiti is no longer pinning this on a 'third party cloud provider.' The company admits that its own IT systems were accessed. But it doesn't address much else ..."
• Whistleblower: Ubiquiti Breach 'Catastrophic' a discussion of this news at the Ubiquiti Forum
• Ubiquiti accused of covering up 'catastrophic' breach - and it’s not denying it from Hacker News April 1, 2021
• Whistleblower: Ubiquiti Breach 'Catastrophic' from Hacker News March 30, 2021
• Ubiquiti breach puts countless cloud-based devices at risk of takeover by Dan Goodin for Ars Technica March 31, 2021. Theft of crypto secrets could allow hackers to remotely log in to devices.
• Brett Glass runs a wireless ISP. He tweeted: "Wish I were surprised. Security has always been one of @Ubiquiti's weakest points (and the reason we avoid their cloud services and heavily firewall their products)." April 1, 2021.
• Troy Hunt is a techie and a big fan of Ubiquiti. He tweeted: "The problem now is the same as I commented back in Jan which is that they’re not providing anywhere near enough information about the incident." Not creating trust.
• From 2017: Citron exposes Ubiquiti Networks. By "exposes" they mean exposed as being a fraud.

FEBRUARY 2021

NAT traversal issues

NAT Slipstreaming v2.0: New Attack Variant Can Expose All Internal Network Devices to The Internet
by Ben Seri of Armis   February 2021
There are two industry issues that affect many routers. Rather than being bugs, they are design flaws in Application Layer Gateway (ALG) software. In late October 2020, respected security researcher Samy Kamkar figured out a way to poke a hole in the router firewall that opened up access to a computer visiting a malicious web page. This initial version of the NAT Slipstreaming attack abuses the Session Initiation Protocol (SIP) protocol and ports 5060 and 5061. The second generation attack abuses the H.323 multimedia protocol to open firewall holes to any LAN side device. It depends on sending TCP traffic out to port 1720 (for call forwarding). In response to these issues, web browsers have blocked some outbound ports. Armis, which developed the second generation attack said "The real fix would be every user and sysadmin disabling all ALGs, as this feature is fundamentally broken." In response to the second generation attach, Chrome not only blocked port 1720, it also blocked 69, 137, 161, 1719, 1723, and 6566. The other TCP ports "are known to be inspected by NAT devices and may be subject to similar exploitation." As for routers, the obvious solution is to disable the ALGs. On the Stuff to Turn Off page here, I provide screen shots and summaries of the varying ALG support from AmpliFi, Asus, DrayTek, Eero, Google Nest, Linksys, Peplink, TP-Link and UniFi. Routers that provide outbound firewall rules can be configured to block these same ports. This is a more complete solution.
Ports to block for v1: 5060 and 5061
Ports to block for v2: 69, 137, 161, 1719,1720, 1723 and 6566
Port later blocked: 554

• New Slipstream NAT bypass attacks to be blocked by browsers by Sergiu Gatlan of Bleeping Computer November 9, 2020. Web browsers will block TCP ports 5060 and 5061.
• Feature: Block HTTP ports 69, 137, 161, 1719, 1720, 1723, and 6566 Connections to HTTP, HTTPS or FTP servers on ports 69, 137, 161, 1719, 1720, 1723 or 6566 will fail.
• Google Chrome blocks 7 more ports to stop NAT Slipstreaming attacks by Lawrence Abrams of Bleeping Computer January 28, 2021
• Google deploys Chrome mitigations against new NAT Slipstreaming attack by Catalin Cimpanu of ZDNet January 29, 2021
• Google Chrome to block port 554 to stop NAT Slipstreaming attacks by Lawrence Abrams of Bleeping Computer. March 8, 2021. Safari and Firefox are already blocking port 554.

JANUARY 2021

Ubiquiti is hacked and lies about it

Ubiquiti tells customers to change passwords after security breach
by Catalin Cimpanu of ZDNet   January 11, 2021
"According to Ubiquiti, the intruder accessed servers that stored data on UI.com users, such as names, email addresses, and salted and hashed passwords. Home addresses and phone numbers may have also been exposed ... How many Ubiquiti users are impacted and how the data breach occurred remains a mystery ... A Ubiquiti spokesperson did not immediately return a request for comment send before this article's publication ... Despite the bad news to its customers, Ubiquiti said that it had not seen any unauthorized access to customer accounts as a result of this incident. The company is now asking all users who receive the email to change their account passwords and turn on two-factor authentication. While initially, some users looked at the emails as a phishing attempt, a Ubiquiti tech support staffer confirmed that they were authentic on the company's forums."
My take: I have installed two AmpliFi systems and this left me annoyed as heck because I was not sure if the problem affected me or not, which is pretty trivial to convey. Do I need to change the router password? The Wi-Fi password? I bought one from the Ubiquiti website (store.amplifi.com) and had to create an account there. Is that part of the breach? None of my business. I logged into the site to change my password and there is no change password function. You can't make this stuff up. Do AmpliFi customers have a Ubiquiti account if they purchased the hardware elsewhere? Dunno. No more Ubiquiti for me. We did not know they were lying about much of the problem until March 2021.

• Ubiquiti: Change Your Password, Enable 2FA by Brian Krebs Jan. 11, 2021. Quoting: "The warning from Ubiquiti carries particular significance because the company has made it fairly difficult for customers using the latest Ubiquiti firmware to interact with their devices without first authenticating through the company’s cloud-based systems. This has become a sticking point for many Ubiquiti customers, as evidenced by numerous threads on the topic in the company’s user support forums over the past few months." Krebs repeated what Cimpanu said "Ubiquiti has not yet responded to requests for more information..."
• Ubiquiti Networks Breach from Hacker News
• From the Ubiquiti Forum: A Request for Local Accounts in light of this breach Jan. 11, 2021
• In their own words: Account Notification by Ubiquiti. This does not create trust.

A huge number of security problems with FiberHome routers

Multiple backdoors and vulnerabilities discovered in FiberHome routers
by Catalin Cimpanu of ZDNet   January 18, 2021
Anyone with an optical fiber connection to the Internet has an Optical Network Terminal that converts optical signals into Ethernet and Wi-Fi data packets. Chinese company FiberHome makes a HG6245D model ONT/router that is a security disaster. The HG6245D is widely deployed in South America and Southeast Asia. News of these flaws comes from Pierre Kim who has reported many other router bugs in the past. He was supposed to give a presentation on the problems at a conference that was cancelled due to the pandemic. Not only were there many security flaws (too many to count) there were also 28 backdoor accounts. Geeze. What does the company have to say for itself. Nothing. Quoting: "Requests for comment sent by ZDNet to FiberHome via email and its official website last Thursday, January 14, remained unanswered at the time of writing."

• Multiple vulnerabilities found in FiberHome HG6245D routers by Pierre Kim (@PierreKimSec). January 12, 2021. Kim is of the opinion that some of the backdoors were intentionally placed by the vendor. He says that it is likely that other fiberhome devices (AN5506-04-FA, AN5506-04-FAT, AN5506-04-F) are also vulnerable because fiberhome devices have quite a similar codebase. One of the many security issues is the lack of an IPv6 firewall which leaves all the internal services reachable to anyone via the Internet. According to Kim, it is "trivial" for an un-authenticated bad guy to run software on the router, both from the Internet side via IPv6 and from the LAN side using either IPv4 or IPv6.

2020   top

DECEMBER 2020

A great reason to avoid Zyxel devices

Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways
by Catalin Cimpanu of ZDNet   January 2, 2021
Quoting: "More than 100,000 Zyxel firewalls, VPN gateways, and access point controllers contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via either the SSH interface or the web administration panel." This is as bad as bad gets. It is a great reason to avoid all Zyxel hardware. According to Dutch security firm Eye Control, the username and password were visible in a firmware executable file. The userid is not visible to an administrator of the device and its password can not be changed. Eye Control reports that since the SSL VPN on these devices operates on the same port as the web interface, a lot of them have exposed port 443 to the Internet. Patches are available.

• Undocumented user account in Zyxel products by Niels Teusink of Eye Control. (CVE-2020-29583) December 23, 2020. Original source of the story.
• Zyxel security advisory for hardcoded credential vulnerability from Zyxel Dec. 24, 202
• On the whole, the tech press simply repeated the ridiculous response from Zyxel which was little more than a word salad. On the January 5, 2021 episode of his Security Now podcast, Steve Gibson was the only one to note that the emperor had no clothes and detail just how disgraceful this is. He too, suggests this is reason enough to avoid Zyxel devices going forward.

TP-Link Access Point has a back door - a hidden Wi-Fi network

Tweet thread
by Jon Aubrey   December 1, 2020
The Access Point (AP) in question is the TP-Link TL-WA701ND. Jon uses it to connect an Ethernet-only device to his home Wi-Fi network. The tweet thread starts with "One day while I was scanning around my house for WiFi networks I noticed a high-powered WiFi network with a hidden SSID broadcasting from my main office. With a little more investigation I determined this was coming from the TP-Link, but what was it?" Not only was the network not broadcasting its SSID, there was also nothing about its existence in the user interface of the device. Really hidden. You could stop right there, as this tells you everything you need to know about TP-Link. He very impressively hacked the router and learned the SSID of the network and logged in to it. Quoting: "The hidden network in this case is bridging with the other WiFi network that I told the client to connect to, so we have a backdoor into my home network, not fun." The important lesson here is for buying a router from a company you can trust. This is a lesson the New York Times has not learned, all they care about in reviewing routers is speed. In their WireCutter division the top two recommended routers are both from TP-Link.

• Update: On Jan. 7, 2021, Another TP-Link router was found doing the same thing. Twitter user @JAMESWT_MHT tweeted: "Not only TL-WA701ND too TL-WR802N V4 LAST FIRMWARE In client mode create hidden SSID". On the up side he also says that the "TL-wa901nd with last firmware is not affected by this behavior"
• In September 2019, I found a similar issue: Hidden Wi-Fi Networks on a Synology Router. In my case, the Synology RT2600ac router was creating two hidden Wi-Fi networks, one on each Wi-Fi radio frequency band. Here too, there was nothing in the router's admin interface about these networks. I stumbled across them quite by accident, as did Jon Aubrey in his tweeted story.

NOVEMBER 2020

Apple pokes holes in macOS firewalls for their own use

Apple's own programs bypass firewalls and VPNs in Big Sur
by Anders Lundberg of MacWorld   November 18, 2020
Apple has modified the guts of the Big Sur edition of macOS (aka macOS 11) to poke a hole in some (not all) outgoing firewalls for their own corporate use. 56 Apple apps and processes, such as FaceTime, iMessage, iCloud, Maps and Siri can no longer be contained by bypassed firewall software running on the system. They also made their own software immune to the previously-mandatory network changes imposed by some (not all) VPN client software running on macOS. This too, can be thought of as poking a hole in the firewall, though the official term is a VPN leak. Some worry that bad guys can use this new system to piggy-back on the Apple exceptions/holes and bypass firewalls and VPNs. To everyone else, this is a macOS story. To me, it is a router story. Regardless of the operating system on any computing device, the router is the top dog. It can, for example, block all access to the outside world that does not go through the VPN tunnel. Perhaps not easy to configure, but its possible, at least with professional grade routers (pfSense and Peplink for example). Some have suggested running a VPN client on the router to avoid any and all VPN leaks.

• Apple lets some Big Sur network traffic bypass firewalls Ars Technica Nov. 17, 2020
• ProtonVPN prevents Apple apps on Big Sur exclusion list from bypassing firewall by ProtonVPN November 17th, 2020. Their VPN network control is not impacted by Big Sur. That said, they advise everyone using their macOS app to enable the Kill Switch. This option in their software prevents the computer from establishing any connections outside the VPN tunnel, including all Apple apps.
• Big no on Big Sur: Mullvad disallows Apple apps to bypass firewall by Mullvad Nov. 16, 2020. Their VPN client software does NOT allow Apple’s own apps to route around their VPN. Instead of using the content filter provider APIs, they the Packet Filter (PF) firewall component of the OS.
• Some Apple Apps on macOS Big Sur Bypass Content Filters, VPNs ThreatPost November 17, 2020

Auditing a Buggy Asus Router

At a recent hacking contest in China, bugs were found in two routers: the TP-Link TL-WDR7660 and the Asus RT-AX86U. The contest results were announced November 9, 2020. The TP-Link router is not sold in the US, there is no mention of it at www.tp-link.com/us/. The contest rules require the discovered flaws be disclosed to the vendor. I will watch Asus and see when they admit to the flaw and when they fix it. Perhaps most importantly, we will see if they patch just the one model or if they bother to investigate or say anything about similar models running similar firmware.
 -->April 18, 2021: new firmware, version 3.0.0.4.386.42095, is dated March 18, 2021. It fixes a DoS vulnerability and these security bugs: CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687, CVE-2020-25684, CVE-2020-25685, CVE-2020-25686, CVE-2020-36109. Chances are one of these is the Nov. 2020 bug.
 -->January 2, 2021: Still nothing on the Asus Security Advisory page. But, there is new firmware, version 3.0.0.4.386.41535 dated Dec. 30, 2020. There were many changes in the firmware, but there is no mention of a bug fix. The bug seems to have fallen off the end of the earth. Such are consumer routers.
 -->December 17, 2020: Still nothing on the Asus Security Advisory page. No new firmware either.
 -->November 22, 2020: Still nothing on the Asus Security Advisory page. No new firmware either.
 -->November 13, 2020: There is nothing on the Asus Security Advisory page about this.

• The Asus Security Advisory page. When the bug was found, the last advisory was July 10, 2020.
• Available downloads for the Asus RT-AX86U. When the bug was found, the latest firmware was dated October 23, 2020. It "improves system stability" (thanks for nothing) and is Version 3.0.0.4.384.9318 (was there a sale on numbers?).

OCTOBER 2020

Singapore takes the first steps to making routers secure

Singapore tightens security requirements for new home routers
by Eileen Yu of ZDNet   October 13, 2020
Starting April 2021, home routers in Singapore will have to have taken some basic security steps in order to be sold. The exact requirements were not clear from the article, but it starts at the very beginning: every router has to have randomized and unique login credentials with an unspecified minimum password strength. And, security patches have to be downloaded automatically. Routers will also have to disable "system services and interfaces that are deemed to be vulnerable" which might refer to WPS and/or UPnP. However, there is nothing about how long security patches have to be issued. The article points out that Japan imposed similar requirements and that the UK is considering this too. The US? Fuggedaboutit. It's the Wild West here, which is why this site is needed.

Tenda routers hacked. The company response tells us not to use their products

New Ttint IoT botnet caught exploiting two zero-days in Tenda routers
by Catalin Cimpanu of ZDNet   October 4, 2020
Netlab, the network security division of Qihoo 360, reported that bad guys have been exploiting bugs in Tenda routers to install malware on the routers and to build an IoT botnet. The botnet, called Ttint, was first sighted in November 2019. Not satisfied with the usual, infecting devices to perform DDoS attacks, Ttint also implements 12 different remote access methods to the infected routers, used the routers as proxies to relay traffic, tampered with the router's firewall and DNS settings, and gave attackers the ability to execute remote commands on the hacked devices. Until July 2020, the bad guys exploited bug CVE-2020-10987. Then, Sanjana Sarda, of Independent Security Evaluators, published a detailed report on the vulnerability and four others. A few weeks later Ttint software was revised to exploit a different bug in the same routers. Despite the public shaming, Tenda has fixed neither bug. That's all we need to know. The command control center for the botnet is at notepod2.com, so if you can block this domain in your router or DNS, please do.

• Ttint: An IoT Remote Access Trojan spread through 2 0-day vulnerabilities by Lingming Tu, Yanlong Ma and Genshen Ye of Netlab 360. October 1, 2020. The report that the article is based on.
• Tenda AC15 AC1900 Vulnerabilities Discovered and Exploited by Sanjana Sarda of ISE. July 10, 2020. The details of five bugs in the Tenda AC15 AC1900 Smart Dual-band Gigabit Wi-Fi Router (and perhaps other Tenda routers). The blog details two methods that attackers can use to gain persistent unauthenticated root access to the router. Over six months, Tenda never replied to an email from ISE.

SEPTEMBER 2020

Another reason to avoid Netgear hardware

Before you buy that managed Netgear switch, be aware you may need to create a cloud account to use its full UI
by Gareth Corfield of The Register   September 21, 2020
Yes, this story is about managed/smart switches rather than routers. Close enough. And it's very useful for peek into the corporate mindset of Netgear. They changed the rules on their customers. Owners of Netgear managed switches are now required to setup a Netgear Cloud account to continue to use the full web interface to manage the devices. Without an account, some features are off-limits. Netgear has done a similar thing with their routers. In that case, a router firmware update introduced telemetry that was on by default. What does Netgear do with information from the newly assimilated switches? Their privacy policy says that data can be hoovered up for marketing purposes and research. Resistance is futile. Someone commenting on the story noted that to use many features of an Asus router, you need to accept Terms and Conditions that include transmitting your data to TrendMicro and potentially others. This has been covered here previously.

• GC108P / GC108PP Firmware Version 1.0.5.8 from Netgear. The firmware update that mandated the change. Last updated Sept 18, 2020
• What features of my NETGEAR Smart Managed Pro Switch can I access without registering? from Netgear Aug. 22, 2019

Blog about old buggy software in consumer routers

Network routers are just computers
by Daniel Aleksandersen   September 12, 2020
A recent study found that one-third of the tested routers shipped with Linux kernel version 2.6.36, which was released in October 2010. This outdated version of the Linux kernel has 233 known security vulnerabilities registered in the Common Vulnerability and Exposures (CVE) database. The study did not look into whether different software services on the router run in sandboxed and constrained environments, or whether they have full privileged access to the system. In Aleksandersen's experience, he has only seen services with full access (bad security). He complains that it is not difficult or time-consuming to set up these protections, but network equipment manufacturers tend not to bother with it. He also replicated a small part of the study at a local electronics shop. He noted every router being sold and checked when they had last received a security update. Not a single router had received a software update in the last 14 months. Manufacturers of consumer routers are not incentivized to provide ongoing support and security updates for their devices. It’s expensive to employ staff that support old products that don’t generate revenue. In his opinion that are no good consumer routers. None. He says you need to switch to more involved, complicated, and expensive enterprise-grade network equipment before you see any improvements. I agree and thus my recommendation here for Peplink products. My page on configuring the Pepwave Surf SOHO should make it easier to get started.

My blog on using two routers

A second router can make working from home much more secure
by Michael Horowitz   September 25, 2020
The title is self-explanatory. Last Updated: Oct. 31, 2020.

Do not buy a router from MoFi Network

Critical Vulnerabilities Discovered in MoFi Routers
by Rich Mirch of CriticalStart, Teamares   September 2, 2020
I had never heard of Mofi Network until this report came out. They make 4G/LTE routers based on OpenWRT. When Mirch first examined them, he found ten bugs. Mofi fixed some of the bugs, not all, and while doing so introduced still more bugs. Mirch found two (yes two) undocumented administrator accounts (think backdoor). At least one of them lets attackers login to the management interface without a password. The devices also default to enabling remote administration, which no one does any more. Also, no authentication is required to download a support file that contains cleartext credentials and password hashes. One bug that is not fixed, lets bad guys authenticate as root without the root password.

• Router vendor has patched some zero-days, but leaves others wide open by Sean Lyngaas for Cyberscoop Sept 2, 2020. Asks how we incentivize security among router vendors in a market that prizes affordability and convenience. Good question. And this: "MoFi did not respond to phone calls, emails and Facebook messages seeking comment."

AUGUST 2020

More Cisco bugs

Cisco alert: Four high-severity flaws in routers, switches and AnyConnect VPN for Windows
By Liam Tung of ZDNet   August 6, 2020
More high-severity flaws in assorted Cisco software. One bug is in the StarOS system that runs on the ASR 5000 Series Aggregation Services Routers. It allows a remote attacker without credentials to cause a denial of service. Some Small Business switches and Managed switches are also buggy. A remote attacker without credentials can cause a denial of service on the buggy switches. Some vulnerable switches are not being fixed because Cisco considers them too old.

• Cisco Security Advisories

JULY 2020

Counterfeit high end networking devices

A Tale of Two Counterfeits
by Steve Gibson of GRC   July 21, 2020
Two weeks ago, we learned that C-Data networking devices were spy machines (story below) with all sorts of backdoor accounts. Turns out this was not true, that the devices the researchers had studied were counterfeit. The retraction has been ignored by the tech press, except for Steve Gibson. The other counterfeit he discusses is another recent story, F-Secure found about phony Cisco switches. The Cisco devices were discovered only because they would not boot after a firmware update. Nothing gave away the C-Data devices.

• Statement on Pierre Kim Revealing Security Vulnerabilities in C-data OLT products July 14, 2020 from C-Data
• Hunting for backdoors in counterfeit Cisco devices by F-Secure July 15, 2020
• The Anatomy of a Cisco Counterfeit Shows Its Dangerous Potential by Lily Hay Newman in Wired July 17, 2020

Yet another Cisco flaw

Cisco patches actively exploited ASA/FTD firewall vulnerability
by Sergiu Gatlan of Bleeping Computer   July 24, 2020
At this point a severe and actively exploited flaw in Cisco software is not really news. The software this time is the Cisco Adaptive Security Appliance (ASA) Software (the OS for standalone appliances, blades, and virtual appliances) and the Cisco Firepower Threat Defense (FTD) Software which should be providing next-gen firewall services. Vulnerability CVE-2020-3452 may allow unauthenticated attackers to read sensitive files on unpatched systems through directory traversal attacks. This happened in the usual way, improper input validation of URLs in HTTP requests. Yawn.

C-Data networking devices are spy machines

Backdoor accounts discovered in 29 FTTH devices from Chinese vendor C-Data
by Catalin Cimpanu for ZDNet   July 10, 2020
NOTE: See above. The studied devices were counterfeit.
Researchers Pierre Kim and Alexandre Torres examined networking devices from C-Data and found the worst possible situation. The devices are, technically, not routers, and they are found in the internal networks of ISPs rather than our homes or offices. Earlier research by Pierre Kim can be found on this website in many places. The devices can be thought of as optical modems, they convert optical signals to Ethernet. The firmware in 29 devices from C-Data was found to have 7 vulnerabilities. Even worse, the devices have backdoor accounts, which can grant full access to people that know the hard-coded passwords. This was so obviously done to allow purposeful access/hacking/spying, that the researchers went public with their results rather than tell C-Data first. Much blame also falls on the ISPs that purchased this equipment. For one thing, the boxes only use HTTP for administration not HTTPS. Also, they use Telnet rather than SSH. Both are red flags. The defense against this is a VPN. Using one means that your ISP sees nothing but encrypted bytes.

• Multiple vulnerabilities found in CDATA OLTs by Pierre Kim. The original research.

A study of 127 router models found miserable security

Home router security report
by Peter Weidenbach and Johannes vom Dorp of the Fraunhofer Institute   (20 page PDF) July 2020
Researchers at the German Fraunhofer Institute studied 127 common home routers from Asus, AVM, D-Link, Linksys, Netgear, TP-Link and Zyxel. They looked at the latest available firmware as of March 27, 2020. Not one router was bug-free. Some had hundreds of known vulnerabilities. The average number of critical vulnerabilities per router was 53. The best routers had 21 vulnerabilities. A third of the routers use the 2.6.36 Linux kernel which was last updated nine years ago. Routers are not updated very often. 46 routers had not received a security update in the last year. 27 had not been updated in the last two years. In the worst case, there had been no update for 5 years. That said, the report did not go into the concept of End-of-Life where a manufacturer publicly admits there will be no more updates. And, even when routers are updated many known vulnerabilities were not fixed. This is not news, similar prior studies also found this. 50 routers had hard-coded credentials (userid/password) and 16 had well known or easy crackable credentials. Linux provides a number of exploit mitigation features and the routers rarely used them. The same complaint was very recently made by the person that found bugs in 79 Netgear routers (see below). Most firmware has private cryptographic keys so whatever is being secured with a public-private crypto mechanism is not really secure. As for rating the vendors on security, AVM was the best, ASUS and Netgear were mid-tier and the worst were D-Link, Linksys, TP-Link and Zyxel.

• Bruce Schneier blogged about this report on Feb. 19, 2021. His comment: "We know the reasons for this. Most routers are designed offshore, by third parties, and then private labeled and sold by the vendors you’ve heard of. Engineering teams come together, design and build the router, and then disperse. There’s often no one around to write patches, and most of the time router firmware isn’t even patchable. The way to update your home router is to throw it away and buy a new one."
• Revealed: How home router manufacturers dropped the ball on security by Mark Hachman of PC World. July 6, 2020
• Over 100 Wi-Fi routers fail major security test - protect yourself now by Paul Wagenseil July 8, 2020. What is not in the report: Huawei routers were not examined because the company does not make its router firmware publicly available. And, gateways issued by ISPs were not examined because the ISPs outsource firmware development to many third parties.
• Fraunhofer test: Huge security flaws in common home routers at Born City by guenni July 5, 2020
• AVM routers seem to be available world-wide but not in the US.

Yet another Cisco bug

Cisco SMB kit harbors cross-site scripting bug: One wrong link click... and that's your router pwned remotely
by Shaun Nichols of The Register   July 2, 2020
There is a bug in the Cisco Small Business RV042 Dual WAN VPN Router and the Cisco Small Business RV042G Dual Gigabit WAN VPN Router. The bug is in the web interface and is as old as time itself - lazy programming. That's my term, the article attributes the bug to "insufficient validation of user-supplied input". The flaw can be exploited by an unauthenticated remote attacker. The bug is in the web interface so it probably can only be attacked on the LAN side, unless remote admin is enabled. That said, a malicious web page runs on the LAN and can attack the buggy routers from there. The bug was discovered by a company called CyCognito and they said that, in the worst-case scenario, a bad guy could exploit the flaw to take complete control of a vulnerable device. Cisco has issued updated firmware.

• Cisco Small Business RV042 and RV042G Routers Cross-Site Scripting Vulnerability from Cisco July 1, 2020. This says "Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability." What is does NOT say is whether they checked their other 924 router models. Did they?
• Using CyCognito Platform, Researchers Uncover Zero-Day Vulnerability on Cisco Routers from the CyCognito Marketing Team July 2, 2020

JUNE 2020

Cisco is the only router vendor vulnerable to Ripple20

List of Ripple20 vulnerability advisories, patches, and updates
by Ionut Ilascu of Bleeping Computer   June 25, 2020
TCP/IP software from a company called Treck is very buggy. The software is used in millions of IoT devices. And, in Cisco ASR 5000 Series routers. It is also in six other Cisco devices. Why is Cisco is using Treck software?

• Multiple Vulnerabilities in Treck IP Stack Affecting Cisco Products from Cisco Last Updated June 22, 2020

UPnP yet again

CallStranger - Data Exfiltration & Reflected Amplified TCP DDOS & Port Scan via UPnP SUBSCRIBE Callback
by Yunus Çadirci   June 8, 2020
UPnP (Universal Plug and Play) allows devices to find each other on local networks and establish connections to exchange data. Devices communicate on their own without human involvement. UPnP was introduced back in the early 2000s, and it is designed for use on trusted Local Area Networks, thus it has no security at all. Opening up UPnP to the Internet is a mistake, yet a recent Shodan query found over five million devices doing UPnP on the Internet. Some are security cameras, DVRs, printers and, of course, routers. In December 2019, security engineer Yunus Çadirci found a new bug in UPnP. The bug was by design, it was a flaw in the UPnP specification itself. The spec was updated in April 2020. Some implementations of UPnP are buggy, others are not. Miniupnp (after 2011) is not vulnerable to the CallStranger flaw. Older versions of Windows 10 vulnerable, the latest is not. Good luck figuring out which version of UPnP is installed on a device. It is very likely that most vulnerable devices will never have their software updated. If you can run Python, Çadirci created a python script that scans a network for vulnerable devices. Vulnerable devices can be abused to exfiltrate data, scan the Local Area Network or cause a network to participate in a DDoS attack. More specifically, the vulnerability is caused by the Callback header value in the UPnP SUBSCRIBE function. It can be controlled by an attacker.

• Universal Plug and Play (UPnP) SUBSCRIBE can be abused to send traffic to arbitrary destinations Vulnerability Note VU#339275 by the CERT Coordination Center. June 9, 2020
• Billions of devices affected by UPnP vulnerability by John E Dunn of Naked Security June 10, 2020
• CallStranger vulnerability lets attacks bypass security systems and scan LANs by Catalin Cimpanu of ZDNet June 8, 2020
• CVE-2020-12695: CallStranger Vulnerability in Universal Plug and Play (UPnP) Puts Billions of Devices At Risk by Tenable Security June 8, 2020
• CallStranger (CVE-2020-12695) the Python script
• The Ars Technica article on this contains mistakes so I will not link to it. To read it copy the URL from below.
  UPnP flaw exposes millions of network devices to attacks over the Internet by Dan Goodin June 11, 2020
  arstechnica.com/information-technology/2020/06/upnp-flaw-exposes-millions-of-network-devices-to-attacks-over-the-internet
  It says "For those who insist on keeping UPnP turned on, use a site such as this one to make sure the router isn't exposing sensitive ports." The link does not go to a UPnP tester page, instead it goes to a page that tests for DNS Hijacking. I emailed Dan Goodin twice and never heard back. I also added a comment to the article.

APRIL 2020

More proof that ISP DNS should be avoided

TalkTalk customers unable to opt out of ISP's ad-jacking DNS - just like six years ago
by Matthew Hughes of The Register   April 20, 2020
When you try to contact a non-existing computer, by name, you should get an error message. Instead, some DNS providers show sponsored ads instead. Not the biggest problem in the world, but worse at TalkTalk where the ability to stop the sponsored ads does not always work. Worse, this prevents some customers from connecting to VPNs. The real solution is not use DNS servers from an ISP. Instead go with Quad9 or Cloudflare or OpenDNS or Google. For more about DNS, see the Test Your DNS page on this site.

Still more fallout from Linksys hack

Linksys asks users to reset passwords after hackers hijacked home routers last month
by Catalin Cimpanu of ZDNet   April 16, 2020
Linksys Smart WiFi is a cloud-based system for administering Linksys devices. Recently, Bitdefender detected an organized campaign to break into D-Link and Linksys routers and change the DNS server settings. In response, Linksys has locked all user accounts and is forcing users to reset their passwords. When the password is changed, Linksys will check the DNS server settings and remove the known bad ones. To me, this seems flawed - a bad guy could logon, change the password and then change the DNS servers the next day to some other malicious ones. The one real lesson here is to register your router with the hardware manufacturer.

• Required password reset due to DNS hack from Linksys

MARCH 2020

A different take on the same hacking spree

New Router DNS Hijacking Attacks Abuse Bitbucket to Host Infostealer
by Liviu Arsene of BitDefender   March 25, 2020
This seems to be same story as the one below, but many details are different. For one thing, there is no mention of Windows 10 checking for the status of the Internet connection. Instead, it says that a number of popular websites (Amazon Web Services, Disney, Reddit and more) are targeted. And, it only mentions Linksys routers being hacked, nothing about D-Link. Neither article says how the bad guys are getting into the vulnerable routers. This article is from BidDefender and thus the focus is on Windows. So much so, that its no clear if any other OS can be victimized. From their perspective, the use of Bitbucket to deliver malware is interesting, I could care less. It also abuses TinyURL. Yawn. Most victims are in Germany, France, and the United States. As with the article below, the bad DNS servers are 109.234.35.230 and 94.103.82.249. If your router supports outbound firewall rules, it would be good to block these. The malicious web pages reside on 176.113.81.159, 193.178.169.148 and 95.216.164.181. What is not said here is testing a router for open ports (see the Test Your Router page here). Also, any device running a VPN client is immune to this. And, any browser configured to use encrypted DNS is immune to this. Defense is boring.

Hacked routers display scam COVID-19 virus warnings

Hackers Hijack Routers' DNS to Spread Malicious COVID-19 Apps
by Lawrence Abrams of Bleeping Computer   March 23, 2020
Yet another case of DNS hijacking. No surprise, the vulnerable routers are from D-Link and Linksys. The malicious DNS servers are 109.234.35.230 and 94.103.82.249. The article fails to mention my DNS Tester page which displays the currently in-effect DNS servers. Windows periodically connects to www.msftconnecttest.com to test whether the Internet connection is functional. Bad guys screwed with the DNS for this domain. When Windows runs a connectivity test, a browser opens to display the scam warning about COVID-19. The article says to configure your router to get DNS servers from your ISP. This is wrong. It is safer to use DNS servers from known trusted sources such as Cloudflare, Quad9, OpenDNS, NextDNS or Google, among others.

• New attack on home routers sends users to spoofed sites that push malware by Dan Goodin of Ars Technica. March 25, 2020.

Industry wide flaw reported

pppd vulnerable to buffer overflow due to a flaw in EAP packet processing
by CERT Coordination Center - Vulnerability Note VU#782301   March 4, 2020
A new vulnerability that affects many router vendors was reported by Ilja Van Sprundel of IOActive. There are actually two bugs. The first is in the Extensible Authentication Protocol (EAP) packet processing in the Point-to-Point Protocol Daemon (pppd). The bug is an error in how the code validates the size of the input before copying the supplied data into memory. Exploiting the bug allows an unauthenticated remote attacker to cause a stack buffer overflow. The second logic flaw is in the eap_input() function which may not check if EAP has been negotiated during the Line Control Protocol (LCP) phase. This allows an unauthenticated attacker (the worst type of attacker) to send an EAP packet even if ppp refused the authentication negotiation. The vulnerable pppd code in eap_input will mistakenly process the EAP packet and trigger the stack buffer overflow.
Is your router vendor vulnerable? Results are trickling in. OpenWrt is vulnerable and a fix is being worked on. Synology is vulnerable and a fix is being worked on. TP-Link is vulnerable and a fix is being worked on. Ubiquiti Networks has put out an advisory with updated firmware to address this vulnerability. Apple and Draytek are not vulnerable. The worst responses, so far, have been from Asus, Eero, D-Link, Linksys, Netgear and pfSense. They have not said anything.

• Is Peplink affected by the pppd buffer overflow flaw? March 9, 2020. This will be patched in firmware version 8.1.0 even though, on their platform, the threat to the general public is basically non existent.

FEBRUARY 2020

Thousands of Asus routers hacked

FBI Warned Of Fraudster's Paradise: Up To 130,000 Hacked Asus Routers On Sale For A Few Dollars
by Thomas Brewster of Forbes   February 28, 2020
Somewhere between 50,000 and 130,000 Asus routers have been hacked and are being offered for sale alongside personal information on roughly a half million people. Why? Quoting: "The reasons for fraudsters to use such hacked routers are twofold. First, it masks the origin IP address of the fraudster. Second, fraud detection systems will block a transaction if it's taking place outside of the geolocation where the card is normally used. So if a fraudster has access to either a router in a similar location to their victim's typical transactions or their actual router, it's much less likely their illicit purchase will be blocked." The Asus bug dates back to at least 2018 and has been patched, but since Asus firmware updates are a manual process that is miserably explained, few people ever do it.

Wi-Fi bug - No big woof

Flaw in billions of Wi-Fi devices left communications open to eavesdroppng
by Dan Goodin of Ars Technica   February 26, 2020
A Wi-Fi vulnerability in chips made by Cypress Semiconductor and Broadcom, allows nearby attackers (within Wi-Fi range) to decrypt some over-the-air data. The good news is that its only a drip of data (several kilobytes) and the vulnerable data is only transmitted immediately after disconnecting from a Wi-Fi network. This is a bug in WPA2, but data transmitted via SSL/TLS still has that encryption going for it. Since very little data is transmitted in plain text, this is not a huge issue. The flaw was discovered by Eset. It affects routers from Asus and Huawei as well as iOS devices, Macs, Amazon Echos, Android devices and more. The flaw is known as Kr00k and billions of devices use the flawed hardware/firmware. The bug was discovered months ago, so many devices have available updates to fix this. However, there is no tester, so there is no way to know if any particular device is buggy or not. The big exception are Apple devices. Interestingly, devices that are not vulnerable become vulnerable if connected to a vulnerable router. Known vulnerable routers: Asus RT-N12, Huawei B612S-25d, Huawei EchoLife HG8245H and Huawei E5577Cs-321. What about the other 14,000 routers? Don't know. Eset said nothing about routers they tested and found were not vulnerable. Chances are other Asus routers are vulnerable. The RT-N12 is old and will probably never be patched. In fact, chances are Asus will never say anything about this. Update: Multiple Cisco products are affected by this.

• kr00k by Eset
• KR00K - CVE-2019-15126 SERIOUS VULNERABILITY DEEP INSIDE YOUR WI-FI ENCRYPTION from Eset (PDF)
• ASUS Product Security Advisory A list of Asus security advisories. Their last router update to fix a security issue was Nov 26, 2019
• Wi-Fi Protected Network and Wi-Fi Protected Network 2 Information Disclosure Vulnerability by Cisco Feb 27, 2020. Quoting: "Cisco is investigating its product line to determine which products may be affected by this vulnerability. As the investigation progresses, Cisco will update this advisory ..."

Windows malware guesses Wi-Fi passwords

One of the most destructive botnets can now spread to nearby Wi-Fi networks
by Dan Goodin of Ars Technica   February 11, 2020
Mostly clickbait. The only danger is to Wi-Fi networks that are using a default password. Still, a good reminder about using VLANs. To me, the important point in this article is that the malware phones home to 87.106.37.146 and 45.79.223.161. You really need a router than can block outgoing connections to an IP address.

• Emotet Evolves With new Wi-Fi Spreader by James Quinn of Binary Defense Feb 7, 2020

JANUARY 2020

Ubiquiti UniFi goes to the dark side

You spoke, we didn't listen: Ubiquiti says UniFi routers will beam performance data back to mothership automatically
by Robbie Harb of The Register   January 29, 2020
"Ubiquiti Networks is once again under fire for suddenly rewriting its telemetry policy after changing how its UniFi routers collect data without telling anyone." Clearly, the company can no longer be trusted. That said, they are still much better than Synology when it comes to exfiltrating data. The UniFi routers will collect two types of information, PII (personally identifiable information) and other stuff. You can opt out of the PII being sent (collected too?) in the user interface but not the other data. This leads to the question of exactly what type of data falls into each camp. So far, we don't know. The company claims that UniFi owners can stop the collection of "other data" by manually editing a config file. Exactly what file this is, is not clear in this article. Also, the article is just about UniFi, not any of the other lines from Ubiquiti such as AmpliFi, Alien or Edge. However, someone on Reddit said that an upcoming beta release for the EdgeRouter includes "anonymous crash reporting". In November 2019, you could block this phoning home by blocking domain trace.svc.ui.com. It is not clear if that still applies.

• UniFi - Analytics Data Collection FAQ from Ubiquiti
• See a Reddit comment with instructions on how to block all phoning home by editing the config.properties file. January 29, 2020
• Sure, we made your Wi-Fi routers phone home with telemetry, says Ubiquiti. What of it? You didn't ask for it, we didn't tell you about it, but hey, it clears GDPR so what you gonna do? by Shaun Nichols in The Register Nov 7, 2019
• Reddit comments
• Update: UniFi Phone Home/Performance Data Collection Nov. 2019

Travel Router discussion

The Privacy, Security, & OSINT Show - Episode 153
by Michael Bazzell   January 17th, 2020
A discussion of travel routers. The router he settled on is the GL.iNet AR750s Slate and I have a summary of it on the Resources page. I had purchased the same router months before this show aired.

• The podcast episode for Apple users

Self promotion masquerading as router attack news

Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices
by Cong Zheng, Yang Ji and Asher Davila of Unit42   January 21, 2020
This is the least important router attack I have seen to date. In my opinion, it just self-promotion by Palo Alto Networks. Tomato is an open source alternative firmware for routers. It is not very popular, Unit42 (a division of Palo Alto Networks) found just over 4,600 Tomato routers exposed on the Internet. They also discovered a new variant of the Muhstik botnet that attacks Tomato routers by using the default userid/password to log in to the admin web interface which is on port 8080. Remote administration is off, by default, in Tomato so the number of vulnerable devices can probably be counted on one hand. Muhstik mainly uses infected devices for cryptocurrency mining and DDoS attacks. The usual stuff.

• Internet routers running Tomato are under attack by notorious crime gang by Dan Goodin Jan. 21, 2020. Under attack? Really? It's not even brute force, just the default password. Clickbait this is.

Netgear Routers

Leave your admin interface's TLS cert and private key in your router firmware in 2020? Just Netgear things
by Shaun Nichols   of The Register   January 20, 2020
This is not big critical issue. Netgear left a private key embedded in the firmware for their routers, firmware that anyone can download. In theory, a bad guy could use to impersonate the Netgear domain, routerlogin.net, that they tell customers to use to access the router web administration (they also use routerlogin.com). The exact details are not clear in the article, I don't think the author understands the issue. To me, the most important aspect of this occurred when the researchers that found the problem tried to communicate with Netgear. It went badly and there is no excuse for that. None. Also, if you report a Netgear bug, then silence is the rule. Also bad. Good reasons to avoid Netgear devices.

• The original problem disclosure: Netgear Signed TLS Cert Private Key Disclosure by Nick Starke and Tom Pohl.
• Exploiting Netgear's Routerlogin.com by Saleem Rashid Feb 9, 2020
• Netgear's routerlogin.com HTTPS cert snafu now has a live proof of concept by Gareth Corfield of The Regiser Feb 12, 2020. For the attack to work, the victim has to try to log into their home router after connecting to a compromised Wi-Fi point and downloading malware. Not very likely.

2019   top

NOVEMBER 2019

Lots of D-Link router bugs

D-Link Adds More Buggy Router Models to 'Won’t Fix' List
The bugs page has two stories from mid-November about bugs in D-Link routers. About a dozen routers are deemed too old to fix, so there will be no updates. The other story is about the D-Link DIR-878 router which was hacked by seven different groups at a recent hacking contest. D-Link has said nothing about the hacking and we are left to just guess which other D-Link routers have the same bug.

• Tianfu Cup Round-Up: Safari, Chrome, D-Link Routers and Office 365 Successfully Hacked ThreatPost Nov 18, 2019

More ISP monitoring of your network coming soon

How does Plume get all these ISP partnerships? Open source software
by Jim Salter of Ars Technica   November 12, 2019
Increased monitoring of the network in your home by both your ISP and by Plume is coming. Quoting: "Plume now has partnerships with the first- and second-largest ISPs in the United States, as well as the first- and second-largest in Canada - and also with the National Cable Television Collective (NCTC), a membership organization comprising several hundred independent US cable companies. Earlier this month, we covered the announcement of a Plume partnership with J:COM, Japan's largest ISP ... The real value proposition for ISPs is better support, with faster and cheaper ISP development pipelines. Plume's virtual NOC makes it easy for a support technician to see just what's going on in a customer's network and, therefore, make helpful and accurate assessments about problems. If a customer calls in to complain that their Apple TV, Fire Stick, or Roku keeps buffering, a technician can see at a glance whether the problem is low signal strength or congestion, and they can offer advice accordingly."

Ubiquiti adds telemetry

Sure, we made your Wi-Fi routers phone home with telemetry, says Ubiquiti. What of it?
by Shaun Nichols of The Register   November 7, 2019
You didn't ask for it, we didn't tell you about it, but hey, it clears GDPR so what you gonna do? More details on this are on the Secure Routers page. This article adds nothing to what is on the Secure Routers page, but there are 107 comments as I write this. Ubiquiti owners don't know how good they have it compared to Synology owners. In my tests of the RT2600ac router I found that it phoned home all the time, it was none of our business why and you can't stop it.

OCTOBER 2019

Old routers, old bugs, new attacks

This aggressive IoT malware is forcing Wi-Fi routers to join its botnet army
by Danny Palmer of ZDNet   October 31, 2019
Three old Wi-Fi routers are vulnerable to malware that takes advantage of known vulnerabilities to rope them into a botnet. The malware is a new variant of software that first appeared in 2014, known as Gafgyt. The new variant attacks the Huawei HG532, the Realtek RTL81XX and the Zyxel P660HN-T1A. Vulnerable routers are found by net-wide scans. Interestingly, this latest malware kills any other malware on the router.

• Home and Small Office Wireless Routers Exploited to Attack Gaming Servers by Asher Davila of Unit 42 of Palo Alto Networks. October 31, 2019.

Apple adding some smart home features to 3 routers

Why we need Apple's HomeKit-enabled routers
by Jonny Evans of Computerworld   October 16, 2019
Back in June 2019, Apple announced upcoming HomeKit-enabled routers from Linksys, Eero and cable company Spectrum. Seems like a big nothing to me. The Pepwave Surf SOHO can do anything that needs to be done in terms of isolating devices in your home. Apple software will have three options: Restrict to Home, Automatic, and No Restrictions.

• Where are the HomeKit secured Wi-Fi 6 routers for my iPhone 11? by Jonny Evans Sept. 13, 2019

EoL lists for router manufacturers

Is Your Old Router Still Getting Security Updates?
by Chris Hoffman of How-To Geek   October 12, 2019
Router manufacturers are not forced to update router for any particular amount of time. And, since many compete on price and people buy the cheapest possible routers, the manufacturers have to cut corners somewhere and long-term support is an easy place to cut. After all, how many people will buy a router because the manufacturer promises extended security updates? So how do you tell if your router is still supported? Check the router manufacturer's website. The article has links to End-of-Life lists for eight router vendors. As a reader commented, however, it does not address the many people who use a router provided by their ISP.

SEPTEMBER 2019

Routers still buggy after all these years

SOHOpelessly Broken 2.0
by Independent Security Evaluators   September 16, 2019
In 2013 ISE first researched routers and IoT devices and found many bugs and flaws. Now, in 2019, things are no better. They discovered 125 security vulnerabilities across 13 routers and NAS devices. Or, as they would put it: Security controls put in place by device manufacturers are insufficient against attacks carried out by remote adversaries. Vendors tested: Buffalo, Synology, TerraMaster, Zyxel, Drobo, ASUS, Asustor, Seagate, QNAP, Lenovo, Netgear, Xiaomi and Zioncom (TOTOLINK). All 13 devices had at least one vulnerability that could be leveraged by an attacker to get remote access to the device's shell or administrative panel. They obtained root shells on 12 of the 13 devices, allowing them complete control. Six devices were as bad as bad gets: they could be remotely exploited without authentication. One of these was the Netgear Nighthawk R9000. The ASUS RT-AC3200 router had three types of bugs. This was also a test of the companies, just as much as their software. These companies never responded to ISE: Drobo, Buffalo Americas, and Zioncom Holdings.

• 125 New Flaws Found in Routers and NAS Devices from Popular Brands by Swati Khandelwal September 17, 2019
• Popular consumer and enterprise routers, IoT devices contain remote access vulnerabilities by ZDNet September 16, 2019

Yet another LAN side protocol available on WAN is being abused

Yikes! Another DDoS Weapon, WS-Discovery Amplification Attacks
by A10 Networks   September 2019
What I have to say, is on the Bugs page as these devices should not be exposed on the Internet.

AUGUST 2019

The Wi-Fi networks at WeWork have bad security

WeWork's laughably weak Wi-Fi password is downright dangerous
by Sean Captain of Fast Company   August 21, 2019
WeWork is not even trying when it comes to their Wi-Fi security. The password they use is one of the worst anyone could possibly choose. And, yes, I said the password because they use the same one at multiple locations. The article also dinged them for using WPA2 Personal, which is not really fair. If the password was complex and rotated, this would be fine. That said, if they cared, they would use WPA2 Enterprise rather than WPA2 Personal. Turns out they do care, about making money. The bad Wi-Fi security is used as a lure to sell customers better security for more money. Not mentioned here is that routers can also isolate users from each other, a security feature hardly anyone uses and one that works with WPA2 Personal. Also not mentioned is the DNS environment at WeWork. These things don't come up, typically because the people writing these stories are Art History majors and not familiar with the technology.

Router and IoT firmware still not secure

Huge Survey of Firmware Finds No Security Gains in 15 Years
by Paul Roberts of Security Ledger   August 14, 2019
A study of thousands of device firmwares showed that the security is terrible and has not improved over the last 15 years. The report is from Cyber Independent Testing Lab (CITL), a non-profit organization that conducts independent tests of software security. Their Chief Scientist, Sarah Zatko said "Nobody is trying ... We found no consistency in a vendor or product line doing better or showing improvement. There was no evidence that anybody is making a concerted effort to address the safety hygiene of their products". CITL examined firmware from 18 vendors including ASUS, D-link, Linksys, NETGEAR, Buffalo, Belkin, TP-Link, QNAP, Ubiquiti and others. They did not look at the stuff on my Security Checklist page. Instead they looked a the use of non-executable stacks, Address Space Layout Randomization and stack guards (which prevent buffer overflow attacks). As an example, the ASUS RT-AC55U used none of these security features.

• Tweet by dotMudge

New VPN feature added to AmpliFi

Secure networking is now available to all AmpliFi users anywhere in the world with the AmpliFi Teleport App
by AmpliFi   August 15, 2019
My thoughts on this are on the Mesh Routers page.

Consumer Reports does a poor review of 29 routers

Many Wireless Routers Lack Basic Security Protections, Consumer Reports' Testing Finds
by Nicholas De Leon of Consumer Reports   August 6, 2019
It seems that no matter what computer related topic they cover, Consumer Reports does a poor job. This review of 29 routers is amateurish and, in large part, a waste of time. The advice offered for making any router more secure is less than the short list on the home page of this site. And, no mention of this site? This article does not have the individual router ratings, but I have seen them and they are mostly useless. There is no link here so as not to encourage anyone to read this article. I am working on a long rebuttal. My initial rebuttal is on the Secure Routers page.

• consumerreports.org/wireless-routers/wireless-routers-lack-basic-security-protections/ The URL of the article

Router botnet detected in the Philippines and Thailand

Don't let the crooks 'borrow' your home router as a hacking server
by Paul Ducklin of Sophos   August 7, 2019
SSH (Secure Shell) is the probably the most common program for remotely accessing computers. Your router may be running an SSH server for administrative purposes; perhaps so that your ISP can get into it and make changes. There are multiple ways that bad guys can abuse an SSH server and make money off it. Netlab 360 recently found several hundred Fibrehome routers, model AN5506, in Thailand and the Philippines infected with malware. The malware installed an SSH server on the routers, one that listens on the non-standard port 23455. This appears to be a zombie network of SSH tunnels that the bad guys are holding on to as ready-to-use proxies.

• Test if TCP port 23455 is open in your router
• Some Fiberhome routers are being utilized as SSH tunneling proxy nodes by Netlab 360. The original story source August 2, 2019

Opting out of Comcast public Wi-Fi in your home

Comcast Xfinity is Using your Router as a Wifi Hotspot, at your Expense. Here’s how to Opt Out.
by G.E. Miller of 20 Something Finance   August 1, 2019
Quoting: "Not only are you paying an outrageous $13 per month ($156 per year) ... to lease a sub-par modem, but Comcast is then using that very same modem that you are being overcharged for to provide the revenue-generating Xfinity WiFi service to other customers ... Disabling or opting your modem out of the Comcast Xfinity public wifi hotspot network is fairly simple on the surface, but there have been reports of customers running into issues, and you may have to periodically re-opt-out. Go here to manage your preferences and 'turn off' ..."

• Comcast XFINITY WiFi: Just say no by me June 2014
• How to Replace a Comcast Modem with your Own by G.E. Miller Last updated: August 1, 2019

JULY 2019

Disney's Circle Internet filtering reviewed

Can Disney’s Circle really deliver a porn-free Internet?
by Jim Salter of Ars Technica   July 21, 2019
Not directly a router story, but close. Circle is available both as a standalone device or a service embedded in some Netgear routers. This article reviewed the first generation stand-alone device, a second gen model was recently released. Salter much preferred it inside the router. While he felt that Circle's filtering is best of breed, it does have some quirks and it is easier to escape a kids safe sandbox than it should be. Circle judges websites as either all good or all bad. This can be problem when you allow sites that contain both innocent and explicit content (e.g. Reddit, Flickr, Imgur). The external device intercepts all traffic using ARP spoofing. The upside is that it connects to a router the same way every other device does (Ethernet or WiFi). The downside is speed, it slows things down. Some high end switches and routers detect this as an attack and block the Circle device. A reader comment mentioned that it can block all new devices, by default.

Still more DNS server hijacking on Brazilian routers

Brazil is at the forefront of a new type of router attack
By Catalin Cimpanu of ZDNet   July 12, 2019
Avast reported that more than 180,000 routers in Brazil had their DNS settings changed in the first half of 2019. Basically, look at a webpage and your router gets hacked (assuming it has a default password). Malicious DNS servers send victims to scam websites with real names. Or, they replace legitimate ads with ads that are malicious or with ads that make the bad guys money. Multiple groups are doing this. Needless to say, no article on the subject mentioned my Test Your DNS page which is like missing the elephant in the room. Sad.

• Website drive-by attacks on routers are alive and well. Here’s what to do by Dan Goodin July 11, 2019
• Avast blocks millions of attempts in Brazil to send users to malicious websites by Avast July 11, 2019
• Router Exploit Kits: An overview of RouterCSRF attacks and DNS hijacking in Brazil by David Jursa, Alexej Savčin of Avast July 10, 2019. Suggested defense? Avast software of course.
• NCSC Issues Alert About Active DNS Hijacking Attacks by Ionut Ilascu for Bleeping Computer July 14, 2019

Yet another Cisco screw-up

Huawei cryptographic keys embedded in Cisco’s firmware
by SEC Technologies   No date
OK, the mistake is in software that runs on switches rather than routers, but close enough. Cisco firmware was found to contain digital certificates and keys belonging to Futurewei Technologies, a US-based R&D arm of Huawei. Yes, Huawei. Turns out Cisco was using a Huawei-made open-source package during testing and forgot to remove it before rolling out the software to the world. Oops. In fairness, this was not a threat to Cisco clients. On the other hand, based on feedback from SEC Technologies, Cisco also removed some unnecessary software and updated third party software, included in their firmware, that had multiple vulnerabilities. Of course, Cisco will focus on the oversight that caused no immediate threat and they not say anything about shipping software with known vulnerabilities. In part, this is a plug for an IoT Inspector service from SEC Technologies. It seems to work.

• Seriously? Cisco put Huawei X.509 certificates and keys into its own switches by Liam Tung July 4, 2019

D-Link agrees to do good stuff

D-Link must suffer indignity of security audits to settle with the Federal Trade Commission
by Max Smolaks of The Register   July 3, 2019
Back in January 2017, the FTC accused D-Link of a long list of shoddy security practices, including, non-removable default passwords in IP cameras, command-injection flaws, leaked router security keys and plain-text password storage in its mobile app. The case was finally settled with D-Link agreeing to do good stuff. They will submit to security audits every two years for the next decade. They pledged to take security seriously for the next 20 years. Of course, they admitted no guilt. Two things stood out to me. First, they agreed to automatic firmware updates. Second, they will tell customers when their routers are no longer getting bug fixes. Quoting from the agreement: At least 60 days prior to ceasing security updates for a Covered Device, a clear and conspicuous notice to consumers who registered their Covered Device, through the communication channel(s) the consumer chose at the time of registration, and a clear and conspicuous notice on the product information page of the Covered Device on Defendant’s website that the Covered Device will no longer receive firmware updates..

• PROPOSED ORDER and JUDGMENT The legal settlement
• D-Link to undergo security audits for 10 years as part of FTC settlement by Catalin Cimpanu of ZDNet July 3, 2019

JUNE 2019

Apple HomeKit will integrate with some routers

Apple breathes new life into HomeKit with a focus on privacy and security
by Kevin C. Tofel   June 5, 2019
The Apple smart home system, HomeKit, will add support for routers from Linksys, Eero and Spectrum. We don't yet know exactly what this means, there are no specifics. The concept is that smart home devices will be isolated from seeing the full home network (LAN). None of the articles about this mentioned that you can already isolate devices using a Guest Wi-Fi network. For more about isolating devices into Virtual LANs, see the VLAN page right here.

MAY 2019

I ran a test

Barbarians at the gate - Attacks/Probes of a router
by me   May 28, 2019
For a day, I left my router open to incoming connections looking for Microsoft Remote Desktop. There were 62 attacks/probes looking for a Windows machine to remotely control. The probes came from 20 different countries and from 7 different states in the US. One service, one day. Router security matters.

An unspecified brand of routers is being hacked to install malware on PCs

Hackers abuse ASUS cloud service to install backdoor on users' PCs
by Dan Goodin of Ars Technica   May 16, 2019
According to Eset, bad guys are abusing an ASUS self-update mechanism for their WebStorage software to install Windows malware. Eset believes (but can't be 100% sure) that the attacks are the result of router based man-in-the-middle interception that exploits HTTP connections to ASUS servers. Of course, the HTTP is on Asus, not the router. Also on Asus is incomplete code-signing to validate the authenticity of downloaded files. Eset found that most of the organizations that were hacked were using routers made by the same manufacturer, which they declined to identify. The routers have their web admin interface exposed to the Internet, security mistake number 7 on the short list on the home page of this site. Get a Chromebook.

• Plead malware distributed via MitM attacks at router level, misusing ASUS WebStorage by Anton Cherepanov of Eset. May 14, 2019. Original source of the story.

A new take on Router Security

Airbnb host thrown in the clink after guest finds hidden camera inside Wi-Fi router
by Kieren McCarthy of The Register   May 8, 2019
I did not see this coming. A router in an Airbnb in China was found to have a peephole drilled into the front of it, right next to the LEDs that indicate Ethernet activity. The hole looked very much like the Ethernet LEDs. Blending in with the crowd. The hole was connected to a camera that was inside the router.

Still another Critical Cisco bug

Sinister secret backdoor found in networking gear perfect for government espionage: The Chinese are – oh no, wait, it's Cisco again
by Iain Thomson of The Register   May 2, 2019
This bug is as bad as bad gets. An unauthenticated, remote bad guy can connect to the buggy devices as the root user. The NSA must have loved this one. The issue is a default SSH key pair. Bad guys only need to open an SSH connection via IPv6 to a vulnerable device using the SSH key pair to get root access to the system. In summary: BACKDOOR. BACKDOOR. BACKDOOR. This was discovered and reported by Oliver Matula of ERNW Enno Rey Netzwerke. Be sure to scroll down this page for other brutal flaws in Cisco software. Cisco also fixed 22 high severity bugs and 18 considered medium severity. Seem like lots of bugs to you?

• Cisco Warns of Critical Nexus 9000 Data Center Flaw by Tara Seals of Threatpost May 2, 2019
• Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Default SSH Key Vulnerability The critical bug. From Cisco May 1, 2019
• Cisco Security Advisories and Alert Details of the other 40 bugs that Cisco fixed on May 1, 2019.

APRIL 2019

Me on using a router to defend against IoT and Windows 10

Why I like my router
by Michael Horowitz   April 26, 2019
Tracing network activity to see if you have a vulnerable IoT device. Blocking vulnerable and insecure IoT devices. Defending against Windows 10 spying with DNS.

DNS changing attacks on consumer routers

Ongoing DNS hijackings target Gmail, PayPal, Netflix, banks and more
by Dan Goodin of Ars Technica   April 5, 2019
As long there are consumer routers that don't self-update or have been abandoned (no more bug fixes) this hardly qualifies as news. That said, yet again, bugs in consumer routers are being exploited to configure the routers with malicious DNS servers. As always, the malicious DNS servers send victims to scam copies of real websites. For some reason, the fact that the malicious DNS servers, in this case, were hosted by Google seems noteworthy. It is not. Most of the buggy routers are from D-Link, again, not news. They are the D-Link DSL-2640B, DSL-2740R, DSL-2780B, DSL-526B and 260E. In addition, some routers from Secutech and TOTOLINK were attacked. The true disgrace here is the reporting about this from people that do not really understand the topic. As a result, the defensive measures offered by Ars Technica and ZDNet are, to be kind, sub-optimal. Looking for Extended Validation certificates, for example, is not mentioned. Heck, the scam sites in this case are particularly low rent, served over HTTP, so just looking for DV certificate would be sufficient defense. And, I have a list here of many websites that report on your DNS servers. Using them avoids the need to log in to the router which too many people are unable to do. And trusting router vendors to fix flaws, the knee jerk reaction, is being unjustifiably optimistic. In Google's case it is shifting blame too.

• Ongoing DNS hijacking campaign targeting consumer routers by Troy Mursch April 4, 2019. Original report.
• Hacker group has been hijacking DNS traffic on D-Link routers for three months by Catalin Cimpanu for ZDNet April 4, 2019
• Hackers Abuse Google Cloud Platform to Attack D-Link Routers by Lindsey O'Donnell for Threatpost April 5, 2019

Excellent router security article

TP-Link router zero-day that offers your network up to hackers
by Paul Ducklin of Sophos   April 2, 2019
An excellent article about router security. As the title suggests, the focus of the article is the recently disclosed flaw in a TP-Link router, but the article is a worthwhile read for everyone as it includes a defensive strategy against ISP supplied devices. And, it is another example of a consumer router company not caring about security.

MARCH 2019

Huawei clearly does not care about router security

Huawei bungled router security, leaving kit open to botnets, despite alert from ISP years prior
by Gareth Corfield of The Register   March 28, 2019
This is something we have seen before from router vendors. Huawei routers had a known bug and the company fixed the bug in some of their routers but not all of them. Do the least amount of work possible to make the spotlight go away. An ISP told Huawei about a trivially exploitable remote code execution flaw back in 2013. The bug meant that the HG523a and HG533 routers/gateways could be hijacked by bad guys. Huawei fixed the vulnerability sometime in 2014. However, other Huawei devices in the HG series, suffered from the same flaw and remained vulnerable for years. The bug, in UPnP, was discovered, yet again, years later. Again, a patch was issued. This article leaves out an important point. The bug in the UPnP software is only half the story. That UPnP is exposed to the Internet, is actually a larger flaw. This too, goes back to 2013.

• On the same day as the above, there were stories in the news about other Huawei programming sloppiness.
  Britain’s spy agency delivers a scathing assessment of the security risks posed by Huawei to the country’s telecom networks by Ellen Nakashima of the Washington post. March 28,2019.

Cisco yet again, again

RedTeam Pentesting
On March 27, 2019, German security firm RedTeam Pentesting issued three advisories about bugs in the Cisco RV320 Dual Gigabit WAN VPN Router. The biggest severity is to Cisco's reputation. These bugs were initially identified in September 2018, and the first three advisories about them were released Jan. 23, 2019. Cisco issued fixes, but, the fixes were flawed. These routers were reported being attacked in January 2019 - there is a summary of this below on this page.

• Cisco bungled RV320/RV325 patches, routers still exposed to hacks by Catalin Cimpanu of ZDNet March 28, 2019. Bugs also affect the RV325.
• Cisco RV320 Command Injection RedTeam Pentesting discovered a command injection vulnerability in the web-based certificate generator feature of the Cisco RV320 router which was inadequately patched by the vendor.
• Cisco RV320 Unauthenticated Configuration Export RedTeam Pentesting discovered that the configuration of a Cisco RV320 router can still be exported without authentication via the device's web interface due to an inadequate fix by the vendor.
• Cisco RV320 Unauthenticated Diagnostic Data Retrieval RedTeam Pentesting discovered that the Cisco RV320 router still exposes sensitive diagnostic data without authentication via the device's web interface due to an inadequate fix by the vendor.

Talos finds 11 flaws in Cujo not-so smart firewall

Vulnerability Spotlight: Multiple Vulnerabilities in CUJO Smart Firewall, Das U-Boot, OCTEON SDK, Webroot BrightCloud
by Cisco Talos   March 19, 2019
Cujo sits between your router and modem (logically or physically) and offers security protection (but no privacy protection). The device contains 11 bugs. In the worst case, the bugs could allow attackers to take complete and permanent control of the Cujo. All the bugs have been fixed and Cujo should auto-update. The Cujo website says nothing about this. Consider that when deciding whether to trust them.

• Host of Flaws Found in CUJO Smart Firewall by Tara Seals March 19, 2019

Router advice from Readers Digest is just as bad as you would expect

This Is How Often You Should Be Rebooting Your Router
by Erin Kayata of Readers Digest   no date
Really? Router advice from Readers Digest? On the upside, it's not all bad. Re-booting a router can't hurt and, as the article says, its a good thing to do when there are problems. Also, there is some malware on routers that is removed by rebooting. But, an expert claims rebooting will fix slow Wi-Fi. Things go further downhill with the author claiming that regularly turning a router on and off makes for "a faster connection." And, if witches are haunting the router, rebooting gets rid of them (just joking). The article says that rebooting can "prevent yourself from being hacked" which is not true. The ultimate heap of baloney is this: "According to Consumer Reports, your Internet provider assigns a temporary IP address to each of your devices which can change at any time. If your router doesn’t catch the change, your connection can become slow." My joke about haunted witches is closer to the truth.

Another company buying router bugs

As Phones Get Harder to Hack, Zero Day Vendors Hunt for Router Exploits
by Joseph Cox of Motherboard   March 7, 2019
Obtaining vulnerabilities for mobile phones is getting harder, so companies that sell exploits are increasingly looking for attacks that target routers instead. The article is mostly about Crowdfense which buys zero day exploits from researchers and sells them to government agencies. They are now offering a total of $15 million to hackers with exploits for sale which includes up to $100,000 for router attacks. Zerodium does the same thing, see the January 2019 section below.

FEBRUARY 2019

Cisco yet again

Management Interfaces in Three Models of Cisco Networking Devices Are Vulnerable to RCE Attacks
by Ryan Seguin of Tenable   February 27, 2019
This is as bad as bad gets. Quoting: "Cisco has released a security advisory for CVE-2019-1663, a remote code execution (RCE) vulnerability present in the remote management interface on certain router and firewall devices, the RV110W, RV130W, and RV215W. The vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code through malicious HTTP requests." Patches have been released. To be remotely hacked the routers must have remote administration enabled and it is disabled by default. The bug is critical, yet it was first discovered October 25, 2018. The delay in issuing a fix strikes me as much too long. These are old devices. For example, the RV215W was reviewed by PC Magazine in January 2013 and the review noted it did not have gigabit Ethernet and Wi-Fi was only on the 2.4 GHz band.

• Cisco RV130 – It's 2019, but yet: strcpy by Dave Null of Pen Test Partners February 28, 2019. They are one of two companies that found the bug. These routers do not run Cisco IOS, they instead use some form of embedded Linux. This article has technical details of the flaw which is a buffer overflow caused by overly-long password.
• Cisco RV110/RV130/RV215 Unauthenticated Configuration Export Vulnerability (CVE-2019-1663): What You Need to Know by boB Rudis of Rapid7 Feb. 28, 2019. There are just shy of 12,000 exposed devices on the internet.
• Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability a Cisco security advisory. Feb. 27, 2019
• Cisco: Patch routers now against massive 9.8/10-severity security hole by Liam Tung February 28, 2019

JANUARY 2019

Two buggy Cisco routers are being attacked

Hackers are going after Cisco RV320/RV325 routers using a new exploit
by Catalin Cimpanu of ZDNet   January 27, 2019
Bad guys are trying to exploit two just-patched flaws in two Cisco routers. The patches were released on January 23, 3019. Proof of concept code to exploit the bugs was released the next day. The day after that, the attacks started. The first flaw (CVE-2019-1653) lets an attacker get device configuration details without a password. The flaws exist on both the LAN and WAN side. The second bug (CVE-2019-1652) allows an attacker to run admin commands on the device, again without a password. Here too, the articles I read did not say if this bug is LAN or WAN side, or both. It is estimated there are 6,247 vulnerable Cisco RV320 routers, and 3,410 vulnerable Cisco RV325 routers. The vast majority of them are on the networks of US based ISPs. More information about the bugs is on the Bugs page. The RV320 was first released in June 2013. It now sells for about $140. It is dual WAN and supports SSL, PPTP and IPSec VPNs. No Wi-Fi. The true takeaway, for me, is whether Cisco is a trustworthy router vendor. Earlier this month, there was this story: Cisco warns: Patch now or risk your security appliance choking on single rogue email and they seem to have lots of bugs: Cisco Security Advisories and Alerts.

• Over 9,000 Cisco RV320/RV325 routers are vulnerable to CVE-2019-1653 by Troy Mursch. Original report. January 26, 2019
• Hackers Targeting Cisco RV320/RV325 Routers Using New Exploits by Ionut Ilascu of Bleeping Computer January 27, 2019

Japanese government to do some hacking

Japanese government plans to hack into citizens' IoT devices
by Catalin Cimpanu of ZDNet   January 27, 2019
Me: The article starts in the middle, not the beginning. On a secure network, the IoT devices can not be accessed from the Internet. While IoT devices need to make outgoing connections, they should not be allowed to accept unsolicited incoming connections from every bad guy in the world.
Article summary: The Japanese government has authorized its employees to hack into IoT devices in Japan find insecure ones. They will start looking for routers with default passwords and common passwords. The Japanese are worried about the Summer Olympics in Tokyo 2020, specifically that hackers might abuse IoT devices to launch attacks against the Olympics.
Me: This is a good thing to do, but it will not protect the Olympics - attacks can be launched from anywhere. You can test your our own router using the many tests on my Router Tester page. You can also see what the outside world has found on your public IP address on my Shodan page.

Clickbait from Wired

Your old router is an absolute goldmine for troublesome hackers
by Amit Katwala of Wired UK   January 14, 2019
I consider this article is clickbait, not because of any exaggerations or lies, but because of its focus on the bad stuff. Hair on fire and all that. It omits defensive steps people can take, steps that are the sole reason for this website. In fact, it omits me, after I was interviewed by email by the author. And, great editing: "ISPs could be doing more to educate, for example by regular email bulletins to provide guidance and firmware updates, but that could potentially users them vulnerable to phishing scams." All that said, things are indeed bad.

Maybe avoid router brands targeted by Zerodium?

How to Sell Your 0day Exploit to ZERODIUM
by Zerodium
Quoting: "ZERODIUM is the leading exploit acquisition platform for premium zero-days and advanced cybersecurity capabilities. We pay BIG bounties to security researchers to acquire their original and previously unreported zero-day research ... at ZERODIUM we focus on high-risk vulnerabilities with fully functional exploits and we pay the highest rewards (up to $2,000,000 per submission)." They pay for bugs in these brands of routers: ASUS, Cisco, D-Link, Huawei, Linksys, MikroTik, Netgear, TP-Link, and Ubiquiti. Perhaps, using a different brand makes you safer? It is always better to be a lesser target.

• Steve Gibson on Zerodium on his Security Now podcast, Episode 697 January 15, 2019. And, Show Notes PDF

Spectrum/Charter to start using Cujo in 2019

Charter Communications Goes With CUJO AI For Customer Security and Privacy
by Julio Urquidi   January 8, 2019
There is, as yet, no meat on the bones of this story. Still, a Spectrum executive said it will provide "... Spectrum Internet customers advanced security, privacy and additional control over their in-home networks..." Being lied to is commonplace, so no surprise, that it will reduce privacy not increase it. And, customers have all the control they could possibly want as things stand since Spectrum lets you replace all their hardware with your own. Even using their hardware, they do not (as far as I know) prevent customers from making configuration changes to the router/gateway they provide. My brief take on Cujo is on the Resources Page.

• Charter Communications Chooses CUJO AI to Enhance the Spectrum Internet Connected Experience Press Release from Cujo. Quoting: Cujo "...helps various ISP departments reduce costs, save time..."

Avast report says the worst router attacks are still to come

Hacking attacks on your router: Why the worst is yet to come
by Danny Palmer of ZDNet   January 3, 2019
Avast issued a report with predictions for 2019 and this article summarizes the router section. Quoting: "Cyber criminals are only scratching the surface when it comes to exploiting vulnerabilities in routers ... and the worst is yet to come, with attackers set to use compromised devices for a wider variety of malicious activities." Some reasons why: VPNfilter was real bad. People don't update router firmware. People ignore routers and won't know if theirs gets hacked. Poor passwords and default passwords. Malware source code has leaked so anyone can use it. The defensive advice offered by the FBI is lame.

• Avast Threat Landscape Report - 2019 Predictions PDF
• Steve Gibson discussed the router section of the Avast report on the January 15, 2019 episode of his Security Now podcast.

Exposed router ports attacked yet again

Hacker Streaming PewDiePie Videos on Exposed Chromecast Devices
by Lawrence Abrams of Bleeping Computer   January 2, 2019
A new hacking campaign is targeting Chromecast adapters, Smart TVs, and Google Home. At the moment, the attackers are merely playing a video urging victims to subscribe to a YouTube channel. Pretty harmless. However, the attacks could turn mean very easily. According to a website the attackers created, they can remotely play media on your device, rename your device, factory reset it, reboot it, force it to forget all wifi networks, force it to pair to a new Bluetooth speaker/wifi point. In addition, exposed devices leak information: the current WI-Fi network name, saved Wi-Fi networks, the bluetooth devices an exposed device has paired with, the alarms that are set, and much more. The hackers claim they were able to retrieve approximately 123,000 vulnerable devices using Shodan, with 100,000 actually being accessible. The exposed TCP ports are 8008, 8009, and 8443, which are normally used for management functions.

• CastHack Hacking Chromecasts/Google Homes/SmartTVs. Website setup by hackers
• Test if TCP port 8008 is open
• Test if TCP port 8009 is open
• Test if TCP port 8443 is open
• Hacker hijacks thousands of Chromecasts and smart TVs to play PewDiePie ad by Catalin Cimpanu of ZDNet January 2, 2019

2018   top

DECEMBER 2018

Brutal bug in Orange routers reveals Wi-Fi passwords to anyone

Over 19,000 Orange modems are leaking WiFi credentials
By Catalin Cimpanu of ZDNet   December 24,2018
Nearly 19,500 Orange Livebox ADSL gateways are leaking their WiFi SSID and password to a remote unauthenticated users. An attacker is exploiting a vulnerability (CVE-2018-20377) that was first described in 2012. Yes, 2012. All the bad guys have to do is request the URL get_getnetworkconf.cgi. What a disgrace. Most of the vulnerable devices are assigned to customers in France and Spain.

• Over 19,000 Orange Livebox ADSL modems are leaking their WiFi credentials by Troy Mursch December 23, 2018. The original report.

Netgear router fails to find updated firmware

Security Now Podcast Episode 694
by Steve Gibson of grc.com   December 18, 2018
Gibson read a letter from a listener who was having poor Wi-Fi performance on a Netgear router. The router said the installed firmware was the latest, but eventually, the listener checked the Netgear website and, sure enough, there was updated firmware. Installing the update restored the Wi-Fi performance. The question this raises, is whether the router was infected with malware which blocked it from reporting newer firmware. Had the listener read the Ongoing Care and Feeding section on the home page of this site, he would have rebooted the router periodically just for good luck. Rebooting clears up many malware infections.

A very different take on router security

A look at home routers, and a surprising bug in Linux/MIPS
by Parker Thompson, Sarah Zatko, Mudge Zatko of Cyber Independent Testing Lab   December 7, 2018
Quoting: "At Cyber-ITL, our mission is to empower consumers to protect themselves by reporting on the security of popular products. We reviewed 28 popular home routers for basic hardening features. None performed well ... We analyzed the firmware images of 28 popular home routers, checking for basic code hygiene and software safety features. What we found was disappointing: none of the routers made consistent use of basic software safety features like ASLR, stack guards, and DEP - features which have been standard in desktop environments for over 15 years ... These findings suggest an industry-wide failure to audit and test the security of the software running on these products. Indeed, our review shows that even the most basic practices are being largely ignored. The absence of these security features is inexcusable: the features discussed in this report are easy to adopt, come with no downsides ... while none of the routers we reviewed scored well, the Linksys WRT32x scored the best ... there is little consistency in terms of security practices even within the models of the same brand ... this poor showing implies an apathetic attitude towards applied consumer safety and security..." It is not clear to me just how important these features are. As I understand them, they defend the OS from attack by malware. However, a router is not a general purpose OS. The only software running on the router is software provided by the hardware manufacturer. No one runs a web browser on their router.

• Build Safety of Software in 28 Popular Home Routers the actual report (PDF)
• Hacker News discussion of this
• Most Routers Have Terrible Security, But There’s One That Doesn’t Suck by Paul Wagenseil of Toms Guide Dec 18, 2018
• Twitter thread of 21 tweets by Robert Graham ‏ @ErrataRob who disagrees in large part with this research. Dec 16, 2018
• Twitter thread by @dotMudge about the report
• Most home routers don't take advantage of Linux's improved security features by Catalin Cimpanu of ZDNet January 4, 2019. Router firmware rarely includes ASLR, DEP, or RELRO protections

NOVEMBER 2018

Yet another way to abuse UPnP

Hackers are opening SMB ports on routers so they can infect PCs with NSA malware
by Catalin Cimpanu of ZDNet   November 28, 2018
UPnP has been a problem for routers for years. It is one of the first things that should be disabled. UPnP was only meant to be used on a Local Area Network but the morons that program many routers exposed it on the Internet. Its like a doctor operating on the wrong leg. Routers that expose UPnP to the Internet have been abused time and time again. In this latest twist, bad guys are re-configuring the router to allow them access to shared folders on a victim's network. They are attacking and abusing Windows file sharing that runs on TCP ports 139 and 445 (among others). Akamai detected this malware campaign and they call it EternalSilence. They report that of the 277,000 routers with vulnerable UPnP services exposed online, 45,113 have been compromised this way. As if copying all the shared files wasn't enough, by exploiting assorted bugs, this type of access can also infect both Windows and Linux computers with malware. Akamai said "Administrators will have problems detecting the malicious NAT injections, as there is no administrative visibility into them on an injected router." I have my doubts about that as I have seen routers expose this type of information. They also say: "The best way to identify if a device is vulnerable or actively being leveraged for UPnProxying is to scan an end-point and audit it's NAT table entries," but it is not clear if this scanning is done from the LAN side or the WAN side. Frankly, the suggested defensive steps from Akamai are useless. And neither the ZDNet, Register or Ars articles add anything of value. Port forwarding requires knowledge of the LAN side subnet. It is not clear if the bad guys can learn this from the router or if they merely guess at default values.

• UPnProxy: EternalSilence by Akamai SIRT Nov 28, 2018. The original report.
• Testing if a router is exposing UPnP on the Internet is a bit complicated. I have a whole section on testing for UPnP in the Test Your Router page.
• Router attack exploits UPnP and NSA malware to target PCs by John Dunn for Naked Security. Dec 3, 2020.
• Lowering the attack surface is a tried and true way to be safer. UPnP is just one of many things that should be disabled on a router, if they are not being used. I have a long list here on the Stuff to Turn Off page.
• Here are another 45,000 reasons to patch Windows systems against old NSA exploits Richard Chirgwin in The Register Nov. 30, 2018. Note the link to a January 2008 article suggesting that people disable UPnP.
• Mass router hack exposes millions of devices to potent NSA exploit by Dan Goodin of Ars Technica Nov. 29, 2018. Adds nothing to the story.

Germany weighs in on Router Security

Germany pushes router security rules, OpenWRT and CCC push back
by Richard Chirgwin of The Register   November 20, 2018
"Last week, in a attempt to address broadband router security, the German government published its suggestions for minimum standards – and came under immediate criticism that its proposals didn't go far enough." The rules are guidelines for manufacturers, they are not enforceable laws. This site has guidelines for everyone else. Vendors that adhere to the guidelines can indicate this with a sticker on their routers. The German Federal Office for Information Security (BSI), said the guidelines were the result of consultations with vendors, network operators, and consumer advocates. Hard to imagine more of a consumer advocate for router security than me. I was not contacted. Among their suggestions that are slightly off the beaten path: Guest Wi-Fi networks should not have access to device configuration, factory resets should put the router into a secure state, and all personal data should be deleted during a factory reset. The Chaos Computer Club (CCC) and OpenWrt both felt the guidelines did not go far enough and demanded that: "Vendors have to inform customer before buying the product for all devices being sold in Germany, how long the device will get security updates in case problems are found" and "the customer must have the possibility to install custom software on their devices..." There will always be some disagreement, but this is a first step, one that no other country has taken.

• BSI TR-03148: Secure Broadband Router Requirements for a secure Broadband Router. Version: 1.0 November 2, 2018. The report in PDF format (in English)
• BSI TR-03148 Sichere Breitband Router A writeup about the paper from the BSI (in German)
• Germany proposes router security guidelines by Catalin Cimpanu of ZDNet November 26, 2018
• My Security Checklist

Let us not forget bad D-Link security

Uncle Sam, D-Link told to battle in court over claims of shoddy device security: Judge snubs summary judgment bids
by Richard Chirgwin of The Register   November 6, 2018
The Federal Trade Commission (FTC) filed a lawsuit against D-Link in January 2017 complaining of assorted bad security practices, including hard-coded passwords, command-injection vulnerabilities, misplaced security keys, and plaintext password storage. They claim there was misrepresentation because D-Link touted the advanced security of its products. More below. The legal battle is going to trial on January 14, 2019.

A large router botnet thanks to a 5 year old bug

IoT botnet infects 100,000 routers to send Hotmail, Outlook, and Yahoo spam
by Catalin Cimpanu for ZDNet   November 7, 2018
The past two months have seen the rise of the new BCMUPnP_Hunter botnet composed of roughly 100,000 home routers. Analyzed by the Netlab team at Qihoo 360, the botnet exploits a five-year-old bug in the Broadcom UPnP SDK which is embedded in thousands of router models from multiple vendors. The vulnerability is as bad as bad gets, a remote un-authenticated attacker can execute malicious code the router. The botnet scans for routers with an exposed UPnP interface on port 5431. The botnet is sophisticated and newly programmed by someone quite good at their craft. Infected routers both send SPAM and function as proxy nodes to hide the location of the bad guys.

• BCMPUPnP_Hunter: A 100k Botnet Turns Home Routers to Email Spammers by Hui Wang and RootKiter of 360Netlab. November 7, 2018. This is the original source of the story. It cites 116 different type of infected devices they have observed so far, including routers from D-Link, Verizon Actiontec, Linksys, TP-LINK , CenturyLink Technicolor and ZyXEL. They also note that Broadcom UPnP is also used by Asus and Netgear.
• Test TCP port 5431 on your router.
• Ars Technica got to this a week late: A 100,000-router botnet is feeding on a 5-year-old UPnP bug in Broadcom chips

OCTOBER 2018

Routers hacked in Poland to send SMS messages

The camera makes fun of the SMS bill
by CERT Orange Polska   October 31, 2018
Assorted devices, including routers, that use SIM cards for Internet access were hacked to send SMS messages to foreign countries, earning the bad guys money from the SMS termination. Some hacked devices were: D-Link DWR-921 4G LTE routers, Teltonika RUT240 industrial routers, Dahua CCTV devices (disputed) and Digi modems. It is thought that the devices were vulnerable because of default passwords. The D-Link DWR-921 router also has a known Directory Traversal bug that lets attackers download a configuration file with a unencrypted passwords. This router will not be fixed by D-Link and it suggested to throw them away. Both articles are in Polish but Chrome translation is good enough to get the gist.

• Errors in routers causing bills for many thousands of PLN by Anna Wasilewska-Śpioch October 31, 2018

Hacker takes pity on MikroTik routers

A mysterious grey-hat is patching people's outdated MikroTik routers
by Catalin Cimpanu of ZDNet   October 12, 2018
In fairness to MikroTik they have been patching reported bugs quickly. However, its no surprise, that their customers do not install the patches. A lone person has taken pity on unpatched MikroTik routers and is patching them so they can not be abused by bad guys. Using the name Alexey, this person has bragged about this on a Russian blogging platform. He adds firewall rules that block access to the router. On this site, the Test Your Router page links to many online services that test your router for open TCP/IP ports. The same for the Shodan page. The worst bug (CVE-2018-14847) was patched in April 2018. It lets a bad guy download the user database file. Once decrypted, this gives bad guys access to the username/password to log in remotely. Alexey claims to have patched over 100,000 MikroTik routers. To put this in perspective, there are over two million MikroTik routers in use and over 420,000 show signs of infection. Bad guys who are installing malware on these routers are not closing WAN side ports, so they can still be modfiied.

Xiongmai video surveillance devices are extremely insecure

Using a router to defend against Xiongmai video devices
by Michael Horowitz (me)   October 10, 2018
OK, the Xiongmai devices in question are not routers. But, they are so terribly insecure that security firm SEC Consult recommends throwing them in the trash. In contrast, I suggest a number of ways to isolate them while continuing to use them despite their many security issues. My suggestions can apply not just to Xiongmai devices but to all insecure IoT devices.

• Millions of Xiongmai Video Surveillance Devices Can be Hacked via Cloud Feature (XMEye P2P Cloud) by SEC Consult Oct. 9, 2018
• Over nine million cameras and DVRs open to APTs, botnet herders, and voyeurs by Catalin Cimpanu of ZDNet October 9, 2018

MikroTik devices must be patched

October 7, 2018: RouterOS from MikroTik was patched with the latest bug fixes at the end of August and in September (they maintain different branches of their firmware). Four bugs that were just patched were found by Jacob Baines of Tenable Research. And, a bug that was patched back in April 2018 was much more serious than previously believed. Only 30% of MikroTik devices have been patched. Details are on the Bugs page. New attacks will surely follow.

Good news

Netgear sent me an email message, informing me of the availability of new firmware for the EX3800 range extender. The email included a link to How do I upgrade firmware on my NETGEAR WiFi Range Extender? Well done.

SEPTEMBER 2018

GhostDNS, yet another DNS changing router attack

70+ different types of home routers(all together 100,000+) are being hijacked by GhostDNS
by Netlab 360   September 29, 2018
Starting September 20, 2018, Netlab noticed an existing malware campaign ramp up its attacks with new scanners. Radware blogged about this campaign back in August (2018), but Netlab says it goes back even further. They call it GhostDNS and it now attacks more than 70 different routers. They have seen it infect over 100,000 routers, so far. Malicious DNS servers are used to send victims to fake/scam versions of websites. Rather than using a similar domain name (citibank.edu instead of citibank.com) users deal with the real domain name but are directed to a scam site nonetheless. They have observed GhostDNS targeting at least 52 domains so far, including major banks, telcos, ISPs, media outlets, Avira and Netflix. The GhostDNS malware campaign consists of: Shell DNSChanger, Js DNSChanger, PyPhp DNSChanger, a Phishing Web System, a Web Admin System and a Rogue DNS System. There are over 100 attack scripts. Routers are attacked from both sides, from the WAN and from the LAN. 88% of infected routers are in Brazil. Some companies making vulnerable routers are D-Link, Tenda, TP-Link, Roteador and (of course) MikroTik. The full list of known vulnerable routers is in the blog posting. Netlab 360 has been working to take components of GhostDNS off-line. The best defense against all types of DNS attacks is to be familiar with and look for indications that a website uses Extended Validation.

• GhostDNS Malware Security from TP-Link. Oct. 10, 2018. A reasonable response with reasonable router security suggestions.
• 100,000 home routers recruited to spread Brazilian hacking scam by Richard Chirgwin for The Register. Oct 2, 2018

A sophisticated botnet with no obvious purpose

Torii botnet - Not another Mirai variant
by the Avast Threat Intelligence Team   September 27, 2018
The Telnet honeypot of security researcher Vess On Security was attacked by a new botnet coming from Tor exit nodes. Hard to imagine that devices still leave themselves exposed to Telnet. The malware contains unprecedented levels of sophistication, yet it has has no obvious purpose. It can exfiltrate data in quite a few different ways and supports multiple layers of encrypted communication. While it phones home on TCP port 443, this is deceptive because it does not use TLS. While most IoT malware is flushed when the device reboots, Torii uses six different methods to maintain persistence. The malware is modular in design and can infect devices running MIPS, ARM, x86, x64, PowerPC, and SuperH, among others.

• Meet Torii, a new IoT botnet far more sophisticated than Mirai variants by Charlie Osborne of ZDNet September 28, 2018

Still more about VPNfilter

Researchers find Russian VPNfilter malware was a Swiss Army hacking knife
by Sean Gallagher of Ars Technica   September 26, 2018
Reminder of old news: VPNfilter had been detected on a half million routers in 54 countries. And, it is the rare malware that survives a reboot of the router.
New news: The VPNfilter router malware is worse than originally thought. New features were discovered that exploit the entire network connected to the infected router. Run for the hills. Or, better yet, run away from consumer grade routers. The newly discovered features are: inspect and redirect HTTP traffic passing through the router, SSH client, SSH server, file transfers using the SCP protocol, nmap port scanner, network reconnaissance from the hacked router, scan for Mikrotik devices, a firewall, port forwarding to an outside network, a SOCKS5 virtual private network proxy server that runs on TCP port 5380, a Reverse-TCP VPN that connects the hacked router to the bad guys over a VPN (used to both steal data and for remote command and control). Quoting: "VPNfilter was clearly built for long-term use as a network exploitation and attack platform." Keep in mind, that this is, in part, an advertisement for Talos themselves. These quotes illustrate my point:
"The sophistication of VPNFilter drives home the point that this is a framework that all individuals and organizations should be tracking. Only an advanced and organized defense can combat these kinds of threats, and at the scale that VPNFilter is at, we cannot afford to overlook these new discoveries."
  and
"The sophisticated nature of this framework further illustrates the advanced capabilities of the threat actors making use of it, as well as the need for organizations to deploy robust defensive architectures to combat threats such as VPNFilter."
Also proving my point is that the blogs from Talos are very short on defensive measures. No mention of this website, you can be sure. Just new stuff for Snort and Clam. If you don't know how to use these tools, then I am sure Talos can help. They released a program to decrypt the Winbox protocol and failed to mention that Mikrotik fixed the bugs, so all anyone has to do is install the latest firmware. They did not offer the link below to test port 5380.

• When connected to your router, test port 5380
• VPNFilter III: More Tools for the Swiss Army Knife of Malware by Talos Sept. 26, 2018

Buggy routers have an average of 186 bugs each. Not a typo.

You can't secure your network without securing your routers - and your users' routers
by David Braue of CSO Online   September 27, 2018
Quoting: "The American Consumer Institute Center for Citizen Research conducted an audit of 186 Wi-Fi routers from 14 different manufacturers, using Insignary’s Clarity application to scan the embedded firmware for unpatched security vulnerabilities. Fully 83 percent of examined routers were found to have known vulnerabilities in their code, with an average of 186 vulnerabilities per router ... the report warned that vendors' frequent usage of open-source code had left many routers exposed." The article cites a trifecta of problems: lots of new vulnerabilities being discovered, router manufacturers often-slow response in fixing these bugs and, of course, router owners who typically don't update the router firmware. Testing was done in July 2018 on the latest firmware for each router, so the real world situation is certainly worse. Only 31 routers had no bugs and they were not identified. I don't know who the American Consumer Institute is and I am always skeptical of a report without an author. There is a chance that this is a disguised press release for Clarity. That they don't mention the good routers also points to this being an ad disguised as a study. And, in the days after the study was released, they blogged about every story in the media that mentioned the study. Just what you would do if the study was really an advertisement.

• Securing IoT Devices - How Safe Is Your Wi-Fi Router? by the American Consumer Institute Center for Citizen Research. No author. No date, but sometime between July and Sept. 2018.
• Insignary makes the Clarity product used in this study
• The American Consumer Institute
• New Study Warns of Inadequate Security Provisions in Home and Office Routers Sept. 26, 2018. They announce their own study. Even this was not written by a person, just by "editor"

MikroTik routers attacked abusing bugs with available fixes

Unpatched routers being used to build vast proxy army, spy on networks
by Sean Gallagher of Ars Technica   September 5, 2018
Researchers at Netlab 360 have discovered that thousands of MikroTik routers have been compromised by malware attacking a vulnerability first revealed April 2018. MikroTik issued a fix back in April, but more than 370,000 MikroTik devices are online and still vulnerable. Of those, more than 7,500 are actively being spied on by attackers. The spying is done by forwarding a copy of network traffic to a bad guy. This is done using the built-in packet-sniffing capabilities of MikroTik routers. The sniffer, which uses the TZSP protocol, can send a stream of packets to a remote system using Wireshark or other packet capture tools. The vast majority of the packet capture streams were being sent to an IP address in Belize. Also, 239,000 of MikroTik devices have been turned into SOCKS 4 proxies. The malicious proxy network is using the non-standard TCP port 4153. It is not clear what the proxies are being collected for, but they are continuously scanning for other vulnerable routers.

• 7,500+ MikroTik Routers Are Forwarding Owners' Traffic to the Attackers, How is Yours? by Netlab 360. This is the original research Sept. 4, 2018
• Thousands of MikroTik Routers Hijacked for Eavesdropping by Tara Seals of Threatpost September 4, 2018. While others say the bug was fixed in April, this aticle says the flaw is a Winbox Any Directory File that MikroTik patched in early August. The article quotes Troy Mursch, researcher at Bad Packets Report, saying "We must note these are carrier-grade routers that have been compromised"
• 7,500 MikroTik routers compromised, traffic forwarded to attackers by Ms. Smith of CSO September 4, 2018
• WinboxExploit Proof of Concept of Winbox Critical Vulnerability April 2018
• Test if port 4153 is open on your router grc.com/x/portprobe=4153

Lots of Cisco bugs

Cisco Releases 16 Security Alerts Rated Critical and High
by Ionut Ilascu of Bleeping Computer   September 5, 2018
Cisco published 30 security advisories on vulnerabilities in its products. Half of the bugs are considered high or critical severity. Three are security problems with critical impact. One critical bug affects the RV-series firewalls and routers, specifically RV110W Wireless-N VPN Firewall, RV130W Wireless-N Multifunction VPN Router, and the RV215W Wireless-N VPN Router. The two routers and the firewall are also vulnerable to directory traversal (CVE-2018-0426), command injection (CVE-2018-0424) and information disclosure (CVE-2018-0425) bugs, all having a high severity.

• Cisco Security Advisories and Alerts

Yet another botnet

New Hakai IoT botnet takes aim at D-Link, Huawei, and Realtek routers
by Catalin Cimpanu for ZDNet   September 3, 2018
A new botnet, Hakai, was first spotted in June 2018. Then, in July, it started to exploit a vulnerability in Huawei HG352 routers (CVE-2017-17215). By mid-August it was targeting more devices and vulnerabilities. Hakai now goes after three different bugs in D-Link routers, one of which involves HNAP. D-Link routers that support HNAP do not let you disable it, but D-Link is moving away from HNAP so anyone with a D-Link router should look for new firmware as it might eliminate HNAP. It also targets Realtek routers and IoT devices using a vulnerable version of the Realtek SDK where the miniigd SOAP service allows remote attackers to execute arbitrary code on the device using a malicious NewInternalClient request. The article does not offer any way of detecting if a specific IoT device is vulnerable or not. The botnet also targets Telnet looking for devices with the port open and simple or default passwords. The Hakai codebase also seems to have leaked as there are two different Hakai-based botnets, Kenjiro and Izuku, spreading online. The article says nothing about what the botnet does to the routers that it infects. It also says nothing about what an infected router might do to the rest of us.

• Hakai: New Linux IoT Botnet by jouini ahmed Aug. 25, 2018
• Click this link grc.com/x/portprobe=23 to see if the Telnet port is open on the router you are currently connected to

AUGUST 2018

The NSA used hacked routers to help decrypt VPNs

NSA Cracked Open Encrypted Networks of Russian Airlines, AL Jazeera, and Other "High Potential" Targets
by Micah Lee of The Intercept   August 15, 2018
The article is about VPNs, but it included a point about using compromised routers to assist in breaking VPN traffic: "In 2014, The Intercept reported on the NSA's plans, dated August 2009, to use an automated system called TURBINE to covertly infect millions of computers with malware. The revelations described a piece of NSA malware called HAMMERSTEIN, installed on routers that VPN traffic traverses. The malware was able to forward VPN traffic that uses the IPSec protocol back to the NSA to decrypt."
The March 2014 article by Ryan Gallagher and Glenn Greenwald referred to here, said this about routers: "The NSA has specifically tailored some of its implants to infect large-scale network routers ... By compromising routers ... the agency can gain covert access to monitor Internet traffic, record the browsing sessions of users, and intercept communications. Two implants the NSA injects into network routers, HAMMERCHANT and HAMMERSTEIN, help the agency to intercept and perform "exploitation attacks" against data that is sent through a Virtual Private Network..." The article also pointed out that the NSA uses hacked routers to deliver malware to targeted machines.

D-Link routers in Brazil hacked to change DNS servers

In-the-wild router exploit sends unwitting users to fake banking site
by Dan Gooding of Ars Technica   August 10, 2018
A flaw or flaws in D-Link gateways (a gateway is a combination modem and router) allows bad guys to remotely change the DNS server that the routers tell connected devices to use. DNS translates domain names, such as RouterSecurity.org into numeric IP addresses. All computer communication is based on numeric IP addresses. A small number of techies may hard code DNS servers into their computing devices, but the vast majority of computing devices use the DNS servers assigned to them by the router. A malicious DNS server will translate the name of a bank into the wrong IP address, one that hosts a scam version of the banking website. If a victim logs in to the scam website, the bad guys learn their banking password. According to Radware, bad guys have been using malicious DNS servers to send potential victims to scam versions of two Brazilian bank websites, Banco de Brasil and Unibanco. The web browser will display the correct banking URL while at the scam website, but the use of extended validation certificates should indicate that the displayed site is a scam. I checked. Both banks do use EV certificates so an educated user would not be fooled. Also, the browser should issue a warning about the self-signed certificate used by the scam sites. Known vulnerable D-Link devices include the DSL-2740R, DSL-2640B, DSL-2780B, DSL-2730B, and DSL-526B. Also, the Shuttle Tech ADSL Modem-Router 915 WM. These attacks were first noticed by Radware on June 8, 2018. The bugs being exploited date back to 2015 and have since been fixed. Vulnerable devices can be hacked without any interaction from the end user. In large part the bugs stem from the web interface being available to LAN side devices without authentication. Finally, Goodin claims that specifying your own DNS servers on your computing device over-rides those in the router. This is not always true, certainly not true with my favorite router the Pepwave Surf SOHO.

• IoT Hackers Trick Brazilian Bank Customers into Providing Sensitive Information by Pascal Geenens of Radware Aug. 10,2018. Original source of the story.

The Sky is NOT falling

New Method Simplifies Cracking WPA/WPA2 Passwords on 802.11 Networks
by Lawrence Abrams of Bleeping Computer   August 6, 2018
This story is sad. The news is trivial, so much so, as to be almost irrelevant. Yet, every outfit did a story that the sky is falling. Not even Steve Gibson was able to put this in perspective and point out how un-important it was. The tech press is truly disgraceful. Consider this statement from the normally reliable Bleeping Computer site "While previous WPA/WPA2 cracking methods required an attacker to wait for a user to login to a wireless network and capture a full authentication handshake, this new method only requires a single frame which the attacker can request from the AP...". The fact is that Wi-Fi attackers never had to wait, they could force any and all currently connected devices off the network. Pretty much any Wi-Fi device would then try to log back in automatically. In fairness, this was a rare article to mention that this newly discovered technique "does not make it easier to crack the password for a wireless network." Many articles outright lied about this. And, some articles mentioned that the new technique only works on routers that have a certain feature enabled. No one bothered to research which routers have that feature enabled. That's not sexy. Have any router companies commented on which, if any of their routers are vulnerable to this new attack? One article had a quote from Eero saying that none of their devices are vulnerable. No one bothered asking any other router vendors. Eero did not publish anything on their website. And, finally, to put this in perspective, let us not forget that Google knows nearly every Wi-Fi password in the world as I blogged back in 2013. And, if Google knows it, the US Government can compel them to turn it over. No hacking needed.

• New Wi-Fi attack cracks WPA2 passwords with ease by Charlie Osborne of ZDNet Aug. 8, 2018. Typically miserable article. Quoting: "Currently, the most popular method is to wait until a user connects to Wi-Fi, wait for the four-way authentication handshake to take place, and capture this information in order to brute-force the password...."
• Scary Wi-Fi attack can hack weak passwords with ease by Chris Smith of BGR Aug. 8, 2018 Scary? I think not. Clickbait for sure. This article was initially brutally wrong saying that strong passwords could be easily hacked using this attack. I tweeted about it. The article and the headline was later updated. The original headline was "Scary Wi-Fi attack can hack your password no matter how strong it is"
• Cracking the passwords of some WPA2 Wi-Fi networks just got easier by Shaun Nichols of The Register Aug. 6, 2018. It too says: "Previously, an attacker would need to wait for someone to log into a network, capture the four-way handshake process used to authenticate users with a wireless access point, and use that to brute-force search for the password." No matter how many people write this, it remains false. The article also said "...the attacker would be able to break into a vulnerable wireless network in far less time..." This is false too. If a Wi-Fi password is sufficiently long, it will take decades to brute force it.
• New attack on WPA/WPA2 using PMKID by Jens Steube Aug. 4, 2018. The original source of the story. Quoting: "At this time, we do not know for which vendors or for how many routers this technique will work, but we think it will work against all 802.11i/p/q/r networks with roaming functions enabled (most modern routers)".

Back to bad news - MikroTik routers at ISPs hacked

Mass MikroTik Router Infection – First we cryptojack Brazil, then we take the World?
by Simon Kenin of Trustwave   August 1, 2018
Quoting: "I noticed a huge surge of CoinHive in Brazil. After a quick look I saw that ... these were all MikroTik network devices ... all of these devices were using the same CoinHive sitekey, meaning that they all ultimately mine into the hands of one entity ... the attacker indeed mainly focused on Brazil ... MikroTik routers are used by Internet providers and big organizations, and in this case it seem that the Reddit post's author's ISP had their router compromised ... the exploit was for a vulnerability patched by MikroTik on April 23rd (2018) .... using this exploit you can get unauthenticated remote admin access to any vulnerable MikroTik router ... the attacker used the device's functionality in order to inject the CoinHive script into every web page that a user visited ... This is a warning call and reminder to everyone who has a MikroTik device to patch as soon as possible, this attack may currently be prevalent in Brazil, but during the final stages of writing this blog, I also noticed other geo-locations being affected as well ... Let me emphasize how bad this attack is. The attacker wisely thought that instead of infecting small sites with few visitors, or finding sophisticated ways to run malware on end user computers, they would go straight to the source; carrier-grade router devices. There are hundreds of thousands of these devices around the globe, in use by ISPs and different organizations and businesses ..." This is, to me, a new type of bad. Any website sitting behind a hacked MikroTik router may deliver malware. One thing does not makes sense in this report. Kenin says that all web page passing through an infected router get modified, but, TLS should protect web pages from being modified in-flight.

• Routers turned into zombie cryptojackers – is yours one of them? by Paul Ducklin of Sohpos Naked Security August 3,2018. By far, the best article on the topic. Describes an unforgivable design flaw made by MikroTik regarding passwords. And puts the problem in perspective - its trivial. Quoting: "You’ll only get cryptojacked if you are browsing via the Mikrotik proxy; the cryptojacking will only kick off when there’s an error to report; and the cryptomining will only last until you exit from the browser tab with the cryptomining code in it. You’re very likely to notice the cryptojacking, not least because your computer will slow down .... Also, Mikrotik's proxy only supports HTTP, not HTTPS."
• Massive Coinhive Cryptojacking Campaign Touches Over 200,000 MikroTik Routers by Catalin Cimpanu of Bleeping Computer August 2, 2018. The count of infected routers keeps growing. Initially 72,000, then just over 170,000 and the latest is over 200,000. A query on the Shodan IoT search engine reveals that there are over 1.7 million MikroTik routers available online.
• Huge Cryptomining Attack on ISP-Grade Routers Spreads Globally by Tara Seals of Threatpost August 2, 2018
• Patches Zero-Day Flaw Under Attack in Record Time by Catalin Cimpanu of Bleeping Computer April 24, 2018
• Dissection of Winbox critical vulnerability May 21, 2018

New thing here - some good news

OpenWrt 18.06 released (Linux OS for your router, first major update in years)
by Brad Linder of Liliputing   August 1, 2018
Quoting: "OpenWrt is an open source, Linux-based operating system designed to run on hundreds of routers and other embedded devices. It can add new features to your networking gear and give you more control over the software running on the hardware in your home. This week the developers released OpenWrt 18.06, which is a big step for a couple of reasons." Some changes: Spectre and Meltdown mitigations, improved firmware upgrade procedure, auto rollback functionality, new Linux kernel, an updated toolchain, some type of support for Wireguard VPNs, and, of course, bug fixes.

• OpenWrt website

JULY 2018

Bank fails to use VLANs

Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M
by Brian Krebs in Krebs on Security   July 24, 2018
Hackers used phishing emails to break into The National Bank of Blacksburg in Virginia bank - twice. In May 2016, "The email allowed the intruders to install malware on the victim’s PC and to compromise a second computer at the bank that had access to the STAR Network, a system ... that the bank uses to handle debit card transactions for customers. That second computer had the ability to manage National Bank customer accounts and their use of ATMs and bank cards. Armed with this access, the bank says, hackers were able to disable and alter anti-theft and anti-fraud protections, such as 4-digit personal identification numbers (PINs), daily withdrawal limits, daily debit card usage limits, and fraud score protections." This first break-in cost the bank $569,000. The second break-in was in January 2017. "This time not only did the intruders regain access to the bank’s STAR Network, they also managed to compromise a workstation that had access to Navigator, which is software used by National Bank to manage credits and debits to customer accounts ... the hackers used the bank’s Navigator system to fraudulently credit more than $2 million to various National Bank accounts." Most of the article is about a lawsuit between the bank and its insurance company. Boring. Clearly the problem here is network segmentation or VLANs. No employee should be reading email messages on a computer that has network access to the core banking systems.

• Using VLANs for Network Isolation by me

Port 5555 being attacked

Open ADB Ports Being Exploited to Spread Possible Satori Variant in Android Devices
by Hubert Lin, Lorin Wu and Vit Sembera of Trend Micro   July 23, 2018
Quoting: "... we found a new exploit using port 5555 after detecting two suspicious spikes in activity on July 9-10 and July 15 ... the activity involves the command line utility called Android Debug Bridge (ADB), a part of the Android SDK that handles communication between devices ... the first wave of network traffic came mainly from China and the US, while the second wave primarily involved Korea ... we determined that the malware spreads via scanned open ADB ports .... It attacks ADB by uploading the payload via TCP port 5555 ... It is reasonable to believe that the same author was behind this sample and Satori ... According to data from Shodan, over 48,000 IoT systems are vulnerable to ADB exploitations. Not all vulnerable systems are exposed as they are usually hidden behind routers with NAT ... However ... they can be made accessible either manually or via UPnP NAT traversal. All multimedia devices, smart TVs, mobile phones, and other devices without additional protection are easy targets for this malware regardless of the user's password strength."

• Test port 5555

Still more attacks on buggy routers

eSentire Observes an Increase in Exploitation Attempts Against Routers
by eSentire   July 20, 2018
eSentire observed exploitation attempts targeting consumer routers made by Dasan and D-Link. The D-Link DSL-2750B with firmware 1.01 to 1.03 is susceptible to this attack. So, too are Dasan GPON routers utilizing ZIND-GPON-25xx firmware and some H650 series. Dasan never issued bug fixes. If these devices get attacked, it can result in remote code execution. An article about the D-Link routers appeared in Ars Technica in June (see below).

• Increase in Attacks on GPON Routers by eSentire July 20, 2018

Huawei Router botnet built exploiting only one bug

Router Crapfest: Malware Author Builds 18,000-Strong Botnet in a Day
by Catalin Cimpanu of Bleeping Computer July 19, 2018
A bad guy built a botnet of over 18,000 routers in the span of a single day. The botnet has been spotted by NewSky Security, and their findings have been confirmed by Qihoo 360 Netlab, Rapid7, and Greynoise. It was built by exploiting a vulnerability in Huawei HG532 routers (CVE-2017-17215). The bug can be exploited via port 37215. This was no zero day, the bug is high profile and had been exploited by many previous botnets. Clearly no one patches their routers. Also, ISPs fail to block incoming connections on port 37215.

• Test port 37215
• Huawei router exploit involved in Satori and Brickerbot given away for free on Christmas by Blackhat Santa by NewSky Security Dec. 28, 2017

Yikes

Hackers Breach Russian Bank and Steal $1 Million Due to Outdated Router
by Catalin Cimpanu of Bleeping Computer   July 19, 2018
What was outdated about the router, no one said. The victim of the hack was PIR Bank. Their network was infiltrated in late May 2018 and the money transferred out on July 3, 2018. The hacker group is known as MoneyTaker, according to Group_IB, and the amount stolen this time was at least $920,000 in US dollars. Group-IB said: "The router had tunnels that allowed the attackers to gain direct access to the bank’s local network .. This scheme has already been used by this group at least three times while attacking banks with regional branch networks." Tunnels? As in VPN?

• $1 million heist on Russian bank started with hack of branch router by Dan Goodin for Ars Technica July 19, 2018

Press Release: new free Avira security product

Avira Home Guard: One out of every four routers is vulnerable to hackers
by Avira   July 19, 2018
This is a press release for a new free product from Avira. It is software that runs on Windows and Android and does a LAN scan to find devices and security issues with them. The text says that many routers have open ports, bit its not clear if the product finds LAN side or WAN side open ports. Avira may be selling FUD. Don't know. Hope to kick the tires on this soon. I later learned that Trend Micro has a similar product that runs on Windows, MacOS, iOS and Android. Trend is upfront of the data that is sent to them, Avira says nothing about this.

• Avira Home Guard
• HouseCall™ for Home Networks from Trend Micro. it reports open ports (LAN or WAN?) and on SSL-Poodle, Shellshock, Heartbleed and WannaCry. The software sends this data to Trend: IP Address, Mac address, Open Ports and Running Service, Broadcast Packets, Device Online Time, Default Password Check Result and Vulnerability Check Result from Devices in the network. It also sends Wi-Fi SSID, Wi-Fi Encryption Setting, Wi-Fi Weak Password Check Result, App UI Action, Device manufacturer, Device OS/Build version, CPU model, DISK vendor/model, MEMORY vendor/model, Network adapter vendor from Device which is running this tool.

Netgear FTP password flaw exploited to steal military documents

Year-old router bug exploited to steal sensitive DOD drone, tank documents
by Sean Gallagher of Ars Technica   July 11, 2018
Quoting: "In May, a hacker perusing vulnerable systems with the Shodan search engine found a Netgear router with a known vulnerability - and came away with the contents of a US Air Force captain's computer. The purloined files from the captain - the officer in charge of the 432d Aircraft Maintenance Squadron's MQ-9 Reaper Aircraft Maintenance Unit ... included export-controlled information regarding Reaper drone maintenance. The vulnerability, which makes it possible for an attacker to remotely execute commands and gain access to the root directory of the router via FTP, was disclosed by Netgear over a year ago ... [it] allowed attackers to ... gain access to the local network. They could then either grab files passing over the network or gain access to devices on it." An article in SFGate, from February 2016, Netgear: Add a password or risk losing your data, says the flaw stems from the promise of convenience: "An owner can plug in a flash drive or a hard drive into a home router and access the data remotely. Turning a USB stick into a private cloud is an enticing perk - and one that’s becoming expected as people grow accustomed to accessing their information from anywhere ... When people attempt to remotely access their data, they are prompted to enter a user name and password. If customers have not established their own unique log-ins, Netgear routers grant access without requiring a password at all." Netgear's point of view was that users are responsible for preventing this. They should change the FTP password as the manual says. The article also says that Netgear did not respond to questions about the specific devices affected by the design flaw.

• Hacker Selling Pentagon’s Killer Drone Manual on Dark Web for $150, Cheap by Kevin Poulsen for The Daily Beast July 10, 2018. This article says the theft was from a home network not from a military base. It also has more details on the bug itself: "If the user switches the Personal FTP Server option on, and doesn’t explicitly set a password for the server, all their shared files are left wide open to anybody who logs in as 'anonymous' with no password required."
• Military Reaper Drone Documents Leaked on the Dark Web by Andrei Barysevich of Recorded Future July 10, 2018. Recorded Future is the company that found the documents for sale.
• A Hacker Was Able To Take Sensitive Documents From The Military Because No One Updated The Routers by Kevin Collier of Buzzfeed July 10, 2018. This article ends with an interesting point. The person selling these documents was an amateur with little technical skill. What would a professional spy agency have done with/to these vulnerable routers? It quotes Andrei Barysevich, who found the documents online: "The exposure could be much bigger than these documents being stolen."
• According to Kevin Poulsen in The Daily Beast, this is the bug that was exploited.
  JNR1010v2 / WNR614 / WNR618 / JWNR2000v5 / WNR2020 / JWNR2010v5 / WNR1000v4 / WNR2020v2 Firmware Version 1.1.0.32 from Netgear Last Updated: Nov. 28, 2016
  This, to me, is really interesting. It says NOTHING about the bug or bugs that are fixed and how they are fixed. Huge black mark against Netgear. Poulsen was told by a Netgear spokesperson that this update adds a password by default. What password? How is it derived? None of our business.
• According to the Ars article, this is the bug in question. I doubt it, as it only applies to the DGN2200v4 modem/router.
  DGN2200v4 Command Execution and FTP Insecure Root Directory Security Vulnerability from Netgear
  This bug can allow hackers who have the router's admin password to inject OS commands that can possibly be used to backdoor the router and modify Internet traffic and to access files in the root directory. An updated version of DGN2200v4 firmware to resolve the vulnerability is in test. NETGEAR plans to release the firmware by the end of November 2016. Last Updated: January 6, 2017. So, it seems like updated firmware was never released.
• How do I set up FTP access on my Nighthawk router? from Netgear. It says nothing about passwords or FTP userids at all. Shameful. Last Updated: Nov. 28, 2016
• How do I set up my personal FTP server on my Nighthawk router? Last updated Nov. 28, 2016. This too, says nothing at all about FTP userids and passwords. Shameful.
• How do I set up FTP access through the Internet so I can access the USB drive attached to my Nighthawk router? from Netgear Last Updated: Nov. 28, 2016. This shows how to limit access to the admin user of the router. It says nothing about passwords and says nothing about the situation when you do not limit access to the admin use. Shameful.
• How do I access the USB drive attached to my Nighthawk router through the Internet with FTP? Last Updated Nov. 28, 2016. You can login as the router admin user with the same password it uses to logon to the router. You can also login as user "guest" without a password. How convenient.

JUNE 2018

Many routers should be illegal

Those Harder to Mitigate UPnP-Powered DDoS Attacks Are Becoming a Reality
by Catalin Cimpanu of Bleeping Computer   June 28, 2018
Every consumer router that I am aware of ships with UPnP enabled. Less tech support calls that way. But, UPnP can be abused to make Denial of Service attacks harder to defend. Quoting: "Security researchers are continuing to see DDoS attacks that leverage the UPnP features of home routers to alter network packets and make DDoS attacks harder to detect and mitigate ... " UPnP was designed for LAN side use only, but many routers are mis-configured and support it on the WAN side. Then too, routers implement it wrong. Specifically, UPnP supports port forwarding to open up a LAN side device directly to the Internet. But, some routers do not validate that the target IP address is really internal, so UPnP allows port forwarding to a public IP address - to a victim of DDos attack. This has been called UPnProxy. This also allows changing the source port number which makes DDoS attack mitigation much harder.

• A New Twist In SSDP Attacks by Arbor Networks June 2018
• DDoS Attacks Leverage UPnP Protocol to Avoid Mitigation by Catalin Cimpanu May 15, 2018
• Over 65,000 Home Routers Are Proxying Bad Traffic for Botnets, APTs by Catalin Cimpanu April 12, 2018

Old D-Link DSL gateways being hacked. No surprise.

Widely used D-Link modem/router under mass attack by potent IoT botnet
by Dan Goodin of Ars Technica   June 20, 2018
Bad guys are exploiting a bug in very old D-Link DSL-2750B DSL gateways in an attempt to make them part of the Satori botnet. The bug has been known for roughly 2 years but the devices have been abandoned by D-Link and the ISPs that gave them out. If you have such a device, it needs to be replaced. This is yet another reason to not use any hardware from your ISP, when possible. The bug allows remote command execution without any authorization needed. The vulnerability can be exploited using the "cli" parameter that directly invokes the "ayecli" binary. Vulnerable firmwares are from 1.01 up to 1.03. It is also possible to retrieve the admin password, wifi password, etc. Attack code exploiting the bug was published last month. Netlab 360 first reported Satori was exploiting this bug on June 15th. They also found it exploiting a bug in a XiongMai router. D-Link representatives did not respond to Ars Technica seeking comment. No surprise there. There is no mention of the device on the D-Link website for the US. I know someone who had one of these from Verizon. As of August 2016, it was running firmware version 5.4.12.1.44.2.1 (not a joke) which was released Nov. 14, 2013.

• D-Link router DSL-2750B firmware 1.01 to 1.03 - remote command execution no auth required A description of the bug from Feb. 5, 2016.
• D-Link router DSL-2750B firmware 1.01 to 1.03 - RCE no auth a description of the bug from January 2017
• D-Link DSL-2750B - OS Command Injection the bug at Exploit Database May 25, 2018
• Botnets never Die, Satori REFUSES to Fade Away by Netlab 360 June 15, 2018. Netlab 360 is the main source of info on the Satori botnet.
• Satori IoT Botnet Variant by Radware June 19, 2018
• D-Link 2750B Wireless Gateway Router from Verizon who used to give these out. Needless to say, there have been no updates to the info here for years.
• DSL-2750B User Manual (PDF)
• Wireless N300 ADSL2+ Modem Router the DSL-2750B Product page at D-Link.com for Australia.

MikroTik router serving as Command and Control

Chinese Cyber-Espionage Group Hacked Government Data Center
by Catalin Cimpanu of Bleeping Computer   June 15, 2018
In November 2017, according to Kaspersky Lab, bad guys hacked a data center belonging to a Central Asian country and embedded malicious JavaScript code on government websites. The code re-directed victims to malicious websites hosting exploitation tools that attempt to infect victims with a remote access trojan (RAT). The attackers hacked a MikroTik router to host the command and control server of the RAT. The hacked router controlled and retrieved data from infected victims, providing an additional layer of anonymity between the bad guys, victims, and forensic investigators. This is believed to be the first time that bad guys hosted a C&C server on a router. MikroTik is also on the VPNFilter list of vulnerable manufacturers. Why? According to Rapid 7, most MikroTik devices are not maintained.

• LuckyMouse hits national data center to organize country-level waterholing campaign by Denis Legezo of Kaspersky June 13, 2018. Command and control lived on the network of a Ukrainian ISP. The Mikrotik router was running firmware version 6.34.4 (from March 2016) with SMBv1 on board. "We suspect this router was hacked as part of the campaign in order to process the malware's HTTP requests."

Further proof that VPNFilter was inevitable

VPNFilter's Potential Reach - Malware Exposure in SMB/Consumer-grade Devices
by Bob Rudis of Rapid7   June 7, 2018
Rapid7 scanned the Internet looking for devices from the 11 manufacturers whose routers are known to be vulnerable to VPNFilter. Of those, they counted the ones with an open Telnet port and found just over 453,000 devices. Quoting: "... poorly configured and maintained devices remain at-large just waiting for attackers to regain control ... To ... understand the potential scope of the problem (and not with just VPNFilter), Rapid7 Labs researchers used banner scan results from Project Sonar and Censys to try to get a count of the device families targeted by VPNFilter. The initial numbers for the spread of VPNFilter were in the 500,000 device range and ... the potential for exploitation of all types in these device families (VPNFilter and beyond) is much, much larger ... we picked the most egregious port - telnet - to see what is there since - if telnet is exposed, the devices are seriously, egregiously poorly configured and are likely already compromised in other ways, let alone potential victims for VPNFilter (in any form) ... While we cannot determine if these devices are, in fact, compromised by the latest round of VPNFilter exploits, their mere presence on this singular cleartext port is a clear indicator that we have a long way to go reduce the number of candidates for compromise."

MAY 2018

VPNfilter router hack - an inevitable disaster

New VPNFilter malware targets at least 500K networking devices worldwide
by Talos division of Cisco   May 23, 2018
If you own a crappy router, it is likely to get hacked. That is the lesson to be learned here. And, by crappy, I mean anything from your ISP or a consumer router. You can stop reading now.
The story: State sponsored bad guys, probably Russians, have hacked a lot of routers (at least 500,000 in 54 countries is the estimate) with really nasty malware. Talos, working with law enforcement and others, found devices from Linksys, Mikrotik, Netgear, TP-Link and QNAP (a NAS not a router) infected. They listed specific models but clearly said their list was incomplete. Nonetheless many articles left out the incomplete part, leaving the impression these were the only vulnerable models. In reality, every device from these vendors needs to be considered vulnerable. There is no easy way to tell if a device is infected with VPNFilter. The exact method of infection is not known and Talos has not completed its research. As shown on the Bugs page here, there are many router bugs just waiting to be exploited. Heck, being a bad guy targeting routers is like being a kid in a candy store. Talos said "...most devices targeted ... have known public exploits or default credentials that make compromise relatively straightforward." In other words, easy pickings. While the initial router infection may have been easy, the malware is, nonetheless, fairly sophisticated. For one thing, it is installed in sections, a main controller is installed first and it then downloads other components. The initial component learns the IP address of where it should download the rest of itself in a very clever way. It downloads an image, and looks in the image metadata for an IP address. Also, this is only the second router malware that can survive reboots of the router. The malware/botnet has been around for a couple years and grew slowly until May 8, 2018 when it increased 28 fold with almost all new infections in the Ukraine.
So what? The malware can do assorted bad things and Talos is not sure it has detected everything. It can certainly steal website credentials and brick the router it is running on. And, as with other router hacks from the last few months, it can be used to hide the true location of bad guys doing bad things. If the FBI breaks your door down thinking you did a bad thing on the Internet, it might be due to VPNFilter. Speaking of the FBI, they said VPNFilter can do "information collection, device exploitation, and blocking network traffic." Finally, it monitors modbus traffic on TCP port 502. Modbus is an Industrial Control Systems (ICS) protocol. A report from JASK said "Western Europe and North America may be at increased risk for a potential ICS attack against critical infrastructure."
Solutions offered: Reboot you router is the big headline everywhere. Good reporters note that all routers should be rebooted, bad reporters point to the few that have been verified as vulnerable. Rebooting is also called power cycling. Simply put, unplug a router from the electricity, wait a short bit and then plug it back in. What is sometimes missing is that this only removes part of the malware, not all of it. Specifically, it removes the add-on components, but not the initially installed component. The malware that is left is harmless in and of itself, but it still leaves the router open to re-infection. Fully removing the malware requires a hard reset to restore the router to a factory fresh state. The downside to this is that any changes made to the default configuration will need to be re-done and hardly anyone knows every change that was made. Some routers can save their current configuration which begs the question if this is restored after a reset, are you still safe? No one has addressed this. Certainly if the malware changed DNS servers, you do not want to restore the bad ones. Finally, a factory refresh may be a waste of time, if the bug that led to the infection in the first place is not fixed. And, again, we do not know how the initial infections are done. Everyone also says to update the firmware. No one points out that this may be useless. Many routers are abandoned and their firmware is not updated and bugs are not fixed. Other solutions are not solutions, just re-cycled words. For example: change default passwords and turn off Remote Management. Well, duh.
Solution not offered: Use a Pepwave Surf SOHO router. Steve Gibson was the only person to question whether a factory reset really removed the malware. He suggested installing new firmware as the best approach for removing existing corrupted firmware. But that begs the questions: if a router already is running the latest firmware, can you re-install it on top of itself? Which leads me to wonder, how long before the malware prevents any firmware updates? Infected devices did TCP scans on ports 23, 80, 2000 and 8080 which Talos wrote are indicative of Mikrotik and QNAP NAS devices. A secure router has no open ports. The Test Your Router page lists many tests you can run against your router looking for open ports. Rebooting a router every now and then is a good idea in general, nothing to do with VPNFilter specifically. There are many router hacks that are removed by rebooting. I recommend periodic reboots on the home page of this site.
Unknown: What does a factory reset of a router really do? Does it install new firmware from a read-only copy? If so, how old is this firmware? Or, does it simply reset the configuration options but make no changes to the installed firmware? NO ONE addressed this issue. Then too, why is it that 3 of the 4 affected companies say nothing about a factory reset in their instructions to their customers? Strange.
Mystery: Who owned toknowall dot com, the domain seized by the FBI? Did the bad guys register it or was an innocent website hacked?
Detecting an infection:
June 30, 2018: Symantec has a VPNFilter checker at www.symantec.com/filtercheck. Interestingly, it is only available via HTTP, not HTTPS. Exactly what it does is not explained, Symantec says only that it tests for the presence of the ssler plugin. How it tests or what exactly it tests is not explained. Also, the plugin is but one component of VPNFilter and Symantec is clear that a router that gets a clean bill of health on their test, "...may still be compromised by other threats or components of VPNFilter." On this page, Symantec says that a list of vulnerable routers is available in their blog. There are multiple mistakes with this. Depending on the release of firmware, a router may or may not be vulnerable. Also, the list of known vulnerable routers is wrong as it omits information from at least two vendors that know exactly the vulnerability that led to infection. They just copied a list from Talos.
June 9, 2018: It seems that you cannot detect the presence of the VPNFilter malware just by looking at your router. The second Talos report mentioned that the router does port forwarding of port 80 to 8888, but did not say if this was visible in the router interface. The report also mentioned that it disables gzip compression, but no one has said how to detect this. Likewise, it tries to downgrade HTTPS to HTTP which is perhaps the easiest means of detection, but many websites force HTTPS all the time. All the detection mentioned anywhere involves monitoring traffic leaving the suspect router, which means connecting the router to something other than a modem. In effect, doing a Man-in-The-Middle attack on the suspect router. The MiTM device could look for the use of http : / / api.ipify.org?format=json which the malware uses to learn its public IP address. It could also look for outgoing requests to the domain seized by the FBI, toknowall dot com. Talos has published many Indicators of Compromise.
Update June 2, 2018: I re-read the Talos blog and it clearly says that rebooted routers can be fully re-infected. Quoting: "If the attempt to the backup domain fails, stage 1 opens a listener that waits for a specific trigger packet to open a connection for the actor to connect interactively to the device ... when any packet arrives on any port, the listener performs a series of checks to identify a trigger packet. If the packet meets a predefined set of criteria, it will extract an IP address from the packet and attempt a stage 2 download." Surely the bad guys know the IP addresses of all infected routers, even those that were re-booted. They may lose track of some because the re-boot may assign a new public IP address, but still, they should be able to fully re-infect many of the rebooted routers. And, the malware listens for a trigger packet on all ports making it impossible to do port scans to find infected devices.

• Debunking the New York Times on Router Security and VPNFilter by me. Their article on the subject was riddled with mistakes. June 17, 2018
• VPNFilter router malware - just the bad stuff by me June 4, 2018, updated June 8th. As the title says, concentrating on the bad stuff. And, a wish for router expiration dates.
• VPNFilter Targets More Devices Than Initially Reported by Lucian Constantin June 6, 2018. Quoting: The large variety of targeted devices highlights the considerable amount of development work and testing that went into building this malware and botnet. The home router ecosystem is incredibly diverse. Most router firmware is based on Linux, but there are significant differences between firmware packages from different manufacturers and even between devices from the same vendor’s line of products.
• VPNFilter: New Router Malware with Destructive Capabilities by Symantec Security Response Team published May 23, 2018, last updated June 6, 2018.
• VPNFilter Update - VPNFilter exploits endpoints, targets new devices by Talos June 6, 2018. VPNFilter is targeting more makes/models of devices than initially thought, and has additional capabilities. They are wrong about QNAP. The company has clearly said which versions of their QTS software are vulnerable and which are not. Talos does not include this information making it look as if all QNAP devices are vulnerable.
• VPNFilter malware infecting 500,000 devices is worse than we thought by Dan Goodin of Ars Technica June 6, 2018. Quoting: if the device is more than a few years old, buy a new one.
• VPNFilter: a global threat beyond routers by Juniper June 6, 2018. It infects small office/home office routers, not enterprise brands. Juniper Networks routers are not believed to be affected. Even the new list of vulnerable devices is not complete. Still no sign of any zero day vulnerability being exploited, so it is likely that known vulnerabilities and weak passwords are the main vector of infection.
• Security advisory for VPNFilter malware from Asus June 8, 2018. Pretty lame.
• Why the FBI wants you to reboot your router - and why that won't be enough next time by Bruce Schneier in the Washington Post June 6, 2018. Finally, someone besides myself is calling a spade a spade. Quoting: "Honestly, the best thing to do if you have one of the vulnerable models is to throw it away and get a new one.".
• Router reboot: How to, why to, and what not to do by Stephen Cobb of Eset on We Live Security June 4, 2018. Good article.
• The VPNFilter Botnet Is Attempting a Comeback by Catalin Cimpanu of Bleeping Computer June 2, 2018. A new report from JASK and GreyNoise Intelligence (below) found that the people behind the VPNFilter botnet are attempting to compromise new routers and build a new, second generation VPNFilter botnet. They found scans looking for Mikrotik routers with port 2000 exposed online in the Ukrainian. Since May 8th, the VPNFilter botnet has been looking for Ukrainian routers in particular.
• From Russia with Love? Kevin Stear of JASK May 31, 2018. The report mentioned above.
• Should you reboot your router like the FBI says? by The Associated Press May 30, 2018. Excellent, short article. The FBI acknowledges that rebooting a router only temporarily disrupts the malware. After rebooting, the core infection persists and there is no simple way to delete it. The persistent malware is in listening mode, awaiting instructions. If you can update the firmware in your router to the latest version you should, but it may not fix the problem. It won’t hurt.
• Beers with Talos Episode 30 - VPNFilter, the Unfiltered Story with Cisco Talos employees Craig Williams, Joel Esler, Matt Olney, Nigel Houghton, Nick Biasini and Mitch Neff May 25, 2018. They discuss how Talos got involved, why they disclosed when they did, and details of the malware itself. Worth a listen.
• Reboot your router to avoid Russian malware, FBI warns: What you need to know by Brad Chacos of PCWorld May 30, 2018. On the upside, Chacos does stress that all routers should be rebooted. On the down side, he buys into the fiction that firmare updates will fix everything.
• Reboot Your Router to remove VPNFilter? Why It's Not Enough by Lawrence Abrams of Bleeping Computer May 29, 2018. An excellent article and the only one to ask the question: Should you reset your router even if its not one of the listed ones?
• VPNFilter by Steve Gibson and Leo Laporte. Security Now podcast transcript. Episode 665, May 29th, 2018. Raises issues that no one else has. He actually read the Talos report and understood it. On the other hand, he mis-read part of it, believing that only the few cited models are in danger of being hacked. Talos clearly said their list of vulnerable devices was incomplete.
• VPNFilter botnet: a SophosLabs analysis Part 1 by Sergei Shevchenko May 24, 2018. A very deep dive into Stage 1 of the malware.
• VPNFilter botnet: a SophosLabs analysis, part 2 May 27, 2018. A deep dive into the operation of Stages 2 and 3. Recommendation at end: "Regardless of whether you think your device has been hacked, power cycle the device, flash the latest firmware over the top of whatever is on there, and perform a factory reset on the firmware."
• F.B.I.'s Urgent Request: Reboot Your Router to Stop Russia-Linked Malware by Louis Lucero II for the New York Times May 27, 2018. By and large this article just repeats the FBI press release without adding any context to the story.
• Foreign Cyber Actors Target Home and Office Routers and Networked Devices Worldwide from the FBI. Alert Number I-052518-PSA May 25, 2018. Quoting: "The FBI recommends any owner of small office and home office routers power cycle (reboot) the devices." This is code for crappy routers. Note that they don't limit the recommendation to the brands known to have been infected.
• Exclusive: FBI Seizes Control of Russian Botnet by Kevin Poulsen for The Daily Beast May 23, 2018. First reporting of this very big deal. The FBI has blocked the malware's ability to reactivate following a router reboot. And, when an infected router is re-booted, it will phone home to the FBI which will then know the router is infected. The FBI could now, in theory, hack the routers.
• Hackers infect 500,000 consumer routers all over the world with malware by Dan Goodin of Ars Technica May 23, 2018. This is the only article I have seen to add some context pointing out the recent warning from the US and Britain that Russian hackers were/are compromising large numbers of routers, switches, and network devices belonging to governments, businesses, and critical-infrastructure providers.
• Justice Department Announces Actions to Disrupt Advanced Persistent Threat 28 Botnet of Infected Routers and Network Storage Devices from the US Department of Justice May 23, 2018. Two interesting points in this press release: (1) The non-profit Shadowserver Foundation will disseminate the IP addresses of infected routers to ISPs and foreign CERTs so they, hopefully, do something to remove the malware (2) Even after rebooting a router, it will remain vulnerable to reinfection with the second stage malware. I take this to mean that the Russians, if they knew the public IP address of the router, could re-infect it.
• Defending Against the New VPNFilter Botnet by the FortiGuard SE Team May 23, 2018. It also targets SCADA/ICS environments by monitoring MODBUS SCADA protocols
• VPNFilter Malware Security by TP-Link May 23, 2018. They are looking into it and will update this over time, or so they claim. As of June 2nd, no update. This should tell you everything you need to know about TP-Link. Nothing about factory resets.
• Security Advisory for VPNFilter Malware on Some Routers from Netgear, last updated May 30, 2018. Rounds up the usual suspects. Yawn. Nothing about factory resets.
• VPNFilter Malware Update from Linksys May 25, 2018. On the one hand Linksys passes the buck saying "If customers believe they have been infected ... " since there is, realistically, no way to know if a router has been infected. On the other hand, they do have instructions for performing a factory reset. Also, Linksys makes a point that Netgear and TP-Link can not - their newer routers self-update.
• VPNfilter official statement by MikroTik May 24, 2018. Quoting: "We are highly certain that this malware was installed ... through a vulnerability in MikroTik RouterOS software, which was ... patched ... in March 2017 ... upgrading RouterOS software deletes the malware, any other 3rd party files and closes the vulnerability." They also point out that their flaw could only be exploited if port 80 was open which their firewall protects against by default.
• Security Advisory for VPNFilter Malware from QNAP May 24, 2018. The best response of all the cited vendors. They specifically define the vulnerable software and options and note that bug fixes were released in 2017. They offer no details however on the nature of the bug(s). Affected products: any QNAP NAS running QTS 4.2.6 build 20170628 or earlier or QTS 4.3.3 build 20170703 or earlier. Also, any QNAP NAS using the default password for the administrator account. Which leads me to ask, why is there a default password for the Admin account?
• The FBI says you should reboot your router. Should you? by Rick Broida May 30, 2018. The worst article I have seen on the topic. Makes the mistake of assuming that only the few router models cited by Talos are vulnerable. Not True! Clearly Broida never read the original reports from techies that actually understand the problem. He also misquotes Linksys, to further the myth that new firmware fixes everything. The article is so bad, I wont link to it.
  https://www.cnet.com/au/how-to/the-fbi-says-you-should-reboot-your-router-should-you/
• Affidavit in support of an application for a seizure warrant May 23, 2018. The FBI asks for the legal authority to take control of the toknowall dot com domain. Nothing is said about what made patient zero in Pittsburgh suspicious of their router in the first place.

Bug in DrayTek routers is being both exploited and fixed

May 21, 2018: A bug in DrayTek routers was reported by the company and is in the process of being fixed by new firmware. Bad guys have been abusing the flaw to modify the DNS servers in the routers. Details are on the Router Bugs page.

WICKED botnet exploits known bugs in Netgear routers

A Wicked Family of Bots
By Rommel Joven and Kenny Yang of FortiGuard Labs   May 17, 2018
If the WICKED botnet can connect to port 8080 on a router it will try to exploit a flaw in Netgear DGN1000 and DGN2200 v1 routers from October 2017. If it can connect to port 8443, it will try to exploit a command injection flaw in Netgear R7000 and R6400 routers from March 2017. If you have a Netgear router, you can test TCP port 8443 and test TCP port 8080. The best result is "Stealth." If one of the ports are open, make sure you have the latest firmware installed.

• Wicked Botnet Uses Passel of Exploits to Target IoT by Tara Seals of Threatpost May 21, 2018

Harder to detect DDoS attacks thanks to UPnP

New DDoS Attack Method Demands a Fresh Approach to Amplification Assault Mitigation
by Avishay Zawoznik, Johnathan Azaria and Igal Zeifman of Imperva   May 14, 2018
It was recently reported that routers with UPnP exposed on their WAN side (the Internet) were being abused by bad guys to make their own customized equivalent of the Tor network to hide their actual location. That was bad enough. Now, Imperva has found that bad guys are also abusing devices that expose UPnP, in DDoS attacks that are harder to detect because the source port is a scam. They searched Shodan and found over 1.3 million devices exposing UPnP on the Internet.

• UPnP protocol exploit makes it harder for IT to shut down DDoS attacks by Conner Forrest for Tech Republic May 15, 2018

Bugs in Every major router

Zerodium buys bugs, including those in routers. On May 7, 2018, the company CEO, Chaouki Bekrar, tweeted: "Since @Zerodium has added routers to its bounty program, we have received at least one pre-auth RCE #0day exploit for every major router. We all know that the security of routers and IoT devices is completely fucked up but it's still scary to see how deeply fucked they are." Translating: pre-auth means pre-authorization which, in turn, means no password needed. RCE is Remote Code Execution, the most severe type of bug.

Dasan GPON routers being attacked

Vulnerabilities Affecting Over One Million Dasan GPON Routers Are Now Under Attack
by Catalin Cimpanu of Bleeping Computer   May 4, 2018
The bug being exploited was disclosed in late April 2018. At first, I did not believe it, my reasons are on the Bugs page. Seems I was wrong and these are real router vulnerabilities. Over a million routers are said to be vulnerable. No article has yet addressed whether the bugs can be exploited remotely, locally or both. The bugs are CVE-2018-10561 and CVE-2018-10562. GPON (Gigabit Passive Optical Network) supports internet connections via fiber optics lines. Most of the vulnerable routers are in Mexico, Kazakhstan, and Vietnam.
Update May 21, 2018: These same routers appear to have another zero day flaw that bad guys are exploiting. See GPON Routers Attacked With New Zero-Day by Catalin Cimpanu for Bleeping Computer.

• Botnet Party on GPON Routers By Catalin Cimpanu May 10, 2018. At least five IoT botnets are fighting each other and attempting to infect Dasan GPON routers, according to Chinese cyber-security firm Qihoo 360 Netlab. The good news is that the exploits of four of them are buggy, preventing them from hacking the routers. THe fifth botnet had its command and control server go down. Dasan said that only "ZNID-GPON-25xx series and certain H640 series GPON ONTs, when operating on specific software releases, are affected by this vulnerability." They estimate that less than 240,000 routers are vulnerable. The routers are old and will not be patched.
• GPON Router Vulnerability Antidote by VPNmentor. Undated. About May 8, 2018 give or take. A patch for the bug. This may be the only hope as Dasan is not going to fix the bugs. "This patch was not created by the official company and is not guaranteed. It was created to help mitigate the vulnerabilities until an official patch is released. Therefore, any issues or problems that might be caused by the use of this tool is not our responsibility, and we advise you to use it at your own risk. This tool disables the web server in a way that is not easy to reverse ... if you are not comfortable with the command line we suggest firewalling your device until an official patch is released."
• GPON Exploit in the Wild (I) - Muhstik Botnet Among Others by Netlab. This is the first time they have seen so many botnets competing for territory in such a short time. They are working to kill the botnets.

APRIL 2018

Hacking a home network

The Digital Vigilantes Who Hack Back
by Nicholas Schmidle for The New Yorker magazine May 7, 2018 issue
The article mentions a security company that got a request from the C.E.O. and general counsel of a multinational corporation. A employee who left the corporation had not returned their company laptop and was suspected of having shared proprietary information with a competitor. They wanted to know if the security company could "hack into the former employee's home network, assess whether the company laptop was connected to it, and, if so, erase any sensitive files." Doing so, would require access to the MAC address of the devices connected to the former employee's home network. That, in turn, requires router access. The security company said, for the article, that from a technical standpoint "such a hack would not be difficult."

Apple FINALLY comes clean, no more AirPort routers

Apple officially discontinues AirPort router line, no plans for future hardware
by Zac Hall of 9to5Mac   April 26, 2018
"Apple is officially exiting the wireless router business and selling off its remaining inventory of AirPort products. This includes the AirPort Express, AirPort Extreme, and both models of AirPort Time Capsule." Why would anyone buy the remaining inventory? Especially since the last new model was released five years ago. Apple seems to hate their customers. Back in Nov. 2016, Bloomberg reported that Apple had disbanded the team responsible for developing Apple's routers. Yet, it took till now to make it official. And, even now, they have not lowered the price of remaining inventory. The article says that the router will be supported for years to come, but they are, after all, Apple fanboys. I doubt there will ever be another firmware update to the AirPort routers. As for replacements, needless to say, I recommend the PepWave Surf SOHO router. It is, however, a single device and Peplink does not offer a mesh router system. At the moment, I would recommend Eero, based on my experiences with tech support. However, I have only kicked the tires on Eero, Google Wifi and AmpliFi.

• Choosing a Wi-Fi router to use with Apple devices by Apple April 26, 2018. Essential features when shopping for a Wi-Fi router to use with your Mac, iPhone, iPad, Apple TV, HomePod, or other Apple devices. This is brutally trivial and says nothing about security, needless to say.
• I have never been a fan of Apple routers, for many reasons

UPnProxy- the UPnP abuse will never die - no progress in 5 years

UPnProxy: Blackhat Proxies via NAT Injections
by Akamai   undated (sometime this month)
UPnP was intended to be used on a LAN and, as such, all devices were considered trusted and the protocol has no security at all. It's an old protocol. Back in January 2013 it was discovered that millions of routers were exposing UPnP on their WAN side (the Internet) by mistake. For more on this see the Bugs page. Here we are, 5 years later and this is still true. It seems nothing was done about the millions of buggy/vulnerable routers from 2013. Last month, Symantec wrote about a cyber espionage group known as the Inception Framework abusing UPnP to forward traffic from one router to another to another to another, etc. This lets bad guys hide the true source of their bad deeds. The link and summary are on this page, under March 2018. Now, Akamai is reporting the same thing and they call it UPnProxy. Akamai says it detected over 4.8 million routers that expose various UPnP services via the WAN interface. Again, there should be none, UPnP was only intended for LAN side use. Of these exposed routers, Akamai says over 65,000 home routers are currently being abused. No need for a VPN or Tor when you bounce your Internet data through dozens of other people's routers. This is a gift to spammers, phishers, botnets and the like. It is a bit like having a dedicated bad-guy-only version of Tor. Akamai was kind enough to shame the buggy and vulnerable devices and their manufacturers. Asus is a disgrace, they have a large number of vulnerable devices. Some other manufacturers on the list are D-Link, Ubiquiti, Netgear and ZyXel. Peplink was not on the list. Akamai also blamed ISPs because they are in a position to block UPnP traffic that was never meant to traverse the Internet in the first place. Comcast deserves credit here, they block UDP port 1900. This story did not get nearly enough attention. My guess is that it is beyond the technical comprehension of the many Art History majors that cover technology. Steve Gibson's discussion of UPnProxy (link below) is the only one worth reading/hearing.
- - - -
WHAT YOU CAN DO: How can you tell if your router exposes UPnP to the Internet at large? Steve Gibson has the only test that I am aware of. It is part of his Shields Up! service, the link is below. Every consumer router that I have seen ships with UPnP enabled. So, first off, disable UPnP in your router and then test to see if it was disabled on the Internet/WAN side of the house. Akamai noted that UDP port 1900 is what makes a vulnerable router discoverable. Click here to test if UDP port 1900 is open on your router. Also, check if your router is doing any port forwarding at all. Nothing to do with UPnProxy, all forwarded ports are holes in the router firewall and thus potential security weaknesses. For an Asus router go to System Log, then the Port Forwarding tab. If you see nothing, then you are safe, at the moment. In this screen shot, we see five ports are being forwarded. These are normal forwarding rules in that the destination is a computer on the LAN - they all start with 192.168.1. Victims of UPnProxy would see a public IP address in the "Redirect to" column. I have no idea why UDP port 54051 is being forwarded on this Asus router. For a TP-Link router, go to the Advanced tab, then NAT forwarding, then UPnP. Again, nothing being forwarded is good. In this screen shot, we see two forwarding rules, both to an "Internal IP Address" (starting with 192.168.0). I don't know if any routers let you disable or delete a UPnP created forwarding rule. As we can see in these two screen shots, neither Asus nor TP-Link supports this. But, at least they do report on UPnP created port forwarding. I tried the emulator for a couple Linksys Smart routers and they do not seem to report on this at all. Exposing UPnP also opens up your router to attack which Akamai described in their report. It basically converts Remote Administration to Local Administration. To defend against this, change the port number(s) used for local administration and change the LAN side IP address of the router. And, of course, change the router admin password, and, when possible, the router admin userid too. All that said, the Defensive Computing thing to do is to replace a router exposing UPnP on the Internet. It shows the manufacturer is incompetent.

• Over 65,000 Home Routers Are Proxying Bad Traffic for Botnets, APTs by Catalin Cimpanu April 12, 2018
• Never a Dull Moment Transcript of Security Now podcast Episode #659 April 17, 2018
• GRC's Instant UPnP Exposure Test Click the gray Proceed button on the first page, then look for the big orange button on the next page.
• Universal Plug and Play (UPnP): What you need to know by Akamai SIRT Alerts April 9, 2018

The Russians Are Coming, The Russians Are Coming

Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices
by the Department of Homeland Security, the FBI and the National Cyber Security Centre in the UK   April 16, 2018
Russian cyber actors do not need to leverage zero-day vulnerabilities or install malware to exploit devices. Instead, they take advantage of: devices with legacy unencrypted protocols or unauthenticated services, devices insufficiently hardened before installation, and devices no longer supported with security patches. These factors allow access to both intellectual property and U.S. critical infrastructure that supports the health and safety of the U.S. population. Network devices are ideal targets. A malicious actor with presence on an organization’s gateway router has the ability to monitor, modify, and deny traffic to and from the organization. Whoever controls the routing infrastructure of a network essentially controls the data flowing through the network.
The Russians, like many others, are abusing Cisco Smart Install enabled devices. There is more about abusing Smart install below, dated April 6th. Details on the Smart Install flaws are on the Bugs page under March 2018. Also being attacked are Generic Routing Encapsulation (GRE) and Simple Network Management Protocol (SNMP). The National Cyber Security Centre (NCSC) is an arm of British intelligence agency GCHQ.
From my Defensive Computing perspective, there is nothing special about Russia, all Internet-facing devices are scanned all the time. I blogged about this last month, Routers are constantly being probed - examining a firewall log

• Russian hackers targeting millions of devices around the world, US and UK warn by Lizzie Dearden of The Independent April 16, 2018. State-sponsored Russian hackers are using routers connecting people's homes and offices to the internet to spy on the information going through them.
• U.S.-U.K. Warning on Cyberattacks Includes Private Homes by David Kirkpatrick and Ron Nixon for the New York Times April 16, 2018. "Although Washington and London have known for decades that the Kremlin was trying to penetrate their computer networks, the joint warning appeared to represent an effort to deter future attacks by calling attention to existing vulnerabilities, prodding individuals to mitigate them and threatening retaliation against Moscow if damage was done."
• U.S., British governments warn businesses worldwide of Russian campaign to hack routers by Ellen Nakashima of the Washington Post April 16, 2018. "The agencies, which include the FBI, do not know precisely how many routers, firewalls and switches have been compromised and to what extent."
• Russian hackers are attacking home routers, ISPs and business firewalls to spy and steal data, warns US, UK by Danny Palmer of ZDNet April 16, 2018. "The joint US-UK alert comes days after Home Secretary Amber Rudd warned that the UK had been hit by 49 cyberattacks from Russian groups in the last six months. Jeremy Fleming, the Director of UK intelligence agency GCHQ also recently called out Russia's actions in cyberspace."
• US and UK blame Russia for 'malicious' cyber-offensive by Ewen MacAskill of The Guardian April 16, 2018. "The US and UK have previously blamed Russia for cyber-attacks ... But they portrayed this as far more serious because of the potential to undermine infrastructure. Millions of machines had been targeted in a 'sustained' campaign ... Previously the two nations have spoken only of attacks 'originating from Russia', with lines between Russian criminals and state activity being blurred, but they pinned blame on the Kremlin on this occasion ... The decision of the US and UK governments to go public reflects a loss of patience with Moscow after a series of cyber-attacks and hacks allegedly originating from within Russia."
• Russian hackers mass-exploit routers in homes, govs, and infrastructure by Dan Goodin at Ars Technica April 16, 2018. Just excerpts from the Alert. Adds nothing to the story.
• Joint US - UK statement on malicious cyber activity carried out by Russian government by Nicole Kobie of Wired April 16, 2018. This article does a miserable job of addressing the issue of what people should do to defend their routers. All it says is to install patches. Lame.

Hacked routers with malicious DNS servers lead to Android malware

Roaming Mantis uses DNS hijacking to infect Android smartphones
By Suguru Ishimaru of Kaspersky Lab Securelist   April 16, 2018
Android malware, dubbed Roaming Mantis, is distributed through router DNS hijacking. When a user attempts to access any website via a compromised router, they are redirected to a malicious website. For example, if a web browser tried to access www.securelist.com, it would be redirected to a rogue server that had nothing to do with the security research blog. The nature of the malicious website is hidden from the victim because the web browser displays the original URL. The malicious web page implores the victim to update to the latest version chrome. Victims that install the banking malware have their login credentials stolen. The malware can read SMS messages so it also steals the secret verification code used for two-factor authorization. The article goes into details on the malware, but says nothing about how the routers may have been hacked. It also offers bad advice: "If you have any concerns about the DNS settings on your router, please check the user manual and verify that your DNS settings haven't been tampered with, or contact your ISP for support." Better advice is to use the DNS server tester pages listed here to learn what your DNS servers are.

• Cybercriminals Hijack Router DNS to Distribute Android Banking Trojan by Swati Khandelwal of The Hacker News April 16, 2018

Hacking routers is the latest thing among bad guys

Cyber-Espionage Groups Are Increasingly Leveraging Routers in Their Attacks
By Catalin Cimpanu of Bleeping Computer   April 12, 2018
According to Costin Raiu, director of the Global Research and Analysis Team at Kaspersky Lab, the number of Advanced Persistent Threats leveraging routers for attacks has gone steadily up in the past year, and the tactic has become quite widespread in 2018. Maybe I should put ads on this site. Their research uncovered the LuckyMouse APT which uses routers for hosting their command and control servers, which, Raiu said, is unusual. They believe that the routers were hacked through an SMB vulnerability which allowed the bad guys to upload CGI scripts. He also pointed out that the US government released a document saying that router attacks have been the preferred attack vector for a number of malicious actors for a number of years, yet, the number of reports about router malware and router attacks are few and far between. Thus, Raiu concludes that there's a lot going on that we don't see.

Looks like the Boston Red Sox need better computer nerds

The Red Sox clubhouse's Wi-Fi password does not rank high for creativity
by Nik DeCosta-Klipa of Boston.com   April 12, 2018
Yankee manager, Aaron Boone, was being interviewed after a game at Fenway Park against the Boston Red Sox when the camera showed a bulletin board on the wall next to Boone. On the bulletin board was the Wi-Fi network name and password. This got some attention because the password was the miserably insecure - "baseball". The Red Sox could hardly have chosen a worse password. They took it well, however, tweeting "Guess we need a new WiFi password". As I explain, Wi-Fi passwords need to be at least 14 characters long to resist brute force attacks. However, for a high value target such as the visitors clubhouse at Fenway Park, I would certainly go with a longer password. When you consider all the schools near Fenway Park (Harvard and MIT come to mind), churning out fresh new techies, I would make the password still longer. The password was not their only mistake, an SSID of "clubhouse" gives away too much information. Why not call it "VisitorsClubhouse" and take away all mystery. Better network names would have been BlueSky or ColdWeather or JoesNetwork. See more about picking an SSID. Some of the suggestions on Twitter for new passwords, shown below, were not half bad.

• Chicken and Beer -- Useful to note that spaces are allowed in Wi-Fi passwords. You have to have been a Red Sox fan a few years ago to appreciate the humor in this suggestion.
• Slide.spikes.up -- Two special characters and an upper case letter are good. But, if you are only going to have one capital letter, best that it not be the first character. The password is a reference to the game the Yankee manager was being interviewed about.
• BatBoggsLeadoff -- three dictionary words is not strong enough for a Wi-Fi password. Wade Boggs played for both the Yankees and the Red Sox, by the way.
• JoeKellysRightHook -- four dictionary words is good enough average folks, but not for the Boston Red Sox
• WeLoveTheBullpenCop -- five dictionary words is an OK choice, but it could use a special character. Maybe "WeLove!TheBullpenCop." Its a reference to a 2013 World Series home run by David Ortiz.
• YankeesBlewA3-0Lead -- a great password, has both numbers, upper case letters and a special character
• 19RingsToGo -- a password starting with a number is a good strategy as most people put numbers at the end, but this is just too short
• CityOfChampions -- too short
• YuckTheFankees -- too short, though inventive and has only one dictionary word.
• JimRiceHasLoudTie$ -- pretty good password with upper case letters and a special character. Jim Rice used to play for the Red Sox. His name is a bit too short though. If Andrew Benintendi wore loud ties, that would make the password longer and thus more secure.
• StantonStruckOut FiveTimesInOneGameTwice -- great password and easy to remember. Still I might replace "five" and "one" with the numbers 5 and 1. So, "StantonStruckOut 5TimesIn1GameTwice" is long, has upper case letters and numbers and is pretty easy to remember. And, since Giancarlo Stanton has played in both leagues, every visiting team can appreciate the password. All that said, starting each word with a capital letter makes it harder to type. This would be easier to type and probably more secure as "stantonstruckout 5timesin1gameTWICE" As passwords go, that, is a work of art.
• OneTwoThreeFourFive -- Ugh
• Remember2004ALCS -- a great password, but easier to remember and longer as "Rememberthe2004ALCS"
• Olde_Towne_Team -- darn good. Including a special character between words is a great way to make a password more secure.
• 3timeWSChampsThisCentury -- a great password

A suggestion that made me laugh was to use "JarrodSaltalamacchia," noting that potential hackers are bound to get it wrong. Saltalamacchia used to catch for the Red Sox. My guess is that the same person that chose the old password will choose the new one, so it will probably be "baseball123." It won't take the kids from MIT too long to crack that one.

ISPs keep customers ignorant

What most people think it looks like when you change router's admin password, apparently
by Kat Hall of The Register   April 12, 2018
A survey, by the British comparison website Broadband Genie, reported that 82 per cent of responders have never changed their router password. The article is unclear however about whether it is referring to the router password or to a Wi-Fi password. The survey also found that 52 per cent have not changed their Wi-Fi network name (SSID). This advertises to bad guys that the owner of this network is technically clueless, which may invite attack. 48 per cent of responders said they were baffled as to why they would need to make these changes. A pessimist might assume that ignorant customers make fewer tech support calls. This article is just as guilty as the ISPs it is trying to shame. It notes that bad things can happen if the DNS servers in the router are changed, but fails to mention that you can test for this fairly easily. My Test Your Router page lists many websites that report on the currently used DNS servers.

• Wi-Fi router security knowledge gap putting devices and private data at risk in UK homes by Matt Powell of Broadband Genie. April 12, 2018. This is the original research. "We asked 2,205 people aged 18+ about whether they had carried out simple tasks like changing their Wi-Fi password, changing their router admin password or updating the router’s firmware." Only 14 percent of the respondents have updated their router's firmware. Only 18 percent have changed the admin account password. Only 31 percent have changed the WiFi password.
• Survey Reveals Users Have No Clue About Router Security by Catalin Cimpanu of Bleeping Computer April 23, 2018.

Two router surveys by PC Magazine

April 11, 2018: PC Magazine just published their Readers' Choice Awards 2018: Routers and NAS Devices. Asus won the router award for the seventh straight year. Just days earlier, Akamai issued a white paper, UPnProxy: Blackhat Proxies via NAT Injections that detailed problems with UPnP. The Akamai paper listed buggy devices. Asus had quite a few buggy routers: DSL-AC68R, DSL-AC68U, DSL-N55U, DSL-N55U-B, MTK7620, RT-AC3200, RT-AC51U, RT-AC52U, RT-AC53, RT-AC53U, RT-AC54U, RT-AC55U, RT-AC55UHP, RT-AC56R, RT-AC56S, RT-AC56U, RT-AC66R, RT-AC66U, RT-AC66W, RT-AC68P, RT-AC68R, RT-AC68U, RT-AC68W, RT-AC87R, RT-AC87U, RT-G32, RT-N10E, RT-N10LX, RT-N10P, RT-N10PV2, RT-N10U, RT-N11P, RT-N12, RT-N12B1, RT-N12C1, RT-N12D1, RT-N12E, RT-N12HP, RT-N12LX, RT-N12VP, RT-N14U, RT-N14UHP, RT-N15U, RT-N16, RT-N18U, RT-N53, RT-N56U, RT-N65R, RT-N65U, RT-N66R, RT-N66U, RT-N66W, RTN13U, SP-AC2015 and the WL500. Peplink, my preferred router vendor, was not on the radar screen of PC magazine readers.

Throwing salt on the wound, two days later the magazine came out with their Business Choice Awards for routers, which also recommended Asus. This is crazy, Asus does not make Business class routers. The magazine claimed to have surveyed admins and IT folks, maybe they should use Facebook to find real IT folks. Then again, maybe it tells us more about PC Magazine than it does about Asus.

Cisco devices are being hacked all over the world

What happened to the Internet: attack on Cisco switches
by Kaspersky   April 6, 2018
At the end of March 2018 Cisco released 34 bug fixes of which three were deemed critical. Details are on the Router Bugs page. By April 6th, there was a massive attack against Cisco switches. These devices are used in data-centers across the globe. The attacks are exploiting a bug in the Cisco Smart Install Client software. The Smart Install protocol does not require authentication and should not be exposed to the Internet. Yet, there it is. Kaspersky blames the nerds working in datacenters for failing limit access to TCP port 4786. Or, they should have disabled Smart Install altogether. A simple command tests if Smart Install is running and another command can disable it. Hackers have attacked networks in a number of countries including Iran where they left the image of a U.S. flag on screens along with a warning: "Don't mess with our elections." Some hackers claimed to have fixed the bug on vulnerable devices in the U.S. and UK. One report said the flaw apparently affected 200,000 router/switches. Talos found 168,000 devices exposed by the Cisco Smart Install Client. Motherboard reported 166,000. Attackers are able to reset the devices back to their default configuration and display a message to the victims. The attack on some ISPs cut off Internet access for their subscribers. Talos observed hackers exploiting the vulnerability to target critical infrastructure. Joseph Cox of Motherboard said that the attack seems relatively unsophisticated. Taols, which is owned by Cisco, believes that some of the attacks are from nation-state actors. Sounds better than a bunch of 14 year old kids.

• Critical Infrastructure at Risk: Advanced Actors Target Smart Install Client by Nick Biasini of Talos. April 5, 2018. Cisco reports on their own screw-up. The company is taking an active stance, whatever that means. The buggy software is legacy, which means phooey on you for using our old stuff. Rather than call it a bug or a flaw or vulnerability, the attacks are due to "protocol misuse". Back in 2016, fellow cyber-security firm Tenable reported observing 251,000 exposed Cisco Smart Install Clients.
• Iranian & Russian Networks Attacked Using Cisco's CVE-2018-0171 Vulnerability by Lawrence Abrams of Bleeping Computer April 7, 2018
• Don't Mess With Our Elections: Vigilante Hackers Strike Russia, Iran by Joseph Cox of Motherboard April 7, 2018
• Iran hit by global cyber attack that left U.S. flag on screens by Reuters April 7, 2018

The better to spy on you, my dear

Chinese city shops ordered to start using government-approved routers
by Shannon Liao of The Verge April 5, 2018
The eastern Chinese city of Qingdao will force shops and restaurants that offer Wi-Fi hotspots to use government-approved routers. The stores have to buy the routers themselves at a cost of either $16 or $63. Failure to use the mandated routers incurs a penalty of up to $18,589. The routers are made by BHU, which boasts on its website about a "long-term close collaboration" with local police in China. Do I need to even mention that in August 2016 an expert found multiple security flaws in a Bhu router (see the Router Bugs page). There were three different ways to gain admin access to the router and it also injected suspicious looking third party JavaScript into HTTP traffic. Qingdao is not the first city to mandate a government-approved router. Free routers were given to shops in Chifeng, a city in Inner Mongolia, in 2016. Multiple cities in China have been told to install a "security management system."

• Police tell shops and restaurants to use government approved WiFi router by Xinmei Shen for Abacus News. April 5, 2018. The original source of the story.

MikroTik routers used in DDoS attacks

Mirai-Variant IoT Botnet Used to Target Financial Sector in January 2018
by Priscilla Moriuchi and Sanil Chohan of the Insikt Group. April 5, 2018
In late January 2018, three European financial institutions were hit by DDoS attacks powered by a new variant of the Mirai botnet. The botnet that hit the first company consisted of at least 13,000 devices. The Insikt Group used IP geolocation, service banners from Shodan, and additional metadata to analyze the composition of the botnet and found that the attack was 80 percent comprised of compromised MikroTik routers, with the remaining 20 percent composed of various IoT devices ranging from vulnerable Apache and IIS web servers, to routers from Ubiquity, Cisco, and ZyXEL. All of the compromised MikroTik devices had TCP port 2000 open, which is usually reserved for MikroTik’s bandwidth test server protocol. This port is usually enabled by default in new MikroTik devices. No MikroTik devices with TCP 2000 disabled (a recommended security measure in production environments) were discovered within the botnet.

MARCH 2018

Multiple reports of DNS hijacking on Asus routers

Asus RT-AC66U DNS hacking
by Mpuk7   at the SmallNetBuilder forum   March 10, 2018
Because I maintain this website, someone emailed me asking about their Asus router that had its DNS hijacked. As we both looked into it, there seems to be a lot of that going around. The person who posted this claimed to have the latest Asus firmware, a long password and they had even changed the default router userid. Of course, the latest firmware, at least with consumer routers, always includes old software with known bugs. I am not qualified to review the Asus router log, but this one made it obvious the router was running some old software with known bugs. The router had remote administration enabled, which is almost always a mistake. Two interesting quotes from these reports: "I tried Asus support but they were immensely useless" and another person said Asus was as helpful as a chocolate teapot :-) Two of the bad DNS servers were 185.183.96.174 and 185.117.75.242.
Update March 16, 2018: David Redekop suggested this might be the flaw that was abused here: ASUS Patches Root Command Execution Flaws Haunting Over a Dozen Router Models. Routers enabled for Remote Administration using HTTP rather than HTTPS would be vulnerable to this.

• Did I just get DNS Hijacked? by Imran at Security.StackExchange.com. March 12, 2018. At first iTunes on his Macbook complained that it couldn't connect to Apple. Then, at www.apple.com, his browser warned that the site was not secure. Here too, Remote Administration of the router was enabled. Asus model AC87U running firmware 3.0.0.4.380.7743 (1 release behind) with a non-default password.
• "My ASUS home router was apparently hacked and a rogue DNS server in Dubai added to the configuration. It redirected sites like hxxp://apple.com to a phishing site that (I think) I caught before my children gave away their credentials. Check your routers kids." Tweet by Harlan Barnes @harlanbarnes March 9, 2018
• Have I been DNS Hijacked? by Virdi at OverClockers.co.uk February 24, 2018

MikroTik routers hacked to infect Windows PCs

Kaspersky Lab uncovers Slingshot, the spy that came in from the router
by Kaspersky   March 9, 2018
It is not known how the MikroTik routers were hacked. Currently routers are configured using either a web interface or a mobile app. In the previous century they were administered with Windows software. The hacked routers were administered with Windows software known as Winbox. Winbox, for whatever reason, downloads some Windows executable files (DLLs) from the router. The hacked routers had malicious DLLs that infected the Windows computer used to configure the router. This was professional spyware of the highest caliber. The infections seem to be very targeted, with only around 100 PCs known to be infected. The spyware was extremely effective at stealthy information gathering, hiding its traffic in marked data packets that it can intercept without trace from everyday communications. Operation slingshot seems to have started in 2012 and was still active in February 2018. The MikroTik router firmware no longer installs software on Windows computers. Winbox is still a thing, but they also have a web interface. Kaspersky software can defend against this. So too, can a Chromebook.

• The Slingshot APT FAQ by Kaspersky March 9, 2018
• Router-Hacking 'Slingshot' Spy Operation Compromised More Than 100 Targets by Andy Greenberg of Wired March 9, 2018. Routers have long made an attractive target for hackers. They're always on and connected, often full of unpatched security vulnerabilities, and offer a convenient chokepoint for eavesdropping on all the data you pipe out to the internet. Infecting a router at a business or coffee shop, potentially gives access to a broad range of users.
• Cyber-Espionage Group Infects Victims Through MicroTik Routers by Catalin Cimpanu at Bleeping Computer March 9, 2018. Slingshot appears to be a state-sponsored group and not your regular cyber-criminal operation focused on personal profits.
• The Slingshot APT A detailed look at the internal workings of the malware. March 6,2018
• Potent malware that hid for six years spread through routers by Dan Goodin of Ars Technica March 10, 2018
• Kaspersky's 'Slingshot' report burned an ISIS-focused intelligence operation by Chris Bing and Patrick Howell O'Neill of Cyberscoop Mar 20, 2018

FEBRUARY 2018

Ellen Nakashima, of the Washington Post, wrote Russian spies hacked the Olympics and tried to make it look like North Korea did it. Quoting: "Apart from accessing the computers, GRU cyber-operators also hacked routers in South Korea last month ... according to Western intelligence agencies. Such access could enable intelligence collection or network attacks..." The article also has a quote from security expert Jake Williams of Rendition Infosec: "Anyone who controls a router would be able to redirect traffic for one or more selected targets or cause total disruption in the network by stopping the routing entirely."

JANUARY 2018

An old D-Link HNAP flaw exploited by a new botnet

Masuta : Satori Creators' Second Botnet Weaponizes A New Router Exploit.
by Ankit Anubhav, Principal Researcher, NewSky Security   January 23, 2018
Quoting: "We analyzed two variants of an IoT botnet named 'Masuta' where we ... discovered a router exploit being weaponized for the first time in a botnet campaign ... The weaponized bug introduced in PureMasuta botnet is in the HNAP (Home Network Administration Protocol) which itself is based on the SOAP protocol. It is possible to craft a SOAP query which can bypass authentication by using hxxp://purenetworks.com/ HNAP1/GetDeviceSettings. Also, it is feasible to run system commands (leading to arbitrary code execution) because of improper string handling. When both issues are combined, one can form a SOAP request which first bypasses authentication, and then causes arbitrary code execution."

• Hacking the D-Link DIR-890L by Craig Heffner. A detailed article on the bug from 2015.
• Everything you ever wanted to know about HNAP by me on this site.
• Fresh botnet recruiting routers with weak credentials by Richard Chirgwin of The Register Jan 24, 2018

MikroTik and Ubiquiti Routers defaced due to default passwords

Tens of Thousands of Defaced MikroTik and Ubiquiti Routers Available Online
by Catalin Cimpanu of Bleeping Computer   January 10, 2018
If you don't change the default password, you get what you deserve. It seems that, as a prank, someone has been changing the names of routers. Ankit Anubhav of cyber-security company NewSky Security, first ran across this back in July. He estimates that over 40,000 Ubiquiti routers have been defaced along with 7,300 MikroTik routers. The names given to the routers are "HACKED FTP server," "HACKED-ROUTER-HELP-SOS-WAS-MFWORM-INFECTED," and "HACKED-ROUTER-HELP-SOS-HAD-DEFAULT-PASSWORD."

• Ankit Anubhav Principal Security Researcher at New Sky Security

2017   top

DECEMBER 2017

Satori botnet abusing routers

Warning: Satori, a Mirai Branch Is Spreading in Worm Style on Port 37215 and 52869
by Li Fengpei of Qihoo 360 Netlab   December 5, 2017
Quoting: "About 12 hours ago ... we noticed a new version of Satori (a mirai variant which we named Satori), starting to propagate very quickly on port 37215 and 52869. Two new exploits ... have been added ... during last recent 12 hours we have seen 263,250 different IPs scanning port 37215, and 19,403 IPs scanning port 52869." They have not yet disclosed information on the flaw involving port 37215. The bug being exploited on port 52869 is derived from CVE-2014-8361. It is not clear, to me at least, if this is the same botnet that Dan Goodin wrote about below.
UPDATE: Script Kiddie Responsible for Large Satori Botnet by Lucian Constantin in Security Boulevard December 22, 2017. Security researchers at Check Point Software believe that the Satori botnet of more than 250,000 routers was created by an amateur hacker with limited skills. The botnet abuses a known bug in the Miniigd UPnP SOAP service on port 52869 and a new bug in Huawei HG532 home gateways on port 37215. Huawei exposed a configuration service intended to only be used on the LAN side to the Internet. It is scary that a relatively unskilled attacker can build a large botnet capable of devastating attacks. It highlights the poor state of router and IoT security across the internet.

• IoT Botnet Satori Grows Rapidly Thanks to Zero-Day Flaw by Lucian Constantin in Security Boulevard December 7, 2017. The port 52869 attacks abuse a bug in the Miniigd UPnP SOAP service from a Realtek SDK. The bug was disclosed in 2014 and affects networking devices from multiple vendors that use Realtek RTL81xx chipsets.
• Satori Botnet Has Sudden Awakening With Over 280,000 Active Bots by Catalin Cimpanu of Bleeping Computer Dec. 5, 2017
• Realtek SDK - Miniigd UPnP SOAP Command Execution June 1, 2015. Different devices using the Realtek SDK with the miniigd daemon are vulnerable to OS command injection in the UPnP SOAP interface.
• Security Notice - Statement on Remote Code Execution Vulnerability in Huawei HG532 Product Created Nov. 30, 2017, Last Updated Dec. 22, 2017

Starbucks Wi-Fi hacked in Buenos Aires

Starbucks Wi-Fi hijacked customers' laptops to mine cryptocoins
by Lisa Vaas of Sophos   December 14, 2017
A Starbucks in Buenos Aires was secretly infecting customer computers to mine cryptocoins. The mining was noticed by Noah Dinkin. It was a JavaScript miner from CoinHive for generating Monero. Starbucks responded that they don't run the Wi-Fi, that it was out of their control but they would contact their ISP.

• Starbucks Wi-Fi Hijacked People's Laptops to Mine Cryptocurrency by Jordan Pearson of Motherboard Dec. 12 2017. A Starbucks spokesperson told Motherboard that the incident was isolated to the Beunos Aires location.

A botnet spreads by attacking un-named flaws in Huawei Home Gateways

100,000-strong botnet built on router 0-day could strike at any time
by Dan Goodin of Ars Technica   December 5, 2017
First off, clickbait. There are many botnets that could strike at any time. It is, sadly, the new normal. The buggy devices are the Huawei EchoLife Home Gateway and the Huawei Home Gateway. The bug was first disclosed by Check Point Software on Nov. 27, 2017. The botnet spreads both by abusing a bug and also by guessing 65,000 different userid/password combinations. It does not abuse Remote Administration. This is the second botnet, after Reaper, to spread by abusing flaws in routers. There is much we do not know:
--There are multiple Huawei Home Gateway models and it is not clear if some or all are buggy
--What firmware versions have the bug?
--What userid/passwords is the botnet guessing
--Defense. The article says nothing at all about defending against the flaw. Typical of clickbait.
--Does Huawei know about the bug? Acknowledge it? Have they issued a fix?

• Huawei HG532 Router Remote Code Execution Check Point Advisory CPAI-2017-1016. Nov. 27 2017. Quoting "A remote code execution vulnerability exists in Huawei HG532 Routers. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request."

JUNE 2017

UPnP abused by Windows malware

McAfee Discovers Pinkslipbot Exploiting Infected Machines as Control Servers; Releases Free Tool to Detect, Disable Trojan
by Sanchit Karve of McAfee Labs   June 16, 2017
Pinkslipbot (also known as QakBot or QBot) is a notorious banking-credential harvester that has been active since 2007. It primarily targets users and enterprises located within the United States. The malware uses a new and complicated cloaking strategy to hide the location of its Command and Control servers. It uses two layers of HTTPS proxies made up of around 500,000 infected PCs. Anyone trying to find the IP address of the control server will instead see the proxy system shielding it. Pinkslipbot uses universal plug and play (UPnP) to open ports in the router firewall.

• New malware uses old trick – and is a reminder to disable UPnP by John E Dunn of Sophos Naked Security. June 21, 2017.

For years, the CIA has targeted routers

CIA has been hacking into Wi-Fi routers for years, leaked documents show
by Zack Whittaker of ZDNet   June 15, 2017
Secret documents, dated 2012 and leaked by WikiLeaks, reveal that the CIA has been targeting and compromising routers for years in an effort to carry out clandestine surveillance. One tool, known as CherryBlossom, allows the agency to monitor a target's Internet activity, redirect their browser and scan for information. The documents, which have not been verified, suggest this has been going on for years. CherryBlossom runs on 25 router models from 10 different manufacturers, and it's likely that modifications would allow the implant to run on at least 100 more routers. Among the brands are Asus, Belkin, Buffalo, Dell, Dlink, Linksys, Motorola, Netgear, Senao and US Robotics.

• Advanced CIA firmware has been infecting Wi-Fi routers for years by Dan Goodin of Ars Technica June 15, 2017. Quoting: "Missions can target connected users based on IPs, e-mail addresses, MAC addresses, chat user names, and VoIP numbers. Mission tasks can include copying all or only some of the traffic; copying e-mail addresses, chat user names, and VoIP numbers; invoking a feature known as 'Windex,' which redirects a user's browser that attempts to perform a drive-by malware attack; establishing a virtual private network connection that gives access to the local area network; and the proxying of all network connections."
• ZDNet said: "Routers remain a prime target for intelligence agencies and hackers alike because of they act as a central port of call for an entire network. What makes routers such an attractive target is that they are more often than not riddled with security flaws that make exploitation easy."
• WikiLeaks Reveals How the CIA Could Hack Your Router by Andy Greenberg in Wired June 15, 2017. The headline is wrong, nothing was revealed about "how" to hack a router. Quoting: "a CIA hacker can then install their own custom firmware, which it calls Flytrap, on a victim's router. That malicious firmware can monitor the target's browsing, strip the SSL encryption from web links they click, and even inject other exploits into their traffic, designed to offer access directly to the target's PC or phone."
• CherryBlossom user guide from WikiLeaks. 175 page PDF
• CherryBlossom user guide at DocumentCloud.org

MAY 2017

Privacy issues with Trend Micro software in Asus routers

Review: ASUSWRT router firmware
by Daniel Aleksandersen of Ctrl.blog   May 2, 2017
The stock firmware that runs Asus routers is called ASUSRWRT and it has a somewhat hidden privacy issue. If you use any of the following features, it will collect and transmit data about which websites you visit to Trend Micro: Apps/traffic Analysis, Bandwidth Monitor, Network Analyzer, Network Protection (AiProtection), Parental Controls (including time scheduling), Quality-of-Service, Web History and Network Map. This is spelled out in a EULA from Trend Micro. If the software thinks a website URL is potentially fraudulent, it sends the URL to Trend. In addition, executable files or content that is identified as potential malware is also send to Trend. Finally, email messages identified as spam or malware are sent to Trend, despite the fact that they may contain sensitive data. Quoting: "The EULA also contains language holding the router's owner responsible for notifying their friends, family, and house guests who connect to the internet through the ASUS router that any network activity may be recorded and shared with Trend Micro."

• The Asus RT-AC68U router - it's fast but it also secure? by John E Dunn July 20, 2015. Quoting: "Owners might want to have a close look at the End User License Agreement (EULA) for this system, which is where privacy concerns rear their head .... Trend micro will have access to all websites and services visited while the software is enabled ... This isn't to criticise the router for offering this form of security simply to underline that it comes with a level of passive intrusion some might baulk at in other contexts. Equally, ISPs can collect exactly the same data if they choose so it's important not to over-react."
• Trend Micro End User License Agreement Undated
• How does AiProtection protect my home network? from Asus. Undated.
• TP-Link Archer C3150 V2 review March 9, 2018. The TP-Link HomeCare, powered by Trend Micro, sounds like its the same software in a TP-Link router.

APRIL 2017

More abuse of TR-069

Thousands of Hacked Home Routers are Attacking WordPress Sites
by Mark Maunder of Wordfence   April 11, 2017
We have seen this story before. ISPs leave the TR-069 port, number 7547, open to the world at large rather than restricting access to themselves. Just more support for my recommendation to avoid using a router from an ISP. Wordfence reports that Shodan found over 41 million devices are listening on port 7547.

• Is Your Router Helping Criminals Attack Popular Websites? by Lee Mathews April 12, 2017

FEBRUARY 2017

Dealing with a hacked Netgear router

Router assimilated into the Borg, sends 3TB in 24 hours
by Chris Lee of Ars Technica   February 26, 2017
Interesting story by someone who is not a networking expert. His Netgear R6400 router was hacked. The article goes into the symptoms of the problem and the debugging steps that he took to figure out the problem. After realizing the router had been hacked, a factory reset did not fix the problem which tells me that the router was running malicious firmware. DD-WRT was not much help. In the end, the router was a paperweight.

JANUARY 2017

FTC accuses D-Link of poor security

Feds Accuse D-Link of Failing to Properly Secure Routers and Webcams
by Chris Morran of consumerist.org   January 5, 2017
Federal regulators have accused D-Link of leaving its routers and webcam devices vulnerable to hackers. A lawsuit alleges that D-Link "failed to take reasonable steps to protect their routers and IP cameras from widely known and reasonably foreseeable risks of unauthorized access." D-Link is also accused of misleading the public about the security of their devices. This is going to trial in January 2019.
This is the second time the FTC has gone after insecure routers. In February 2016, they went after Asus for their insecure routers. At least Asus took their medicine, D-Link, in contrast, cried foul.

• The FTC lawsuit (PDF)
• D-Link case alleges inadequate Internet of Things security practices blog by Lesley Fair of the FTC Jan 5, 2017
• FTC Charges D-Link Put Consumers Privacy at Risk Due to the Inadequate Security of Its Computer Routers and Cameras Press release from the FTC Jan. 5, 2017
• D-Link Systems, Inc. Responds to FTC Complaint Defending Security Practices D-Link press release Jan 5, 2017
• FTC Sues D-Link For Pretending To Give A Damn About Hardware Security by Karl Bode of Techdirt Jan 13, 2017
• FTC: D-LINK FAILED TO SECURE ROUTERS, IP CAMERAS by Chris Brook of Kaspersky Threatpost Jan 5, 2017. This article puts the D-Link issues in perspective, noting a number of their other recent security failures.
• Feds Sue D-Link Over Router, Security-Camera Flaws by Paul Wagenseil in Toms Guide Jan 6, 2017
• FTC sues D-Link for insecure routers and IP cameras by Lisa Vaas of Sophos Jan 9, 2017

Thailand ISP ignores router flaws

Router vulnerabilities disclosed in July remain unpatched
by Michael Mimoso of Kaspersky Threatpost   January 17, 2017
The first sentence of this article is all you need to read: "Details on serious vulnerabilities in a number of routers freely distributed by a major Thai ISP were published on Monday after private disclosures made to the vendors in July went unanswered." As I say elsewhere on this site, don't use a router provided by your ISP. TrueOnline, the largest broadband company in Thailand, gives their customers three buggy routers: ZyXel P660HN-T v1, ZyXel P660HN-T v2 and Billion 5200 W-T. Multiple bugs (default admin accounts and command injection vulnerabilities) were found and disclosed by Pedro Ribeiro of Agile Information Security. Most of the vulnerabilities can be exploited remotely, some without authentication. It is likely that the same flaws exist in other ISP customized routers in other countries. A ZyXel representative told Threatpost the router models are no longer supported. Billion ignored a request for comment from Threatpost.

• SOHOpeless routers offer hard-coded credentials and command injection bugs by Richard Chirgwin Jan. 18, 2017
• Multiple RCE in ZyXEL / Billion / TrueOnline routers Full Disclosure mailing list. By Pedro Ribeiro Jan. 16, 2017
• SSD Advisory - ZyXEL / Billion Multiple Vulnerabilities SecuriTeam Secure Disclosure by Maor Schwartz Dec. 26, 2016

2016   top

OCTOBER 2016

In October 2016, Brian Krebs wrote about malware that targeted Asus and Linksys routers. The software turned the routers into SOCKS proxies, which help bad guys hide their location, much like Tor. Bad guys were using these hacked routers for "or a variety of badness, from proxying Web traffic destined for cybercrime forums to testing stolen credit cards at merchant Web sites." Plus, access to these hacked routers was being sold in exchange for Bitcoin.

This is why Router Security matters

IoT Home Router Botnet Leveraged in Large DDoS Attack
by Daniel Cid of Sucuri   September 1, 2016
This is a blog post about a DDoS attack that Sucuri fought off for a client. The attack used three different botnets, one of them composed of routers. Sucuri detected over 11,000 compromised routers from eight different vendors. Quoting: "The largest number of routers being exploited came from Huawei-based routers. They varied between versions: HG8245H, HG658d, HG531, etc." Other routers were from MikroTik, Ubiquiti, NuCom, Dell SonicWall, VodaFone, Netgear, and Cisco-IOS.

FEBRUARY 2016

Building router hacked

Building automation systems are so bad IBM hacked one for free
by Darren Pauli of The Register   Feb 11, 2016
Quoting: "An IBM-led penetration testing team has thoroughly owned an enterprise building management network in a free assessment designed to publicize the horrid state of embedded device security ... they found exposed administration ports ... gaining access to a D-Link panel enabled to allow remote monitoring ... by adding an extra carriage return after the page request it was possible to bypass the router's authentication. They found command injection vulnerabilities in the router and found a list of commands in the firmware source code. They found a cleartext password in the router's var directory that not only granted more router pwnage but, thanks to password-reuse, allowed them to compromise the building management system." No mention of who made the router, let alone a model number.

• Penetration testing a building automation system (PDF) by IBM X-Force Research Feb. 2016

2015   top

In August 2015, Jeff Atwood blogged about how two people he knew fell victim to compromised routers (see Welcome to The Internet of Compromised Things). In one case, the infected router inserted ads onto all HTTP web pages. Quoting:

It's becoming more and more common to see malware installed not at the server, desktop, laptop, or smartphone level, but at the router level ... I write about this because it recently happened to two people I know ... This is way more evil genius than infecting a mere computer. If you can manage to systematically infect common home and business routers, you can potentially compromise every computer connected to them. Router malware is the ultimate man-in-the-middle attack ... [bad guys] can direct you to phishing websites at will - if you think you're on the "real" login page for the banking site you use, think again.

In May 2015, Scott Hanselman wrote about an infected router at his local sandwich shop that "... started to redirect me to a fake 'update your flash' and download a 'Install flashplayer_10924_ i13445851_il345.exe' malware file .... This affects their PoS (Point of Sale) system, tablets, iPhones ... It's a MitM attack (Man in the Middle) where x number of HTTP GETs work fine and then every few hundred the router returns it's own HTML."

Victims don't have do anything to have their computing devices infected with malware. A hacked router can corrupt the self-update mechanism of either the operating system or a specific application. In June 2015 a case like this got a lot of publicity; the pre-installed Swift keyboard on Samsung smartphones self-updated in an insecure way that could be corrupted by anyone able to modify network traffic. A hacked router is one source, so too is a malicious ISP, a bad guy on the LAN or malware running on another LAN-resident device. Because the keyboard software ran with very high system privileges there was almost no end to what malware it was tricked into installing could do.

Australian ISP Optus screws up

Optus must hire checkbox champion after epic router, voicemail borking
by By Darren Pauli of The Register March 27, 2015
Australia's second-biggest telco, Optus, shipped hundreds of thousands of routers with open internet ports and default credentials. Going back as far as 2008, they shipped 300,000 Cisco and Netgear modems that exposed management ports and contained default access credentials.

2012   top

When visiting popular websites, the router can install malware by prompting users to install a plug-in. Here is a screen shot of this from 2012 in Brazil. See also Info Stealer Poses as Google Chrome Installer from Trend Micro written in May 2012.