Router Security Router attacks in the news Website by     
Michael Horowitz 
Home Site Index Bugs News Security Checklist Tests DNS Resources Stats Search Popular Pages
Also see my Defensive Computing Checklist website
 

Routers in the news, pretty much means routers getting exploited by bad guys to do bad things. I am still waiting for a good news story about routers. The flaws that are exploited are documented on the Bugs page. Articles that offer security advice are listed on the Other router security advice page.

YEARS:   2023   2022   2021   2020   2019   2018   2017   2016   2015   2012

2024

DECEMBER 2024

TP-Link may get banned in the US

U.S. Weighs Ban on Chinese-Made Router in Millions of American Homes
by Heather Somerville, Dustin Volz and Aruna Viswanatha for the Wall Street Journal   December 18, 2024
This is the original article with original reporting. But, it is behind a paywall so see the other articles below. In brief, TP-Link is Chinese and bugs/flaws (backdoors?) in their routers have been abused by many bad guys. As a result, three branches of the US government are investigating TP-Link: Commerce, Defense and the Justice department. As to security the article says: "TP-Link routers are routinely shipped to customers with security flaws, which the company often fails to address, according to people familiar with the matter. While routers often have bugs, regardless of their manufacturer, TP-Link doesn't engage with security researchers concerned about them, the people said.&uqot; It also says that over 300 ISPs in the US give their customers TP-Link devices. On the government side, TP-Link is used by NASA, the Defense Department and the DEA. Taiwan and India are also skeptical about TP-Link router security. The article says TP-Link has roughly 65 percent of the U.S. market for routers for homes and small businesses, but there is no source for this information. I live in a very crowded Wi-Fi area and there are mostly ISP routers around me; very few consumer routers. You can get a feel for the security of TP-Link routers by reviewing the News and Bugs pages on this very website :-)
What will come of this? Whether TP-Link is banned, as was Kaspersky, or not, will make little difference. A meaningful increase in router security requires routers to self-update with bug fixes and for there to be a software expiration date on routers; just like milk. Politicians will look good and make speeches for sure but nothing important is likely to result.

Juniper ships with a default password

2024-12 Reference Advisory: Session Smart Router: Mirai malware found on systems when the default password remains unchanged
by Juniper   December 17, 2024
Article IDJSA92451. I don't know exactly what the Juniper Session Smart Router (SSR) or Session Smart Network (SSN) platforms are. But, they clearly ship with default passwords and users are NOT forced to change the default password. This is a miserably lazy, insecure way of doing things. Even some consumer routers force the user to change the out-of-the-box password. Quoting: "These systems have been infected with the Mirai malware and were subsequently used as a DDOS attack source to other devices accessible by their network. The impacted systems were all using default passwords." The infections were so bad, the recommended action is to wipe the whole system and start from scratch.

NOVEMBER 2024

New Router Attack - Nearest Neighbor

Russian spies may have moved in next door to target your network
by Brandon Vigliarolo of The Register   November 25, 2024
No router bugs were used or abused in this attack. A Wi-Fi network across the street from the ultimate victim was used to login to the Wi-Fi network of the victim company. This was directed by Russian bad guys who were thousands of miles away. The Russians were so persistent, the hacked two different companies near the ultimate victim. After being blocked initially, they got in through the Guest network of the victim, then from there into their internal what-should-have-been secure network. The Russians found a device that could access both the Guest Wi-Fi and the internal-only Wi-Fi networks. The ultimate victim used Windows everywhere, which has to have played a part in all this. The internal Wi-Fi network was logged into using Windows domain credentials. The whole thing started with bad passwords, the Russians used brute force password guessing on a public service provided by the ultimate victim. That's how they got the passwords for the ultimate victim company. Never re-use passwords. Never.

Old routers continue to be hacked by the Chinese

Volt Typhoon rebuilds malware botnet following FBI disruption
by Bill Toulas of Bleeping Computer   November 12, 2024
Quoting: " The Chinese state-sponsored hacking group Volt Typhoon has begun to rebuild its "KV-Botnet" malware botnet after it was disrupted by law enforcement in January ... Volt Typhoon ... is believed to have infiltrated critical U.S. infrastructure, among other networks worldwide ... Their primary strategy involves hacking SOHO routers and networking devices, such as Netgear ProSAFE firewalls, Cisco RV320s, DrayTek Vigor routers, and Axis IP cameras, to install custom malware that establishes covert communication and proxy channels and maintain persistent access to targeted networks ... According to a report by SecurityScorecard, Volt Typhoon has started to rebuild its botnet by targeting outdated Cisco and Netgear routers and has compromised a significant number of devices in just over a month ... The KV-Botnet ... attempts to mainly compromise Cisco RV320/325 and Netgear ProSafe series devices. .... The main operation of the KV-Botnet appears to be obfuscating malicious activities by routing traffic through the compromised legitimate infrastructure."
The hacked devices no longer get bug fixes (EoL or End of Life is the official nerd term for this) leaving them permanently vulnerable. It is not know which bug or bugs is being exploited to hack the routers.

OCTOBER 2024

Bugs in Network Security Hardware

Inside a Firewall Vendor's 5-Year War With the Chinese Hackers Hijacking Its Devices
by Andy Greenberg of Wired   October 31, 2024
TLDR: things are bad. Quoting:
"For years, it's been an inconvenient truth within the cybersecurity industry that the network security devices sold to protect customers from spies and cybercriminals are, themselves, often the machines those intruders hack to gain access to their targets. Again and again, vulnerabilities in 'perimeter' devices like firewalls and VPN appliances have become footholds for sophisticated hackers trying to break into the very systems those appliances were designed to safeguard."
Sophos just issued a report on their battle with Chinese bad guys. Why?
"Sophos says it's telling that story now ... to break the cybersecurity industry's awkward silence around the larger issue of vulnerabilities in security appliances serving as entry points for hackers. In just the past year, for instance, flaws in security products from other vendors including Ivanti, Fortinet, Cisco, and Palo Alto have all been exploited in mass hacking or targeted intrusion campaigns. 'This is becoming a bit of an open secret. People understand this is happening, but unfortunately everyone is zip,' says Sophos chief information security officer Ross McKerchar ... Sophos' report also warns ... that in the most recent phase of its long-running conflict with the Chinese hackers, they appear more than ever before to have shifted from finding new vulnerabilities in firewalls to exploiting outdated, years-old installations of its products that are no longer receiving updates."

Hacked Consumer Routers abused by Chinese Bad Guys

Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
by Microsoft Threat Intelligence   October 31, 2024
Microsoft is their normal self here. To summarize: things are bad, use more of our software to make things good. As to details, since August 2023 they have observed a network of compromised small office and home office (SOHO) routers being used in password spraying attacks. The bad guys are Chinese and they are trying to gain initial access to enterprise networks. Routers made by TP-Link make up most of the network but Microsoft has no idea what bug(s) the bad guys are using to infect the routers. Microsoft calls the botnet network Quad7. The bad guys are know to target think tanks, government organizations, non-governmental organizations, law firms, defense industrial base, and others. To stay under the radar, the bad guys don't use the whole botnet at any one time. Also, the bad guys only hit any one target with a fake login attempt once a day. Multiple groups of bad guys are believed to be using the botnet. Microsoft offers no guidance at all for anyone with a TP-Link router.

AUGUST 2024

Never saw this coming: US Congress worried about Chinese routers

Moolenaar, Krishnamoorthi Call for Investigation into Chinese Wi-Fi Routers in U.S. Vulnerable to CCP Hacking & Data Harvesting
Press Release from the US House of Representatives   August 15, 2024
Simply put, which the US government does not do, some members of Congress think its a bad thing for us to be using Chinese routers. This is from the US House Committee on CCP. They won't do anything, but they ask the Commerce Department to investigate TP-Link. Why? Too many of their routers in the US creates a potential national security risk. Wow. Can't say that I disagree. Almost the same day we learned of a hardware back door in key cards made by a Chinese company. The Committee is worried about bugs that might allow Chinese hackers to breach US infrastructure. US infrastructure being protected by TP-Link routers seems a stretch, but again, they make a valid point. They are also worried about TP-Link being forced to hand over data on US citizens to the Chinese state. Just recently CISA and assorted cybersecurity firms have noted that Chinese state-sponsored hackers are using botnets made of home routers to hide their operations against US and Western targets. They should write to Consumer Reports, The Wirecutter and every other outfit that reviews routers and tell them to stop recommending TP-Link routers. Better yet, they should go after ISPs for the miserable security in the routers they provide. Will anything come of this? Probably not.

The Cisco corporate personality

Cisco warns of critical RCE zero-days in end of life IP phones
by Bill Toulas of Bleeping Security   August 8, 2024
Yes, this article about IP telephones, but it is here because of the insight it offers into Cisco's corporate personality. Not good. Cisco has disclosed five flaws, three critical and two high-severity in their SPA 300 and SPA 500 telephones. The bugs allow a remote bad guy without any passwords to execute arbitrary commands on the devices with root privileges, just by sending a specially crafted HTTP request to the buggy phone. Each of the 5 bugs impact all software releases for the SPA 300 and SPA 500 IP phones regardless of their configuration. Also, each bug is a free agent, so that each one can be exploited individually, there is no need to chain them. The two high-severity flaws are caused by inadequate checks on HTTP packets. In other words, lazy programmers. Support ended for the SPA 300 phones in February 2022. Support for the SPA 500 phones ended in June 2020. But, it gets worse. Cisco is still covering the SPA 500 until May 31, 2025 for holders of service contracts or special warranty terms. Still, no bug fix for you. Bottom line: these phones need to thrown in the trash. And maybe don't replace them with another Cisco phone.
On another note, Cisco recently announced that they are laying off thousands of employees which make it likely that the security of their devices will not improve in the future.

JULY 2024

Linksys is sloppy with router passwords

These Linksys routers are likely transmitting cleartext passwords
by Daniel Sims of TechSpot   July 12, 2024
Linksys Velop Pro 6E and 7 mesh routers transmit critical information to outside servers in an insecure manner upon initial installation. Worse than this has been the total silence from Linksys on the issue. The 9 millionth example of why you should not buy a consumer router. Belgian consumer organization Testaankoop found that during initial setup, these routers transmit the SSID and password in cleartext to a server in the US. They also send user session access tokens and database identification tokens. The article suggests that owners of these routers should change their SSID and password without using the Linksys app. Quoting: "More concerning is that Linksys hasn't publicly acknowledged the issue. Testaankoop reported the vulnerability to the company in Belgium and the UK last November with no response. The firmware released after the initial discovery hadn't fixed the problem, and Linksys hasn't contacted Testaankoop since its latest report." Also typical of consumer routers is that the issue of other Linksys routers possibly doing the same thing never comes up. We see this over and over - one model gets tested, gets publicity, gets fixed and the other 99 similar models are ignored.

MAY 2024

Someone hates Windstream

Mystery malware destroys 600,000 routers from a single ISP during 72-hour span
by Dan Goodin of Ars Technica   May 30, 2024
Windstream is an ISP with about 1.6 million subscribers in 18 states. Someone does not like them. In October 2023, over 600,000 routers that Windstream provided to its customers were bricked (made into paperweights). More specifically, about 179,000 ActionTec T3200 routers and more than 480,000 Sagemcom routers were permanently rendered useless and had to be replaced. As for their part, Windstream has said nothing. When contact by Ars Technica, they declined to answer any questions. It is not known how the bad guys got into the routers, but it is likely they abused weak credentials or an administrative system of the ISP.
As stated elsewhere on this site, a router from your ISP is the worst option. This is just further proof.

Wi-Fi gives away your location

Why Your Wi-Fi Router Doubles as an Apple AirTag
by Brian Krebs of Krebs on Security   May 21, 2024
Interesting article about how both iOS and Android use nearby Wi-Fi networks to compute the location of the mobile device. Basically, Apple and Google know where ever router is located. Apple very recently introduced a fix. If the Wi-Fi network name ends with "_nomap" they will no longer report its location to Big Brother. Too little, too late. Krebs does not seem to know that Google has done this for years. This research brings to mind the claims of VPN providers to hide your location. These claims only apply to Ethernet connected devices.

Still another reason to avoid Cisco hardware

Counterfeit Cisco gear ended up in US military bases, used in combat operations
by Scharon Harding of Ars Technica   May 3, 2024
A bad guy has been selling fake Cisco hardware for many years. The interesting question for me, is how much of this is Cisco's fault. The bad guy lives in Florida and he has finally been sentenced to prison for his very long-lived scam operation. The scam imported the fake hardware from China and Hong Kong and used fake Cisco packaging, labels, and documents. The bad guy used at least 19 companies, multiple Amazon storefronts, multiple eBay storefronts and direct sales - known collectively as Pro Network Entities. Exactly what a Pro Network thingy is, I don't know. Not said by the DOJ, which touted the arrest and sentencing, was how the US Government purchased the fake hardware. Could they have been stupid enough to buy it off Amazon and eBay? Since the DOJ said nothing, the Department of Defense probably was that stupid. But another option was that the fake hardware was purchased through an authentic Cisco channel partner. How can that be? The article says that legit Cisco partners would often get their alloted stuff " outside of Cisco-authorized means because it was faster." So yes, Cisco is at fault too. You might think that Cisco would stop dealing with partners that purchased gray market stuff. But, no. Don't underestimate the rot at Cisco. A partner had to be caught doing this twice before they would get booted. Another bad look for Cisco is that the fake hardware had fake serial numbers. This should not have been allowed to happen. The fake serial numbers should have been detected. Cisco bears much of the fault.

APRIL 2024

Cisco is being hacked, yet again

ArcaneDoor Cyberspies Hacked Cisco Firewalls to Access Government Networks
by Andy Greenberg of Wired   April 24, 2024
Quoting: "Network security appliances like firewalls are meant to keep hackers out. Instead, digital intruders are increasingly targeting them as the weak link that lets them pillage the very systems those devices are meant to protect ... Cisco is now revealing that its firewalls served as beachheads for sophisticated hackers penetrating multiple government networks around the world." The buggy devices are Adaptive Security Appliances, which include a firewall, a VPN and other security(?) features. Cisco claims the bad guys are state sponsored. They exploited two new bugs (zero-day vulnerabilities in the lingo of the day). Really, you could not pay me to use any Cisco hardware.

TP-Link Routers being hacked

Multiple botnets exploiting one-year-old TP-Link flaw to hack routers
by By Bill Toulas of Bleeping Computer   April 17, 2024
At least six malware botnets are hunting for buggy TP-Link Archer AX21 (AX1800) routers. The bug that is being exploited was reported to TP-Link in January 2023 and fixed in March 2023. Yet, a year later, many of the vulnerable routers have not been updated. Clearly updating firmware on TP-Link routers is too hard for many people that own them. To me, THE BIG ISSUE HERE is not the AX1800 model but the 38 other routers that TP-Link sells. Are any of them also buggy? The article says nothing about this. TP-Link also says nothing about this. This is reason enough to avoid TP-Link devices.

MARCH 2024

Old Asus routers hacked

TheMoon malware infects 6,000 ASUS routers in 72 hours for proxy service
by Bill Toulas of Bleeping Computer   March 26, 2024
Quoting: "A new variant of TheMoon malware botnet has been spotted infecting thousands of outdated ... routers and IoT devices ... TheMoon is linked to the Faceless proxy service, which uses some of the infected devices as proxies to route traffic for cybercriminals who wish to anonymize their malicious activities ... Black Lotus Labs researchers ... have observed 6,000 ASUS routers being targeted in under 72 hours ... The researchers do not specify the exact method used to breach the ASUS routers, but given that the targeted device models are end-of-life, it is likely that the attackers leveraged known vulnerabilities in the firmware." We have seen this many times before, bad guys do bad things online, but make it appear as if their bad things came from your router.

FEBRUARY 2024

Quite a month for hacking routers

Hackers backed by Russia and China are infecting SOHO routers like yours, FBI warns
by Dan Goodin of Ars Technica   February 27, 2024
The article provides some context: "Nation-state-backed groups have used routers to obfuscate attacks since at least 2018, when researchers from Cisco’s Talos security group detected more than 500,000 SOHO routers that had also been compromised ... [to] install sophisticated malware Talos dubbed VPNFilter to carry out a range of activities. Hundreds of router models from nearly a dozen manufacturers were affected..." Russians have been using infected routers since at least 2022 to facilitate covert operations against governments, militaries, and organizations around the world, including in the Czech Republic, Italy, Lithuania, Jordan, Montenegro, Poland, Slovakia, Turkey, Ukraine, the United Arab Emirates, and the US. Besides government bodies, industries targeted include aerospace and defense, education, energy and utilities, hospitality, manufacturing, oil and gas, retail, technology, and transportation. Ubiquiti EdgeRouters make an ideal hideout for hackers. They are cheap and run Linux that can run hidden behind-the-scemes malware. Bad guys use hacked routers to do bad stuff because their activity seems to come from benign-appearing devices hosted by addresses with trustworthy reputations. Earlier this month, the FBI revealed that it had removed Russian malware from routers but they only temporarily blocked the Russians. The FBI did not patch any bugs in the routers or remove default passwords.

The Russians will try again to hack Ubiquiti Edge Routers

That home router botnet the Feds took down? Moscow's probably going to try again
by Simon Sharwood of The Register   February 28, 2024
The FBI issued a somewhat useless advisory on behalf of the US, Belgium, Brazil, France, Germany, Latvia, Lithuania, Norway, Poland, South Korea, and the UK. It was a warning that Russia may try again to hack Ubiquiti EdgeRouters and owners of these things better patch and re-configure. The cheapie boxes can not self update and they all ship with the same default password, which is disgraceful. A reader comment noted that when Ubiquiti did try to force people to invent their own passwords they made two mistakes in their implementation. Disgraceful again. All the advice from the FBI is for nerds and some of it is vague. Non techies should buy new routers. The original Ubiquiti router hacks were by Russia's GRU military intelligence unit. They build a 1,000-strong botnet and used it for power phishing, spying, credential harvesting, and data theft.

FBI boots Russian hackers out of Ubiquiti routers

Feds dismantle Russian GRU botnet built on 1,000-plus home, small biz routers
by Jessica Lyons of The Register   February 15, 2024
The US government today said it disrupted a botnet that Russia's GRU military intelligence unit used for phishing expeditions, spying, credential harvesting, and data theft against American and foreign governments and other strategic targets. The botnet was "well over a thousand" baby routers that had been infected with malware. The hacked routers were all from Ubiquiti running their Edge OS. Any child could have hacked these routers as they were using publicly known default passwords. Drunk driving. The Russians targeted US and foreign governments and military, security, and corporate organizations. The FBI removed the malware and modified the routers' firewall rules to block remote management of the routers.

JANUARY 2024

This was big

FBI disrupts Chinese botnet by wiping malware from infected routers
by Sergiu Gatlan of Bleeping Computer   January 31, 2024
This was covered everywhere. In brief:
--Chinese bad guys hack shitty home routers, typically those where the software is no longer updated. Newly found bugs in the abandoned router software makes these routers sitting ducks. They use these as the launching point for attacking critical US infrastructure. Since the attacks and/or scans seem to come from innocent locations, they don't raise as many red flags. The FBI was allowed to hack the hacked routers to remove the malware.
--What is not said is that US ISPs must be forced to provide security updates to any and all routers they provide to their customers. As things stand in the US, most ISPs are monopolies (in practice) so they can get away with providing the cheapest routers. In addition, private companies (Cisco, Netgear for example) must be forced to do something when they stop providing updates to their installed routers. And some minimum levels of security need to be enforced. But, due to the failed nature of the US Congress, no relevant law will ever happen, so the US will forever be vulnerable. That is the real news. One instance of malware on some routers is a grain of sand on the beach.
--Details about this grain: The FBI has disrupted the KV Botnet used by Chinese Volt Typhoon state hackers. Hacked routers included Netgear ProSAFE, Cisco RV320s, and DrayTek Vigor routers, as well as Axis IP cameras. The Chinese hacked roughly 30% of all Cisco RV320/325 devices in a month. The FBI director said the Chinese used the hacked routers to hit communications, energy, transport and water sectors. He also said that U.S. cyberdefense is badly outnumbered. Others reported this was part of a larger effort to compromise critical infrastructure, including naval ports, ISPs and utilities. In a useless statement, CISA and the FBI asked router vendors to please have their devices self-update and to only allow access to the web interface from the LAN by default. Oh, and make better software. Ha ha. Yes, they really said this. On a technical level, the FBI action was temporary, when the infected routers reboot, they will again be infected. No article discussed how a router owner can tell if their router is infected. And, not one of the articles listed below mentioned this website.

2023   top

OCTOBER 2023

If you don't patch your router firmware, bad guys are coming for you

IZ1H9 Campaign Enhances Its Arsenal with Scores of Exploits
by Cara Lin of Fortinet   October 9, 2023
Discovered by FortiGuard Labs, a Mirai variant they call IZ1H9, infects Linux-based networked devices turning them into remote-controlled bots for large-scale network attacks. Included in the targets of the malware are D-Link and Zyxel gear which remain vulnerable despite the availability of patches for the bugs being exploited. The malware has added new targets; Netis wireless routers, TP-Link Artcher, Totolink routers and others. The D-Link bugs being targeted for exploitation are CVE-2015-1187, CVE-2016-20017, CVE-2020-25506, and CVE-2021-45382. The TP-Link Archer AX21 bug being exploited is CVE-2023-1389. There is also a large range of related vulnerabilities that focus on TOTOLINK routers.

D-Link employee falls for scam

D-Link clears up 'exaggerations' around data breach
by Connor Jones of The Register   October 18, 2023
On October 1, a post on a hacking forum claimed to be selling 3 million lines of customer information. D-Link's public disclosure confirmed it became aware of the incident on October 2 and with the help of external investigators the company determined the actual number of stolen records to be around 700. D-Link says the data was not stolen from the cloud but instead originated from a test lab environment via a phishing attack on an employee. The stolen data was used for registration purposes. Assuming the best, assuming everything D-Link says is true, it still means that a D-Link employee fell for a scam. Makes me wonder about their employees competence.

SEPTEMBER 2023

Chinese hackers target Cisco

People's Republic of China-Linked Cyber Actors Hide in Router Firmware
by the CISA department of the US government   September 27, 2023
A hacking group that CISA calls BlackTech has been modifying router firmware without detection and then exploiting the domain-trust relationships in the victim router to pivot from international subsidiaries to the headquarters of companies in Japan and the U.S. Targeted organizations include government, industrial, technology, media, electronics, telecommunication, and defense. The article makes it sound like the hacking comes from the LAN side and on the Security Checklist page on this site are a number of ways to lock down access to the router from the LAN side. The bad guys know so much about Cisco routers that they can conceal configuration changes, hide commands, and disable logging while doing their dirty work.

JULY 2023

Zyxel devices are not being patched, so they are being hacked left and right

Zyxel users still getting hacked by DDoS botnet emerge as public nuisance No. 1
by Dan Gooding of Ars Technica   July 21, 2023
Zyxel patched a bug on April 25th. But ... devices are still being hacked because network nerds are not installing the patch. The bug was rated 9.8 which translates to really bad. So many Zyxel devices are being hacked and used by bad guys that this bug is now considered public nuisance No. 1.

Botnet discovered consisting of thousands of infected routers

Routers from the Underground: Exposing AVrecon
by Danny Adamitis and Steve Rudd of Black Lotus Labs   July 12, 2023
Black Lotus Labs (a division of Lumen) discovered a large botnet targeting small-office/home-office routers. Which routers are being infected? They do not say. They claim this is a multi-year campaign involving compromised routers across the globe. The botnet deploys a Linux-based Remote Access Trojan (RAT) they call "AVrecon." The malware has been operating undetected for more than two years in part because owners of infected devices are not likely to notice a service disruption or a loss of bandwidth. They suspect that the botnet network exists to enable a range of criminal activities from password spraying to digital advertising fraud. By one measure, there are 70,000 infected machines. Looking at persistent infections, they found the malware at more than 40,000 IP addresses in more than 20 countries. While they don't say anything about which routers are infected, they have taken network level defenses: null-routing the command and control nodes and impeding traffic through the proxy servers. This renders the botnet inert across the Lumen backbone. What it does for the rest of the world, they do not say. They say the malware uses port 48102, but they not say if its TCP or UDP. And, they do not say if finding the port open is a reliable way to detect an infected device. So, this blog is perhaps more press release than useful information.

JUNE 2023

Now everyone sees the need for better router security

CISA Order Highlights Persistent Risk at Network Edge
by Brian Krebs of Krebs on Security   June 15, 2023
Quoting: "The U.S. government agency in charge of improving the nation’s cybersecurity posture is ordering all federal agencies to take new measures to restrict access to Internet-exposed networking equipment ... The order requires federal departments to limit access so that only authorized users on an agency's local or internal network can reach the management interfaces of these devices." Translation: better router security. This mandate follows a slew of high profile security bugs from Barracuda Networks, Fortinet (which makes Fortiguard products) and file transfer appliances from Forta (GoAnywhere) and Progress Software (MOVEit Transfer).

A black eye for Barracuda

CVE-2023-2868: Total Compromise of Physical Barracuda ESG Appliances
by Caitlin Condon of Rapid7   June 8, 2023
This is stunning. Background: The Email Security Gateway (ESG) from Barracuda Networks is software for filtering inbound and outbound email and (hopefully) protecting customer data. The Email Security Gateway can exist as a physical or virtual appliance, or in a public cloud on AWS or Azure. The hack described below (May 2023) turns out to be hard or impossible to mitigate with a patch. Thus, Barracuda is urging their ESG customers to immediately decommission and replace all ESG physical appliances irrespective of their patch level. Shocking. Quoting: "The pivot from patch to total replacement of affected devices is fairly stunning and implies the malware the threat actors deployed somehow achieves persistence at a low enough level that even wiping the device wouldn’t eradicate attacker access." As bad as this looks, Barracuda handled it better than HP handled the printers they broke with a firmware update. HP just put its head in the sand. Barracuda did not. Still, customers paid for security with ESG and got hacked instead.

MAY 2023

What does 'security' really mean?

Critical Barracuda 0-day was used to backdoor networks for 8 months
by Dan Goodin of Ars Technica   May 30, 2023
This story does not involve a router, but it did let bad guys steal data via the network. Barracuda Networks is an IT security company. The bug was in their Barracuda Email Security Gateway and was due to incomplete input validation of user-supplied .tar files. In other words, lazy programming. The bug let bad guys install multiple pieces of malware for stealing sensitive data. A patch has been issued. In this case, having the Email Security Gateway installed, made you less secure.
Note: See above for an update on this.

Hack the routers, Hack the world

Chinese hackers breach US critical infrastructure in stealthy attacks
by Sergiu Gatlan of Bleeping Computer   May 24, 2023
Lots of router hacks in this story. Quoting: "Microsoft says a Chinese cyberespionage group it tracks as Volt Typhoon has been targeting critical infrastructure organizations across the United States ... since at least mid-2021. Their targets and breached entities span a wide range of critical sectors, including government, maritime, communications, manufacturing, information technology, utilities, transportation, construction, and education." The attacks start by hacking Fortinet FortiGuard devices, exploiting an unknown zero-day vulnerability. The hacked Fortinet devices give the bad guys Windows credentials through LSASS. This, in turn, lets the bad guys deploy web shells for stealing data and keeping a persistent presence on the hacked systems. And then, "To ensure that their malicious activity blends with legitimate network traffic to evade detection, Volt Typhoon employs compromised small office and home office (SOHO) network equipment from ASUS, Cisco, D-Link, Netgear, FatPipe, and Zyxel, such as routers, firewalls, and VPN appliances." So, there we have it. Shitty consumer routers are helping the Chinese hack critical US infrastructure. Ouch.

F--k Asus

Asus router outage is solved
by Dan Goodin of Ars Technica   May 19, 2023
Quoting: "Asus router users around the world took to the Internet to report that their devices suddenly froze up for no apparent reason and then, upon rebooting repeatedly, stopped working every few minutes as device memory became exhausted. Two days later, the Taiwan-based hardware maker has finally answered the calls for help. The mass outage, the company said, was the result of 'an error in the configuration of our server settings file.'" Let me translate: Exactly how they screwed up is none of your business. Quoting again: "After fixing the glitch, most users needed to only reboot their devices. In the event that didn't fix the problem, the company’s support team advised users to save their current configuration settings and perform a factory reset ... Asus still hasn’t provided details about the configuration error." So much went wrong here. (1) Why are Asus routers dependent on the configuration of an Asus server? (2) How did the problem happen? (3) Why did they not find the problem sooner? (4) What will they do so this does not happen again? (5) What exactly is the problem? (6) Which models are affected? Which feature(s) are causing the problems? Which firmware versions are susceptible to the bug? etc. etc. (7) the two day delay in saying anything and the corporate double-speak is insulting.
On the upside, anyone shopping for a router in the future now has a good feeling for just who and what Asus is, as a company.

More hacked routers

Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group
by Check Point Research   May 16, 2023
Check Point Research found a malicious firmware implant in TP-Link routers which allowed the bad guys to get full control of infected devices and access compromised networks while evading detection. They attribute the hack to a Chinese state-sponsored APT group. How the routers got hacked is uncertain. They say it is likely that the bad guys either scanned looking for known vulnerabilities or targeted devices that used default or weak or easily guessable passwords. The malware is not specific to TP-Link routers, so that a wide range of devices and vendors may be at risk. As to the issue of why, they say: "Learning from history, router implants are often installed on arbitrary devices with no particular interest, with the aim to create a chain of nodes between the main infections and real command and control. In other words, infecting a home router does not mean that the homeowner was specifically targeted, but rather that they are only a means to a goal."

Yet again, a high end router (Fortinet) is vulnerable to attack

New Cactus ransomware encrypts itself to evade antivirus
by Ionut Ilascu of Bleeping Computer   May 7, 2023
Most of the article is focused on the Windows-based malware. But, it does include this: A new ransomware operation called Cactus has been exploiting vulnerabilities in VPN appliances for initial access to networks of 'large commercial entities.' Kroll believes that Cactus obtains initial access into the victim network by exploiting known vulnerabilities in Fortinet VPN appliances. It is not known which Fortinet bug the bad guys are exploiting. Perhaps new, perhaps old.

APRIL 2023

Yet another LAN-only protocol being abused on the Internet

SLP: a new DDoS amplification vector in the wild
by Alex Forster and Omer Yoachimik of Cloudflare   April 25, 2023
Quoting: "Service Location Protocol (SLP) is a "service discovery" protocol invented by Sun Microsystems in 1997. Like other service discovery protocols, it was designed to allow devices in a local area network to interact without prior knowledge of each other. SLP is a relatively obsolete protocol and has mostly been supplanted by more modern alternatives like UPnP, mDNS/Zeroconf, and WS-Discovery. Nevertheless, many commercial products still offer support for SLP." Just-published research by Pedro Umbelino at Bitsight and Marco Lux at Curesec documents a new DDoS reflection/amplification attack vector leveraging SLP. The bug is tracked as CVE-2023-29552. Since SLP has no method for authentication, it should never be exposed on the Internet. However, they discovered that upwards of 35,000 on-line devices have their SLP service exposed and accessible to anyone. Devices that speak SLP have two open ports: UPD port 427 and TCP port 427.

Cisco routers are being hacked by Russians abusing a bug fixed in 2017

US, UK warn of govt hackers using custom malware on Cisco routers
by Lawrence Abrams of Bleeping Computer   April 18, 2023
Russian hackers are targeting malware against Cisco IOS routers that are still being used despite their owner having walked away from them. The Russians are exploiting an SNMP flaw (CVE-2017-6742) that was patched in June 2017. This from a joint report from the UK National Cyber Security Centre (NCSC), US Cybersecurity and Infrastructure Security Agency (CISA), the NSA, and the FBI. SNMP is a protocol that lets network administrators monitor and configure network devices remotely. Not only are the hacked routers not being patched, but the flaw also requires poor configuration of SNMP itself. Makes me ashamed to be a computer nerd.

Used Enterprise Routers give away the keys to the Kingdom

Used Routers Often Come Loaded With Corporate Secrets
by Lily Hay Newman for Wired   April 18, 2023
Researchers from the security firm ESET bought 18 used routers made by Cisco, Fortinet, and Juniper Networks. They found nine were just as their previous owners had left them and fully accessible. Only five had been properly wiped. All nine of the unprotected routers contained credentials for the organization's VPN, credentials for another secure network communication service, or hashed root administrator passwords. All nine included enough identifying data to determine the previous owner. Eight of the nine included router-to-router authentication keys and information about how the router connected to specific applications used by the previous owner. Four devices exposed credentials for connecting to the networks of other organizations. Other security companies have repeatedly seen the same thing. Red Balloon Security was specifically mentioned in the article. A shit show. ESET tried to contact all the vulnerable organizations and some would not give them the time of day. There is said to be a resale market with millions of enterprise level networking devices. ESET will present a report on this at the RSA security conference in San Francisco next week.

How does this happen? Do networking techies not know how to reset the devices and they can't be bothered to look it up? Are they over-worked and too busy to spend the time resetting devices? Are they angry at their bosses and this is retribution? Or, has the job been farmed out to a third party that is supposed to reset the routers?

Wi-Fi Design Flaw

Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues
by Domien Schepers, Aanjhan Ranganathan and Mathy Vanhoef from assorted universities   April 2023
The link is to PDF of a research report. The flaws described here are not in any one router or firmware, rather they are the result of omissions from the design specs for Wi-Fi itself. How serious this is is beyond my ability to judge. Quoting: "Wi-Fi devices routinely queue frames at various layers of the network stack before transmitting, for instance, when the receiver is in sleep mode. In this work, we investigate how Wi-Fi access points manage the security context of queued frames. By exploiting power-save features, we show how to trick access points into leaking frames in plaintext, or encrypted using the group or an all-zero key. We demonstrate resulting attacks against several open-source network stacks. We attribute our findings to the lack of explicit guidance in managing security contexts of buffered frames in the 802.11 standards." Traffic that is not encrypted is most at risk, that would be HTTP and old DNS. This offers a great chance to judge the company that made your router. The problems have to be fixed on their end. Do they say anything? Do they offer any suggested work-around? Will they update their firmware?

New Router Checklist

13 Things You Should Do After Plugging In Your New Router
by Jason Fitzpatrick of How To Geek   April 11, 2023
On the whole not a bad article. But I disagree with a couple points targeted at people who have a combination modem/router from their ISP. It says "...you need to put your ISP’s combo unit into bridge mode." This is not true. Then it says "...you need to turn off the Wi-Fi radio in the ISP’s Wi-Fi router combo unit." Also not true. I would do neither of these things, at first. For one reason, they are not technically required. For another thing, it is best to live with the new router for a while before changing anything in the combination box.

MARCH 2023

Sonicwall devices infected with malware

Suspected Chinese cyber spies target unpatched SonicWall devices
by Jessica Lyons Hardcastle of The Register   March 9, 2023
"Suspected Chinese cyber criminals have zeroed in on unpatched SonicWall gateways and are infecting the devices with credential-stealing malware that persists through firmware upgrades, according to Mandiant ... It's unclear whether this malware campaign is related to earlier ransomware infections, which targeted some of these same devices in 2021." The vulnerable devices are the SonicWall Secure Mobile Access (SMA) 100 Series. So, not so secure after all. It is not known how the gateways (aka routers) were infected. A recent firmware release added more defensive features, stuff a "secure" device should have already had.

Old DrayTek routers infected, but how?

DrayTek VPN routers hacked with new malware to steal data, evade detection
by Bill Toulas of Bleeping Computer   March 6, 2023
An ongoing hacking campaign called 'Hiatus' targets old DrayTek Vigor routers (models 2960 and 3900) that are end-of-life. The malware steals data from infected rotuers and builds a covert proxy network. This was discovered by Lumen's Black Lotus Labs and they are unable to determine how the DrayTek routers were initially compromised. Ugh. Black Lotus says that as of mid-February 2023, there were about 4,100 models 2960 and 3900 exposed on the internet. Of these, Hiatus had compromised approximately 100.

2022   top

DECEMBER 2022

Many routers hacked at the PWN2OWN contest

Multiple consumer routers were hacked by many different groups. One highlight is that Synology seems to have gotten the worst of it, the RT6600ax was hacked by many different groups. The contest involved hacking multiple types of devices, only the router exploits are shown below. All the routers were running the latest firmware. To me, the take-away from this is to avoid consumer routers.

OCTOBER 2022

TP-Link does it wrong

TP-Link network equipment hijacks some DNS requests
by Daniel Aleksandersen   October 15, 2022
Non techies trying to get at the web interface of a router often have to address the router by its IP address, which can be too difficult for them. As a result, many hardware vendors offer names for their LAN-resident routers. For example, Asus uses router.asus.net and Netgear uses www.routerlogin.com. Everyone but TP-Link offers this feature using DNS which is fine. TP-Link implemented this feature using deep packet inspection. They intercept everything on UDP port 53 in a kernel module, which is asking for trouble. When they find one of their easy-to-use names, such as tplinkwifi.net, they return the LAN side IP address of their router or Access Point. But, the kernel module is configurable so a bad guy can permanently use it for domain hijacking. And, this is just wrong.

AUGUST 2022

Eero is such a privacy invasion that expert does not want to even review it

Your Router and Online Privacy Risks: Be Aware of that Hidden Potential Danger
by Dong Ngo of Dong Knows Tech   August 9, 2022
Mr. Ngo regularly reviews routers. Quotes from the article: "... I tend to mention the "online privacy risks" in increasing instances in the past couple of years. And the case of the eero Pro 6E must have been the crescendo on this front ... I was so concerned about the privacy risks that, for the first time, I didn't even want to test it. ... Your Wi-Fi router ... can keep tabs on everything you do online, all the websites you’ve visited, and your other activities, such as shopping, streaming, chatting, texting, and so on. If you use a router that doesn’t allow direct access to how it works or limited access, you don’t know what it really does with your information. And if you use a router made by a company that forces you to log in via an account before you can manage your network, your privacy is generally at the mercy of that company. In this case, it’s like you actively report your every move to a third party. And this is the scariest part: That happens completely without your direct knowledge. There’s no visual, warning, or ID checking, not a fist bump or a wink. It’s total unawareness. ... popular networking vendors like Asus, Netgear, TP-Link, Ubiquiti, etc., are independent and relatively small companies. Consequently, their data collection and the collected data are somewhat limited in scope and pervasiveness. ... On the other hand, eero is owned by Amazon, which already has lots of data on its users ... So if you’re an Amazon prime user and use an eero router, your exposure (to Amazon) is much higher than if you have a router from another networking vendor. Come to think about it, the only reason Amazon bought eero in early 2019 might have been because it wanted the user data the then-boutique networking company had designed its routers to collect. It wanted to hook deeper into the home, so to speak."
Not mentioned in this article, Mr. Ngo has also suggested avoiding Google routers for the same privacy reasons.

JULY 2022

DD-WRT and Asus can not be bothered fixing bugs

Vulnerability Spotlight: How a code re-use issue led to vulnerabilities across multiple products
by Francesco Benvenuto of Cisco Talos   July 27, 2022
Talos found three vulnerabilities in open-source router firmware packages. The root cause in each case was a piece of code that had been taken from an open-source library owned by Broadcom. In each case, a specially crafted HTTP request can lead to memory corruption. All three router firmware vendors were contacted on April 11, 2022. FreshTomato issued a patch on May 6th. DD-WRT has not yet issued a patch. The bug also exists in Asus routers, both those running ASUSWRT (factory installed firmware) and the open-source firmware alternative known as Asuswrt-Merlin.

JUNE 2022

New malware targeting routers

ZuoRAT Hijacks SOHO Routers To Silently Stalk Networks
by Black Lotus Labs   June 28, 2022
The malware seems to be using existing, known bugs to infect the routers. The routers are being hacked from the LAN side by malware running on Windows PCs. Some routers can limit the LAN side devices that are allowed to communicate with the web interface. If yours can, its worth looking into. They found infections in these routers: Cisco RV 320, 325 and 420, Asus RT-AC68U, RT-AC530, RT-AC68P and RT-AC1900U, DrayTek Vigor 3900 and some unspecified NETGEAR devices. The malware does not survive a re-boot of the router, so just as the home page of this site has suggested for a long time, periodic reboots are a good idea. The malware does lots of bad stuff. Black Lotus Labs is the threat intelligence division of Lumen Technologies. They "have a narrow view" of the full extent of what the malware can do. That said, they are sure that it does DNS and HTTPS hijacking. Only routers with a MIPS processor are vulnerable. One defense: The malware tries to learn the public IP address of an infected router by calling out to whatsismyip.akamai.com, ident.me, myipdnsomatic.com and ipecho.net. If these calls fail, the malware deletes itself under the assumption that it is being run in an isolated sandbox. If you can, block these websites in your router.

More Kaspersky on router security

The hidden threats of router malware
by Leonid Grustniy of Kaspersky   June 8, 2022
Discusses some things that bad guys do with an infected router, such as: joining it to a botnet for DDoS attacks, steal your data and redirect you to pages with ads or malicious sites instead of the ones you want to visit.

Kaspersky on router security

Router security in 2021
by Maria Namestnikova of SecureList   June 8, 2022
Quoting: "According to cve.mitre.org, the number of vulnerabilities discovered in various routers, from mobile to industrial, has grown over the past decade. However, with the mass shift to remote working, it went off the scale. During 2020 and 2021, more than 500 router vulnerabilities were found. The nvd.nist.gov website presents different figures, but they too show a significant increase in the number of router vulnerabilities found in 2020 and 2021 ... Unfortunately, not all vendors are rushing to fix even critical vulnerabilities. At the time of writing, of the 87 critical vulnerabilities published in 2021, more than a quarter remain unpatched and unreported by the vendor...

APRIL 2022

WatchGuard can not be trusted to do the right thing

WatchGuard waited 11 months to explicitly disclose critical flaw exploited by Sandworm
by Dan Goodin of Ars Technica   April 6, 2022
You buy the hardware for increased security, and it ends up lowering your security. A critical bug in WatchGuard firmware was fixed in May 2021 without a warning to customers of just how important it was. Quoting: "...the company made only the most oblique of references to the vulnerability". Months after the fix was released, the FBI told WatchGuard that their devices were being hacked. Still, no critical notice went out to WatchGuard customers. The company did not disclose the flaw until it became known that Russian hackers exploited it en masse to assemble a massive botnet.

FBI fights back against Russian bad guys

Companies were slow to remove Russian spies' malware, so FBI did it for them
by Dan Goodin of Ars Technica   April 6, 2022
There is a story below (March 2022) about Russian malware called Cyclops Blink infecting Asus routers. It also infected WatchGuard network firewalls, months before the Russians started hacking Asus routers. In February 2022 this became public, but not many WatchGuard devices were cleaned up or updated with new firmware. So, to disrupt the botnet the FBI killed the Command and Control servers. This article makes it sound like the FBI cleaned up infected WatchGuard devices. They did not.

New bugs in TOTOLINK routers exploited immediately

Beastmode botnet boosts DDoS power with new router exploits
by Bill Toulas of Bleeping Computer   April 1, 2022
Botnet operators make money both by selling DDoS services and by launching attacks against firms and asking for a ransom to stop. The Beastmode botnet added five new exploits within a month, three of them targeting various TOTOLINK routers. TOTOLINK has released updated firmware for the buggy routers. Good thing too as the bugs are rated critical (CVSS v3 score of 9.8), enabling bad guys to take full control of vulnerable devices which are the A800R, A810R, A830R, A860R, A950RG, A3000RU, A3100R, A3600R, A7100RU N600R, T6, and T10. The botnet also takes candy from a baby - targeting EoL D-Link products (DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L and DIR-836L) that are vulnerable and will never be updated. It also tries to abuse the Huawei HG532 router using a bug from 2017. The botnet also picks on TP-Link Tapo C200 IP camera and the Netgear ReadyNAS line.

MARCH 2022

Critical bug in Sophos Firewall

Resolved RCE in Sophos Firewall (CVE-2022-1040)
by Sophos   Last Updated April 5, 2022
The Sophos Firewall is for the big boys, as such I have never even seen one. But, it has had its share of security flaws and this one was a doozy. An authentication bypass flaw allows bad guys to get remote code execution. It has been fixed. Interestingly, the firmware has an "Allow automatic installation of hotfixes" feature that is enabled by default. It causes the firewall to check for critical bug fixes every 30 minutes. Cool. To their credit, Sophos updated some firmware that was End of Life. They also informed some of their customers that they had been hacked.

This is why VLANs matter

Wyze patches serious flaws on its security cameras, but not its oldest one - what you need to know
by Paul Wagenseil of Toms Guide   March 29, 2022
Wyze cameras are buggy and the company took a very long time to issue fixes. Heck, for months Wyze would not even communicate with BitDefender, which reported the problems. The oldest version of the camera (version 1) was released in 2017 and will not be fixed (EoL). Details aside, this is exactly why VLANs are so important. It is probably best to keep any camera in its own VLAN, isolated from everything else in your home/office. Also, a router with outbound firewall rules can block the camera from phoning home, keeping the video in your home/office. Or, maybe, restrict where the camera is allowed to communicate on the Internet. As for details, BitDefender found three bugs: an Authentication bypass, a Remote control execution flaw and Unauthenticated access to contents of the SD card. If you have a Wyze Cam check the bottom of the camera. Version 2 units say "v2" while the EoL version 1 says nothing.

Russian bad guys targeting Asus routers

ASUS warns of Cyclops Blink malware attacks targeting routers
by Bill Toulas of Bleeping Computer   March 17, 2022
Russia has plenty of bad guys. Even with many of them killing Ukrainians, they still have enough left over to hack Asus routers. 18 different ASUS models are vulnerable to hacking by the Cyclops Blink malware which comes from a well known group of Russian bad guys known as Sandworm. If Cyclops Blink installs itself, it will persist as it gets written into flash memory. Factory reset does nothing. The malware was discovered infecting Asus routers by Trend Micro which warned: "If it is suspected that an organization’s devices have been infected with Cyclops Blink, it is best to get a new router." Asus has not issued bug fixes. Three buggy Asus routers will not get fixes because they are too old (EoL) to bother with: RT-AC87U, RT-AC66U and RT-AC56U. As is often the case, one defense is to disable remote administration. Trend Micro said "...the spread of Cyclops Blink appears indiscriminate and widespread". Just like Russian bombing in Ukraine. They also warn that the bad guys can adapt their malware for other routers. One defense not suggested is to block the Google DNS server at 8.8.8.8 because the malware uses it.

A great reason to avoid TP-Link routers

Newer TP-Link Routers send ALL your web traffic to 3rd party servers
by Reddit user ArmoredCavalry   March 11, 2022
The Wire Cutter loves TP-Link routers. They are children playing a game meant for adults. This is a great reason to avoid TP-Link routers. Not only the initial find, but also the delay in dealing with the issue and the responses from the company which deal with a third of the issue. TP-Link embeds security software from Avira in some (many?) of their routers. The system is, ironically, called Safe Things and Home Shield. It was discovered that a TP-Link router sent 80,000 DNS requests in 24 hours to Avira Safe Things subdomains. The router was not configured to use the Avira software. Yet.... TP-Link has known about the bug since at least May 2021 but no fix had been issued. Then, this got some traction on Reddit and now TP-Link has beta software. The new software has not been verified to fix any of the three real issues (why call Avira at all, why call Avira so many times, what privacy issues are there with letting Avira spy on router activity). Asus includes security software from Trend Micro and they too had privacy issues.

MikroTik problems linger

Microsoft creates tool to scan MikroTik routers for TrickBot infections
by Bill Toulas of Bleeping Computer   March 17, 2022
Microsoft released a forensics tool named 'routeros-scanner' that network administrators can use to scan MikroTik devices for signs that it was compromised by TrickBot malware. It has been several years since MikroTik warned about the existence of critical flaws, yet hundreds of thousands of MikroTik routers are still vulnerable to malware botnets. One thing to look for is open ports 449 and 8291.

The Dutch do Router Security Right

Russian state hackers target Dutch routers: Volkskrant
by DutchNews.nl   March 3, 2022
The two most interesting aspects of this story to me: (1) The Dutch told victims about their routers having been hacked and (2) they advised that the hacked routers should be thrown away. Well done. A Russian hacking group known as 74455, Sandworm and BlackEnergy, has been targeting Dutch routers belonging to private individuals and small and medium sized businesses. The bad guys are part of the Russian intelligence service. It is not clear if the hacking is linked to the war in Ukraine. The number of hacked routers is not known. All this came to light due to an investigation by the Dutch military intelligence agency MIVD. The malware on the routers communicates with other Russian controlled computers in a network which is used for sabotage, spying and the spread of fake news. And, of course, routers that allow outside access are particularly vulnerable.

FEBRUARY 2022

Wuddya Know? Routers spy on you

Your Router Is Collecting Your Data. Here's What to Know, and What You Can Do About It
by Ry Crist of CNET   February 25, 2022
First of all, my router is not collecting any data about me. CNET lives in the fishbowl of consumer routers. There is a bigger world. Crist reviewed the privacy policies for D-Link, Netgear, Asus, TP-Link, Eero, Google Nest and Arris (really CommScope). Every one confirmed that the company in question collected personal data for the purpose of marketing. All the companies also acknowledged that they share user data with third parties for marketing purposes. Such are consumer routers, one reason to look into secure routers. Crist wasted much of the article looking into whether a router tracks web activity. There is no one answer to that question as parental controls and assorted security features require the inspection of web traffic. Points of note:
 --Asus and Google Nest were the only companies that let you opt out of data collection
 --D-Link refused to answer questions about privacy
 --best for opting out of data collection: The Motosync app for Motorola routers (run by Minim) has a very clear option
 --worse: D-Link and TP-Link, which do not offer any direct means of opting out
 --worst: Eero. The only way to stop Eero devices from gathering data is to not use them.
The Asus instructions for opting out in the article are wrong. The correct path to the option is Advanced Settings -> Administration -> Privacy tab. This is what it looks like. The defensive steps in the article are incomplete. The most obvious omission is to use a VPN or Tor. Both hide activity from the router, just as they do from the ISP. Another option is to use a router with a web interface rather than a mobile app.

Watch out for WatchGuard routers

New Sandworm malware Cyclops Blink replaces VPNFilter
by UK National Cyber Security Centre   February 23, 2022
Once upon a time there was a bug in WatchGuard routers. The company fixed it in May 2021. Still un-patched routers are being infected by bad guys in Russia, specifically part of Russia's GRU military intelligence agency. Not only have the nerds in charge of administering the boxes not installed bug fixes, they also left the buggy routers open to unrestricted remote administration without any of the available security options that WatchGuard provides for restricting remote access to the boxes. You could make a case that the techies doing defense are just as much, if not more, at fault that the Sandworm malware authors. The malware was first seen about three years ago and has been dubbed Cyclops Blink. It abuses the firmware update mechanism to allow it to remain running even if the box is re-booted. Currently only WatchGuard devices have been infected, but the NCSC warns that it could be adapted to other platforms.

JANUARY 2022

UPnProxy Follow-Up - still bad

UPnProxy: Eternal Silence
by Chad Seaman of Akamai   January 27, 2022
Discovered by Akamai, a bug called UPnProxy is still alive and well, six months after they first publicized it. When abused, it attempts to expose TCP ports 139 and 445 on devices connected to the targeted router. Out of 3,500,000 UPnP routers found online, 277,000 are vulnerable to UPnProxy, and 45,113 of them have already been infected by hackers. This is yet another reminder that consumer routers ship with UPnP enabled by default to cut down on tech support requests. Peplink and pcWRT routers ship with UPnP disabled. Many devices were found vulnerable, including some from Asus, D-Link, Belkin, DrayTek, Edimax, HP, Monoprice, Netis, Netgear, Ubiquiti, SMC, ZyXel, ZTE. Also versions of OpenWRT are vulnerable.

Hacking an Optilink fiber router

The Story of How I Hacked my ISP’s Cheapo Standard Issue Router
by secnigma   January 2, 2022
Hacking an Optilink 91001w ONU (Optical Network Unit) in India. Optilink is a rebrand of C-DATA which proved helpful. The webserver running in the router was Boa which was mainly used in embedded devices back in the 2000’s. Development stopped on the software back in 2005. You can't make this stuff up. He found a command injection flaw using the back tick character to execute Linux system commands. The vendor does not share the firmware to the public. To upgrade, the customer has to contact the vendor directly, and they arrange a remote session to upgrade the router. Wow. He eventually found a password file and cracked the hash to reveal two hardcoded backdoor credentials.

2021   top

DECEMBER 2021

Support for Google OnHub routers being discontinued

Google is killing off its OnHub routers, easing the pain with Nest Wifi discounts
by Taylor Kerns of Android Police December 20, 2021
On December 19, 2022 support for Google OnHub routers is ending. The routers will still function, but owners will not be able to make any configuration changes, such as changing the Wi-Fi password. Google is offering owners of an OnHub router a 40 percent discount on their latest routers. The good news is that Google is being up-front and honest about this which is probably better than most consumer routers. And, roughly 7 years of bug fixes is not bad, as routers go. To me, the important issue is that it shows how important it is to be able to configure a router locally without depending on a cloud service. Fewer and fewer routers offer a full LAN side web interface. Mobile apps are the fashion. Another issue some cloud dependent routers have is that they kill LAN side communication when they are off-line.

Netgear is removing the remote administration feature

Quietly, Netgear Kills Web-based Remote Management, Pushing Mobile Apps
by Dong Ngo in his own blog   Dec 21, 2021
I once returned a Netgear router because it only supported HTTP (and not HTTPS) for remote administration. So, clearly, they never cared much about it. Judging by the screen shot in this article, it seems this is still the case, although they do let you change the port and limit the source IP address. If remote administration (Netgear calls it remote management) is disabled, then a firmware update may remove the feature altogether. And, the latest routers don't have remote administration at all. Quoting: "The company didn’t make any announcements or provide any guidelines. Instead, it simply excludes the feature from its new routers starting this year". This is not what you want from your router company. Without the feature, Netgear customers have to use a Netgear mobile app which requires a Netgear account. Ngo writes: "... Netgear is the only one who stands to benefit from this development. The more users who use the apps, the more ... valuable data it can collect from its users ..." Perhaps this is the real motivation.

Vulnerable un-patched MikroTik routers

300,000 MikroTik routers are ticking security time bombs, researchers say
by Dan Goodin of Ars Technica   December 9, 2021
Security firm Eclypsium has found roughly 300,000 on-line un-patched and vulnerable routers made by Latvia-based MikroTik. The three missing patches were discovered and fixed in the past three years. It is as if these routers were abandoned. Needless to say, MikroTik routers do not auto-update. See also a September 2021 item below.

OCTOBER 2021

Hacked routers used by Russians to attack US Government

Russian Hackers Used Home Networks to Evade Detection
by William Turton of Bloomberg   October 26, 2021
The term "Home Networks" in the title of the article refers to hacked routers. So A "residential IP proxy" is a hacked router. Bad guys hack routers and then sell access to the routers. The victimized routers are modified in a way that they forward data packets. Thus, a hacking attempt by the Russian Foreign Intelligence Service, that starts in Russian, appears to come from 123 Main Street in Denver, Colorado. This simple concept is hidden behind the terminology used in the article.When it comes to guessing passwords, access to hacked routers is doubly important. Rather than make many guesses from the same public IP address, bad guys can scatter their guesses across a range of locations. To be a broken record, I recommend avoiding any router from an ISP and also avoiding consumer routers.

Proof that Wi-Fi passwords need to be long

70% of Wi-Fi networks are easy to hack - how to protect yourself
by Paul Wagenseil of Toms Guide   October 28, 2021
Ido Hoorvitch1 of CyberArk walked around his neighborhood and sniffed information from 5,000 thousand Wi-Fi networks. He took this data back to his office and, using hashcat, was able to calculate the password for 70 percent of the Wi-Fi networks. He used a relatively new Wi-Fi attack on WPA2 Personal. He did not say if it the attack will work on WPA2 Enterprise or WPA3. The attack is based on recording the SSID, the hash of the PMKID, the MAC address of the router and the MAC address of a router client. A PMKID is used for roaming between Access Points. If you have a single router, there is no need for a PMKID, yet it was often present. He offered no advice on determining if your router is broadcasting a PMKID. The cracked passwords were often just numbers or just lower case letters. The lesson to be learned is that longer passwords and varied (not random) password are more resistant to this type of brute force attack.

Asus AX56U router hacked twice

Windows 10, iOS 15, Ubuntu, Chrome fall at China's Tianfu hacking contest
by Catalin Cimpanu of The Record   October 17, 2021
The Tianfu Cup is the largest and most prestigious hacking competition in China. At the event, the ASUS AX56U router was hacked by two different teams. I could not find anything on what the bug was and whether Asus will ever fix it or not.

A TP-Link router was hacked for years

Botnet abuses TP-Link routers for years in SMS messaging-as-a-service scheme
by Catalin Cimpanu of The Record   October 7, 2021
Since at least 2016, bad guys have hijacked the 4G-capable TP-Link MR6400 router. The problem came to light when a large number of outgoing SMS messages sent from the SIM card in the router caused high phone charges. The theory is that the bad guys organized the hacked routers into a botnet, and made a business of sending cheap SMS messages. It is thought that the routers were compromised using a vulnerability disclosed in 2015 that provided access to the files on the router. The bug was fixed but many of the routers remain unpatched, even to this day. This research was done by Robert Neumann of Acronis and Gergely Eberhard of Search-Lab. Abuse of the botnet peaked in 2018 and is still ongoing but at a reduced level.

SEPTEMBER 2021

Hacked MikroTik routers used in HUGE botnet

Meet Meris, the new 250,000-strong DDoS botnet terrorizing the internet
by Catalin Cimpanu of The Record   September 10, 2021
The Meris botnet broke the record for the largest volumetric DDoS attack twice this summer. It is estimated that the botnet consists of around 250,000 infected devices, most from MikroTik. MikroTik is a small Latvian company that sells routers, IoT gateways, WiFi access points, switches and the like. It seems like the bug being abused is old. The company said: "As far as we have seen, these attacks use the same routers that were compromised in 2018, when MikroTik RouterOS had a vulnerability, that was quickly patched. Unfortunately, closing the vulnerability does not immediately protect these routers. If somebody got your password in 2018, just an upgrade will not help. You must also change password ... We have tried to reach all users of RouterOS about this, but many of them have never been in contact with MikroTik and are not actively monitoring their devices ...There are no new vulnerabilities in these devices."

JULY 2021

Hacked routers used to attack French organizations

Home and office routers come under attack by China state hackers, France warns
by Dan Goodin of Ars Technica   July 21, 2021
The French National Agency for Information Systems Security (abbreviated as ANSSI) warned that China state hackers are compromising large numbers of routers for use in a vast and ongoing attack against organizations in France. The compromised routers give the attackers anonymity and are used while carrying out reconnaissance and attacks. One defense of a router is to periodically restart it, since most router malware is unable to survive a reboot.

Asus router fails to get online

by me   July 1, 2021
I am setting up and configuring an Asus AC1900P router. I started in early May and was forced to chose between beta firmware and known buggy firmware. I blogged about this here: Asus router firmware: How do you prefer your bugs? New or Old?. By the end of June there was new firmware (version 3.0.0.4.386_43129) which I installed. As I suggest on the New Router page, the router was not directly connected to the Internet, instead it was on my LAN. Specifically, its WAN port was connected to a LAN port of my existing router. The problems began immediately and I will not bother with most of the details. What I thought was a minor thing, turned out to be, I think, the one problem from which all others stemmed: the router incorrectly thought it was off-line. Eventually, it occurred to me to validate this using the tools built into the firmware, specifically at Network tools -> Network analysis. First, I pinged a couple websites and all was well. Then I ran a couple nslookup commands and, again, all was well. As expected, the DNS server was that of my existing router. Then, I tried netstat. Just after a cold boot, with no device connected to the router (other than a computer on my LAN that logged into it via Ethernet Remote Access) this screen shot shows the router was very much involved with a.applovin.com. Applovin does mobile app advertising and because of this, a.applovin.com was blocked on my LAN. The previous firmware (beta version 9.0.0.4.386.41994) ran just fine on the same LAN. The firmware history shows that the current firmware (version 3.0.0.4.386_43129) is twice the size of the previous firmware. A lot must have changed.
I posted a question about this on Reddit and got no response. I also posted a question about it on the SmallNetBuilder forum, and got no useful response. Asus has no forum (that I could find).
Update July 2, 2021: The router is not involved with applovin.com. The domain a.applovin.com was blocked via DNS, specifically, a query for that sub-domain returned an IP address of zero. Many domains on my LAN are blocked this way, a.applovin.com is the first when sorted alphabetically. After testing again today, I ran netstat with the option to resolve names disabled. This showed many connections to IP address zero. When trying to get a name for IP address zero, netstat must have been given a.applovin.com by the main/outer router. Still, the router thinks it is off-line. The main page displays its LAN IP address (192.168.1.something) for a second, then complains about being disconnected. My testing today included a log of all outgoing packets from the router. The log showed that the router made a UDP request to port 19302 at IP address 172.217.215.127 which belongs to Google. A previous log of all router activity as it starts up also showed a UDP request to port 19302, but that time, the IP address was 108.177.122.127. This too is Google. In each case, these were the only requests the router made to the Internet. Researching the UDP port, I learned that it is used by Google STUN servers and can provide the client (the Asus router) with its public IP address. In both instances, the router made these Google STUN requests 8 seconds after it was assigned a LAN side IP address by the other router. The Asus router log file includes this message "WAN Connection: ISP's DHCP did not function properly." Clearly there is a bug in how the router determines if it is online or not. What to do? I changed the WAN type from DHCP to Fixed IP address and assigned it the same LAN-side IP address it was already using. After a reboot, all was well. What a pain.

JUNE 2021

Some vague Zyxel problem

Hackers are using unknown user accounts to target Zyxel firewalls and VPNs
by Dan Goodin of Ars Technica   June 24, 2021
Vague, vague vague. My take-away from this article is that no one knows what is going on. What does "access a device" mean? Bypass what authentication? My guess is that this issue, whatever it is, is very bad, and the vague explanation is designed to hide this. Smells like there are backdoor accounts in the vulnerable devices. Maybe. Glad that they sent a SOP to all registered users. What's a SOP?

MAY 2021

Article by Dong Ngo

Router Management: Web Interface vs. App and the Trend Linksys Typifies
by Dong Ngo   May 29, 2021
Interesting article. Ngo sees and tests many more routers than I do, so he has a good perspective. Quoting:
 => There’s been a trend in home networking that forces or coerces users into signing up for a login account with the vendor and associate their home network with it. It all started with the eero. Nowadays, you’ll find this type of practice common in many vendors, though not all ... Asus is one of a few vendors that provide a mobile app that works without a login account.
 => ... the [mobile] app itself is not inherently bad. Rather it’s the intention behind the app that can be problematic. That’s especially true when a vendor attempts to turn you into a product via the app. Have you ever wonder how exactly the app on your phone is linked to the router at home? There’s no magic. You likely pay for that with your personal information. In fact, the mining of personal information is so lucrative that many vendors - such as Google or Amazon - have gone as far as taking the web interface entirely out of their home networking devices and make the app the only option. Others try to coerce users into the app artificially ... ever wonder why a vendor would like to collect data from your network, the answer is, among other things, advertising. Your online habits reveal a lot about what you have bought and are going to buy. This type of information, collected over time, is a gold mine for the receiving end. In other words, you become the product.
 => On top of that, there are also security risks. That’s because the vendor itself can be hacked, and when that happens, you have no idea who gets a hold of the data collected from your home network and what they’re going to do with it.
He explains how to use avoid creating a Linksys account while still being able to configure a Linksys router using the web interface.

An Asus router offers nothing but bugs

Asus router firmware: How do you prefer your bugs? New or Old?
by Michael Horowitz (me)   May 11, 2021
I am looking to update the firmware on an Asus RT-AC1900P router and I end up with a very bad choice. I am manually reviewing the latest firmware (dated February 1, 2021) because the automatic check for updates in the router failed. No matter. The most recent firmware is in Beta status which no normal router user/administrator would normally want any part of. But, this Beta software has a large number of security bug fixes. So, the choice is either to install firmware with old, known bugs or new untested Beta firmware with new bugs. Router firmware should not remain in Beta status for over three months. Makes you wonder if Asus is even working on testing it.
Update: Firmware version 3.0.0.4.386.43129 was released May 21, 2021 with fixes for seven known bugs (aka CVEs).

Why its hard to trust any Asus router

CVE-2021-32030: ASUS GT-AC2900 Authentication Bypass
by Chris Bellows of Atredis Partners   May 6, 2021
There is a bug in the ASUS GT-AC2900 router (aka RT-AC2900). It currently sells for about $170 and was released around January 2018. The bug has to do with validating the cookie that governs the current state of the web interface. Bugs in the validation can let someone get at the router without knowing the password. In techie lingo, its an authentication bypass vulnerability. Asus was informed of the problem March 16, 2021 and issued patched firmware April 28, 2021. That's the dull and boring part. The interesting part is the reaction from Asus. Sure, they fixed the bug in the RT-AC2900 but what about the many other Asus router models? It is very likely they share the same bug. But, Asus never issued a security advisory, so we have no way to know if their other routers are also buggy. It's none of our business.
Update: I mis-understood the flaws because in listing them, Bellows did not use either "and" or "or". I read it as three different flaws, which was wrong. All three conditions have to be true to trigger the flaw, not any one of them.

Here we go again - lots of old and vulnerable routers

Which? warns that more than 2 million Brits are on old and insecure routers – wagging a finger at Huawei-made kit
by Gareth Corfield for The Register   May 6, 2021
That millions of routers run old buggy software is not news. This time, the report is out of England from consumer organization Which? (the question mark is part of their name). In December 2020 Which? surveyed more than 6,000 UK adults, asking them which routers they were using at home. From this, they identified 13 older routers that are still commonly used and had them evaluated by security specialists at Red Maple Technologies. Nine of the 13 routers did not meet modern security standards. ISP-branded routers are typically white-label devices from China. Recent vendors to UK ISPs have been Huawei and ZTE. One big issue was the lack of firmware (router software) updates. They estimate that 6 million Britons are using routers that were last updated in 2018, and, of those, 2.4 million routers have not been updated for five years. The worst offenders were the Sky SR101 and SR102, the TalkTalk HG523a, HG635 and HG533 and the Virgin Media Super Hub and Super Hub 2. This came up because England is considering a law that would require phone, tablet, and IoT vendors to publish a drop dead date for security updates on new devices. Another issue was weak default passwords that can be easily guessed by attackers from anywhere in the world. Routers with weak passwords were from Sky, TalkTalk, Virgin Media and Vodafone. Perhaps the worst router was the TalkTalk HG533 made by Huawei and released in 2013. Huawei was warned in 2013 of a vulnerability involving UPnP. They claimed it was fixed in 2014, but they never actually fixed it. The same vulnerability was re-discovered in 2017 by a different group of security researchers. The current evaluation found that the HG533 has weak passwords and is not being updated. The worst ISP seems to be Virgin Media because they "... told Which? to stuff off when its researchers came wagging their fingers disapprovingly". In other words: go away kid, don't bother me. Virgin Media "... did not recognise or accept the findings of the Which? research ..." The only good news is that old routers from both BT and Plusnet had received recent updates and had no security issues.

APRIL 2021

F**k Microsoft - they removed this site from Bing and DuckDuckGo and Yahoo and AOL

April 23, 2021. Microsoft does not want you to see this website.
This site is not promoted in any way. There are, for example, no ads for it. And, for whatever reason, no articles about Router Security ever mention this site, let alone link to it. So, when it disappears from a search engine, it disappears. Do a search for "router security" on Google and this site is currently, the top hit. The same is true at Startpage, Yandex and Baidu. Yet, it is nowhere to be found on either DuckDuckGo or Microsoft's Bing. By this, I do not mean that it is on the second page of search results, it does not exist at all. DuckDuckGo says: "We also of course have more traditional links in the search results, which we also source from multiple partners, though most commonly from Bing (and none from Google)." Elsewhere they say: "We get our results from various sources but mostly Bing, Yahoo and Yandex ...". I forgot Yahoo existed. Sure enough, this site is also missing from a Yahoo search for "router security". I don't think Yahoo really has their own search engine, I think they partner with Bing. So, my guess is that Bing is the real culprit. If a site is removed from Bing, it will probably not appear in DuckDuckGo or Yahoo. Granted, I am no expert on this. Could someone have reported this site as bad to Bing? Microsoft makes it pretty easy to ask for a site to be removed. I doubt they notify the site owner. I also doubt they do much Due Diligence.
April 24: Someone emailed me today saying that this site is the top hit for him at DuckDuckGo. Yet, I don't see it at all and I tried DuckDuckGo on multiple computers with multiple browsers and, thanks to a VPN, from multiple IP addresses. Additional testing showed that this site only appears for him with the Lynx text-based browser on Linux. When he uses normal Firefox, the site does not appear. I can not explain this.
April 25: I did some digging through history and found some referrals from cn.bing.com. So, whatever it is about this site that Bing considers bad, illegal or offensive, does not apply to China. I could not determine when the ban took place. But, in looking at the old server logs, I also saw referrals from search.aol.com. The AOL search is also powered by Bing.
April 27: I'm back ... it seems that feedback I submitted to Bing and DuckDuckGo had an effect.
May 6: Demoted again. This site is no longer the top site on Bing when searching for "router security". It remains the top site on Google. The top results, in sequence, are: Norton, TomsGuide, BestBuy (wow what a screw-up), Microsoft, BestBuy again, Wired, pcworld, foxnews, lifewire, zdnet on recent news, welivesecurity also on recent news, usatoday, and then the Test Your Router page on this site. Foxnews for router security? BestBuy? USA Today? Is Microsoft screwing with me or can they really be that bad at this?
May 15: Adding insult to injury. Not only does Bing rank this site lower than it used to, but the top "router security" web page is just awful. It is one of the worst articles on router security that I have ever seen. More on my blog: Bing prefers miserable Router Security advice
May 16: It seems that Bing treats the last date on a page as the Last Updated date. On this site, the last date is usually the page creation date, so, perhaps Bing is ranking the pages low because it thinks they are old. I am doing a test. The last date that physically appears on each page is now May 14, 2021. Time will tell . . .

Still more misery with IoT

100 Million More IoT Devices Are Exposed - and They Won't Be the Last
by Lily Hay Newman of Wired   April 13, 2021
I consider this router news because it is yet another reason to segment your home network (LAN). For more on this concept, see the VLAN page. Over the last few years, researchers have found a large number of vulnerabilities in the software that underpins how devices communicate, both within a LAN and on the Internet. The communication software is known as a TCP/IP stack. This article is about the latest group of bugs, a set of nine vulnerabilities that are estimated to affect 100 million devices, including internet-of-things (IoT) devices and IT management servers. The bugs are in four different, and popular, TCP/IP stacks. The most famous of the four is included in FreeBSD, which underlies routers running both pfSense and OPNsense. The other three TCP/IP stacks are Nucleus NET (from the industrial control firm Siemens), IPnet and NetX. Exploiting the bugs, an attacker can either crash the vulnerable device or, perhaps, take control of it. Patches have been issued for all nine bugs but many devices will not and/or can not be updated. Similar flaws in other TCP/IP stacks have exposed hundreds of millions of devices to potential hacking. Why are there so many bugs in such fundamental software? An expert is quoted saying "A lot of it is about lack of economic incentives to really focus on the quality of this code."

Portable Verizon 4G hotspot is a fire hazard

Verizon Recalls 2.5M Ellipsis Jetpack Mobile Hot Spots Over Fire Hazard
by Allen St. John of Consumer Reports   April 8, 2021
To the public, its a 4G hotspot, but to me, its a router. Verizon is recalling about 2.5 million Ellipsis Jetpack mobile hot spot devices with lithium-ion batteries that have overheated. The specific models are: MHS900L, MHS900LS and MHS900LPP. Verizon is offering a free exchange, replacing the Jetpacks with an Orbic Speed hot spot.

No Cisco for me

Cisco Will Not Patch Critical RCE Flaw Affecting End-of-Life Business Routers
by Ravie Lakshmanan of Hacker News   April 9, 2021
There are many instances, documented in both the News and Bugs pages of this site, of critical flaws in Cisco software. There have been so many huge security flaws in Cisco software that I don't bother including them all here. The concept became clear long ago - they are not trustworthy. Cisco just issued fixes for still more critical bugs (Cisco fixes bug allowing remote code execution with root privileges) but the point here is about a bug they did not fix. Specifically, the bug identified as CVE-2021-1459, which exists in the web-based management interface of the Cisco Small Business routers RV110W, RV130, RV130W, and RV215W. The bug is as severe as severe gets, an unauthenticated bad guy can execute arbitrary code on a vulnerable device. But, these devices are too old to bother with. Quoting the company: "Cisco has not released and will not release software updates to address the vulnerability ... The Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers have entered the end-of-life process ... Customers are encouraged to migrate to the Cisco Small Business RV132W, RV160, or RV160W Routers." I agree that owners of buggy devices need to buy new hardware, but at this point, you could not pay me to use hardware from Cisco (or Ubiquiti for that matter). It is interesting to note that when a bug is really bad, as this one is, Microsoft will make an exception, and issue a patch for no-longer-supported software.

MARCH 2021

Bombshell revelation about Ubiquiti

Whistleblower: Ubiquiti Breach Catastrophic
by Brian Krebs of KrebsOnSecurity.com   March 30 ,2021
Quoting: "On Jan. 11, Ubiquiti Inc.... disclosed that a breach involving a third-party cloud provider had exposed customer account credentials. Now a source who participated in the response to that breach alleges Ubiquiti massively downplayed a 'catastrophic' incident to minimize the hit to its stock price, and that the third-party cloud provider claim was a fabrication ... It was catastrophically worse than reported, and legal silenced and overruled efforts to decisively protect customers. The breach was massive, customer data was at risk, access to customers' devices deployed in corporations and homes around the world was at risk." And, more details: "The whistleblower claims that 'attacker(s) had access to privileged credentials ... and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies. Such access could have allowed the intruders to remotely authenticate to countless Ubiquiti cloud-based devices around the world. " At times like this, you might expect a company to force all users to change their password the next time they logon. Instead, Ubiquiti sent out emails, that were flagged as SPAM, so some users never saw them, that suggested changing their password. I spent 10 years as a Database Administrator so this point really hit home: Ubiquiti had no logging configured for the critical databases that the attacker(s) gained access to. Thus, they have no clue what the bad guys did. This is malpractice and is a great reason not to trust them going forward. Ubiquiti took a full day to respond to these charges and their response was half-hearted and did not fully deny all these charges. Oh, and the attackers also provided proof they had stolen Ubiquiti's source code. Some points:

  1. Ubiquiti has many different product lines (UnifI, AmpliFi, Alien, EdgeRouter) and there was no mention here about which ones are affected. It seems likely that anything using a Ubiquiti cloud service was at risk.
  2. There was disagreement in the comments as to whether the use of Ubiquiti cloud services was required. It seems to vary both by product and by software release. Over time, more Ubiquiti products do require their cloud service.
  3. No mention of their online stores. Are they involved in the breach? I have an account at store.amplifi.com and it is impossible to change the password.
  4. The UniFi Dream Machine requires cloud services. Take it or leave it.
  5. The Edge routers do not require Ubiquiti cloud services according to comments made on the article.

Update: April 4, 2021. Ubiquiti All But Confirms Breach Response Iniquity by Brian Krebs. Four days after the above disclosure, the company issues a public statement that confirms and reinforces the claims in the first article. Nothing was denied.

From other sources

FEBRUARY 2021

NAT traversal issues

NAT Slipstreaming v2.0: New Attack Variant Can Expose All Internal Network Devices to The Internet
by Ben Seri of Armis   February 2021
There are two industry issues that affect many routers. Rather than being bugs, they are design flaws in Application Layer Gateway (ALG) software. In late October 2020, respected security researcher Samy Kamkar figured out a way to poke a hole in the router firewall that opened up access to a computer visiting a malicious web page. This initial version of the NAT Slipstreaming attack abuses the Session Initiation Protocol (SIP) protocol and ports 5060 and 5061. The second generation attack abuses the H.323 multimedia protocol to open firewall holes to any LAN side device. It depends on sending TCP traffic out to port 1720 (for call forwarding). In response to these issues, web browsers have blocked some outbound ports. Armis, which developed the second generation attack said "The real fix would be every user and sysadmin disabling all ALGs, as this feature is fundamentally broken." In response to the second generation attach, Chrome not only blocked port 1720, it also blocked 69, 137, 161, 1719, 1723, and 6566. The other TCP ports "are known to be inspected by NAT devices and may be subject to similar exploitation." As for routers, the obvious solution is to disable the ALGs. On the Stuff to Turn Off page here, I provide screen shots and summaries of the varying ALG support from AmpliFi, Asus, DrayTek, Eero, Google Nest, Linksys, Peplink, TP-Link and UniFi. Routers that provide outbound firewall rules can be configured to block these same ports. This is a more complete solution.
Ports to block for v1: 5060 and 5061
Ports to block for v2: 69, 137, 161, 1719,1720, 1723 and 6566
Port later blocked: 554

JANUARY 2021

Ubiquiti is hacked and lies about it

Ubiquiti tells customers to change passwords after security breach
by Catalin Cimpanu of ZDNet   January 11, 2021
"According to Ubiquiti, the intruder accessed servers that stored data on UI.com users, such as names, email addresses, and salted and hashed passwords. Home addresses and phone numbers may have also been exposed ... How many Ubiquiti users are impacted and how the data breach occurred remains a mystery ... A Ubiquiti spokesperson did not immediately return a request for comment send before this article's publication ... Despite the bad news to its customers, Ubiquiti said that it had not seen any unauthorized access to customer accounts as a result of this incident. The company is now asking all users who receive the email to change their account passwords and turn on two-factor authentication. While initially, some users looked at the emails as a phishing attempt, a Ubiquiti tech support staffer confirmed that they were authentic on the company's forums."
My take: I have installed two AmpliFi systems and this left me annoyed as heck because I was not sure if the problem affected me or not, which is pretty trivial to convey. Do I need to change the router password? The Wi-Fi password? I bought one from the Ubiquiti website (store.amplifi.com) and had to create an account there. Is that part of the breach? None of my business. I logged into the site to change my password and there is no change password function. You can't make this stuff up. Do AmpliFi customers have a Ubiquiti account if they purchased the hardware elsewhere? Dunno. No more Ubiquiti for me. We did not know they were lying about much of the problem until March 2021.

A huge number of security problems with FiberHome routers

Multiple backdoors and vulnerabilities discovered in FiberHome routers
by Catalin Cimpanu of ZDNet   January 18, 2021
Anyone with an optical fiber connection to the Internet has an Optical Network Terminal that converts optical signals into Ethernet and Wi-Fi data packets. Chinese company FiberHome makes a HG6245D model ONT/router that is a security disaster. The HG6245D is widely deployed in South America and Southeast Asia. News of these flaws comes from Pierre Kim who has reported many other router bugs in the past. He was supposed to give a presentation on the problems at a conference that was cancelled due to the pandemic. Not only were there many security flaws (too many to count) there were also 28 backdoor accounts. Geeze. What does the company have to say for itself. Nothing. Quoting: "Requests for comment sent by ZDNet to FiberHome via email and its official website last Thursday, January 14, remained unanswered at the time of writing."

2020   top

DECEMBER 2020

A great reason to avoid Zyxel devices

Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways
by Catalin Cimpanu of ZDNet   January 2, 2021
Quoting: "More than 100,000 Zyxel firewalls, VPN gateways, and access point controllers contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via either the SSH interface or the web administration panel." This is as bad as bad gets. It is a great reason to avoid all Zyxel hardware. According to Dutch security firm Eye Control, the username and password were visible in a firmware executable file. The userid is not visible to an administrator of the device and its password can not be changed. Eye Control reports that since the SSL VPN on these devices operates on the same port as the web interface, a lot of them have exposed port 443 to the Internet. Patches are available.

TP-Link Access Point has a back door - a hidden Wi-Fi network

Tweet thread
by Jon Aubrey   December 1, 2020
The Access Point (AP) in question is the TP-Link TL-WA701ND. Jon uses it to connect an Ethernet-only device to his home Wi-Fi network. The tweet thread starts with "One day while I was scanning around my house for WiFi networks I noticed a high-powered WiFi network with a hidden SSID broadcasting from my main office. With a little more investigation I determined this was coming from the TP-Link, but what was it?" Not only was the network not broadcasting its SSID, there was also nothing about its existence in the user interface of the device. Really hidden. You could stop right there, as this tells you everything you need to know about TP-Link. He very impressively hacked the router and learned the SSID of the network and logged in to it. Quoting: "The hidden network in this case is bridging with the other WiFi network that I told the client to connect to, so we have a backdoor into my home network, not fun." The important lesson here is for buying a router from a company you can trust. This is a lesson the New York Times has not learned, all they care about in reviewing routers is speed. In their WireCutter division the top two recommended routers are both from TP-Link.

NOVEMBER 2020

Apple pokes holes in macOS firewalls for their own use

Apple's own programs bypass firewalls and VPNs in Big Sur
by Anders Lundberg of MacWorld   November 18, 2020
Apple has modified the guts of the Big Sur edition of macOS (aka macOS 11) to poke a hole in some (not all) outgoing firewalls for their own corporate use. 56 Apple apps and processes, such as FaceTime, iMessage, iCloud, Maps and Siri can no longer be contained by bypassed firewall software running on the system. They also made their own software immune to the previously-mandatory network changes imposed by some (not all) VPN client software running on macOS. This too, can be thought of as poking a hole in the firewall, though the official term is a VPN leak. Some worry that bad guys can use this new system to piggy-back on the Apple exceptions/holes and bypass firewalls and VPNs. To everyone else, this is a macOS story. To me, it is a router story. Regardless of the operating system on any computing device, the router is the top dog. It can, for example, block all access to the outside world that does not go through the VPN tunnel. Perhaps not easy to configure, but its possible, at least with professional grade routers (pfSense and Peplink for example). Some have suggested running a VPN client on the router to avoid any and all VPN leaks.

Auditing a Buggy Asus Router

At a recent hacking contest in China, bugs were found in two routers: the TP-Link TL-WDR7660 and the Asus RT-AX86U. The contest results were announced November 9, 2020. The TP-Link router is not sold in the US, there is no mention of it at www.tp-link.com/us/. The contest rules require the discovered flaws be disclosed to the vendor. I will watch Asus and see when they admit to the flaw and when they fix it. Perhaps most importantly, we will see if they patch just the one model or if they bother to investigate or say anything about similar models running similar firmware.
 -->April 18, 2021: new firmware, version 3.0.0.4.386.42095, is dated March 18, 2021. It fixes a DoS vulnerability and these security bugs: CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687, CVE-2020-25684, CVE-2020-25685, CVE-2020-25686, CVE-2020-36109. Chances are one of these is the Nov. 2020 bug.
 -->January 2, 2021: Still nothing on the Asus Security Advisory page. But, there is new firmware, version 3.0.0.4.386.41535 dated Dec. 30, 2020. There were many changes in the firmware, but there is no mention of a bug fix. The bug seems to have fallen off the end of the earth. Such are consumer routers.
 -->December 17, 2020: Still nothing on the Asus Security Advisory page. No new firmware either.
 -->November 22, 2020: Still nothing on the Asus Security Advisory page. No new firmware either.
 -->November 13, 2020: There is nothing on the Asus Security Advisory page about this.

OCTOBER 2020

Singapore takes the first steps to making routers secure

Singapore tightens security requirements for new home routers
by Eileen Yu of ZDNet   October 13, 2020
Starting April 2021, home routers in Singapore will have to have taken some basic security steps in order to be sold. The exact requirements were not clear from the article, but it starts at the very beginning: every router has to have randomized and unique login credentials with an unspecified minimum password strength. And, security patches have to be downloaded automatically. Routers will also have to disable "system services and interfaces that are deemed to be vulnerable" which might refer to WPS and/or UPnP. However, there is nothing about how long security patches have to be issued. The article points out that Japan imposed similar requirements and that the UK is considering this too. The US? Fuggedaboutit. It's the Wild West here, which is why this site is needed.

Tenda routers hacked. The company response tells us not to use their products

New Ttint IoT botnet caught exploiting two zero-days in Tenda routers
by Catalin Cimpanu of ZDNet   October 4, 2020
Netlab, the network security division of Qihoo 360, reported that bad guys have been exploiting bugs in Tenda routers to install malware on the routers and to build an IoT botnet. The botnet, called Ttint, was first sighted in November 2019. Not satisfied with the usual, infecting devices to perform DDoS attacks, Ttint also implements 12 different remote access methods to the infected routers, used the routers as proxies to relay traffic, tampered with the router's firewall and DNS settings, and gave attackers the ability to execute remote commands on the hacked devices. Until July 2020, the bad guys exploited bug CVE-2020-10987. Then, Sanjana Sarda, of Independent Security Evaluators, published a detailed report on the vulnerability and four others. A few weeks later Ttint software was revised to exploit a different bug in the same routers. Despite the public shaming, Tenda has fixed neither bug. That's all we need to know. The command control center for the botnet is at notepod2.com, so if you can block this domain in your router or DNS, please do.

SEPTEMBER 2020

Another reason to avoid Netgear hardware

Before you buy that managed Netgear switch, be aware you may need to create a cloud account to use its full UI
by Gareth Corfield of The Register   September 21, 2020
Yes, this story is about managed/smart switches rather than routers. Close enough. And it's very useful for peek into the corporate mindset of Netgear. They changed the rules on their customers. Owners of Netgear managed switches are now required to setup a Netgear Cloud account to continue to use the full web interface to manage the devices. Without an account, some features are off-limits. Netgear has done a similar thing with their routers. In that case, a router firmware update introduced telemetry that was on by default. What does Netgear do with information from the newly assimilated switches? Their privacy policy says that data can be hoovered up for marketing purposes and research. Resistance is futile. Someone commenting on the story noted that to use many features of an Asus router, you need to accept Terms and Conditions that include transmitting your data to TrendMicro and potentially others. This has been covered here previously.

Blog about old buggy software in consumer routers

Network routers are just computers
by Daniel Aleksandersen   September 12, 2020
A recent study found that one-third of the tested routers shipped with Linux kernel version 2.6.36, which was released in October 2010. This outdated version of the Linux kernel has 233 known security vulnerabilities registered in the Common Vulnerability and Exposures (CVE) database. The study did not look into whether different software services on the router run in sandboxed and constrained environments, or whether they have full privileged access to the system. In Aleksandersen's experience, he has only seen services with full access (bad security). He complains that it is not difficult or time-consuming to set up these protections, but network equipment manufacturers tend not to bother with it. He also replicated a small part of the study at a local electronics shop. He noted every router being sold and checked when they had last received a security update. Not a single router had received a software update in the last 14 months. Manufacturers of consumer routers are not incentivized to provide ongoing support and security updates for their devices. It’s expensive to employ staff that support old products that don’t generate revenue. In his opinion that are no good consumer routers. None. He says you need to switch to more involved, complicated, and expensive enterprise-grade network equipment before you see any improvements. I agree and thus my recommendation here for Peplink products. My page on configuring the Pepwave Surf SOHO should make it easier to get started.

My blog on using two routers

A second router can make working from home much more secure
by Michael Horowitz   September 25, 2020
The title is self-explanatory. Last Updated: Oct. 31, 2020.

Do not buy a router from MoFi Network

Critical Vulnerabilities Discovered in MoFi Routers
by Rich Mirch of CriticalStart, Teamares   September 2, 2020
I had never heard of Mofi Network until this report came out. They make 4G/LTE routers based on OpenWRT. When Mirch first examined them, he found ten bugs. Mofi fixed some of the bugs, not all, and while doing so introduced still more bugs. Mirch found two (yes two) undocumented administrator accounts (think backdoor). At least one of them lets attackers login to the management interface without a password. The devices also default to enabling remote administration, which no one does any more. Also, no authentication is required to download a support file that contains cleartext credentials and password hashes. One bug that is not fixed, lets bad guys authenticate as root without the root password.

AUGUST 2020

More Cisco bugs

Cisco alert: Four high-severity flaws in routers, switches and AnyConnect VPN for Windows
By Liam Tung of ZDNet   August 6, 2020
More high-severity flaws in assorted Cisco software. One bug is in the StarOS system that runs on the ASR 5000 Series Aggregation Services Routers. It allows a remote attacker without credentials to cause a denial of service. Some Small Business switches and Managed switches are also buggy. A remote attacker without credentials can cause a denial of service on the buggy switches. Some vulnerable switches are not being fixed because Cisco considers them too old.

JULY 2020

Counterfeit high end networking devices

A Tale of Two Counterfeits
by Steve Gibson of GRC   July 21, 2020
Two weeks ago, we learned that C-Data networking devices were spy machines (story below) with all sorts of backdoor accounts. Turns out this was not true, that the devices the researchers had studied were counterfeit. The retraction has been ignored by the tech press, except for Steve Gibson. The other counterfeit he discusses is another recent story, F-Secure found about phony Cisco switches. The Cisco devices were discovered only because they would not boot after a firmware update. Nothing gave away the C-Data devices.

Yet another Cisco flaw

Cisco patches actively exploited ASA/FTD firewall vulnerability
by Sergiu Gatlan of Bleeping Computer   July 24, 2020
At this point a severe and actively exploited flaw in Cisco software is not really news. The software this time is the Cisco Adaptive Security Appliance (ASA) Software (the OS for standalone appliances, blades, and virtual appliances) and the Cisco Firepower Threat Defense (FTD) Software which should be providing next-gen firewall services. Vulnerability CVE-2020-3452 may allow unauthenticated attackers to read sensitive files on unpatched systems through directory traversal attacks. This happened in the usual way, improper input validation of URLs in HTTP requests. Yawn.

C-Data networking devices are spy machines

Backdoor accounts discovered in 29 FTTH devices from Chinese vendor C-Data
by Catalin Cimpanu for ZDNet   July 10, 2020
NOTE: See above. The studied devices were counterfeit.
Researchers Pierre Kim and Alexandre Torres examined networking devices from C-Data and found the worst possible situation. The devices are, technically, not routers, and they are found in the internal networks of ISPs rather than our homes or offices. Earlier research by Pierre Kim can be found on this website in many places. The devices can be thought of as optical modems, they convert optical signals to Ethernet. The firmware in 29 devices from C-Data was found to have 7 vulnerabilities. Even worse, the devices have backdoor accounts, which can grant full access to people that know the hard-coded passwords. This was so obviously done to allow purposeful access/hacking/spying, that the researchers went public with their results rather than tell C-Data first. Much blame also falls on the ISPs that purchased this equipment. For one thing, the boxes only use HTTP for administration not HTTPS. Also, they use Telnet rather than SSH. Both are red flags. The defense against this is a VPN. Using one means that your ISP sees nothing but encrypted bytes.

A study of 127 router models found miserable security

Home router security report
by Peter Weidenbach and Johannes vom Dorp of the Fraunhofer Institute   (20 page PDF) July 2020
Researchers at the German Fraunhofer Institute studied 127 common home routers from Asus, AVM, D-Link, Linksys, Netgear, TP-Link and Zyxel. They looked at the latest available firmware as of March 27, 2020. Not one router was bug-free. Some had hundreds of known vulnerabilities. The average number of critical vulnerabilities per router was 53. The best routers had 21 vulnerabilities. A third of the routers use the 2.6.36 Linux kernel which was last updated nine years ago. Routers are not updated very often. 46 routers had not received a security update in the last year. 27 had not been updated in the last two years. In the worst case, there had been no update for 5 years. That said, the report did not go into the concept of End-of-Life where a manufacturer publicly admits there will be no more updates. And, even when routers are updated many known vulnerabilities were not fixed. This is not news, similar prior studies also found this. 50 routers had hard-coded credentials (userid/password) and 16 had well known or easy crackable credentials. Linux provides a number of exploit mitigation features and the routers rarely used them. The same complaint was very recently made by the person that found bugs in 79 Netgear routers (see below). Most firmware has private cryptographic keys so whatever is being secured with a public-private crypto mechanism is not really secure. As for rating the vendors on security, AVM was the best, ASUS and Netgear were mid-tier and the worst were D-Link, Linksys, TP-Link and Zyxel.

Yet another Cisco bug

Cisco SMB kit harbors cross-site scripting bug: One wrong link click... and that's your router pwned remotely
by Shaun Nichols of The Register   July 2, 2020
There is a bug in the Cisco Small Business RV042 Dual WAN VPN Router and the Cisco Small Business RV042G Dual Gigabit WAN VPN Router. The bug is in the web interface and is as old as time itself - lazy programming. That's my term, the article attributes the bug to "insufficient validation of user-supplied input". The flaw can be exploited by an unauthenticated remote attacker. The bug is in the web interface so it probably can only be attacked on the LAN side, unless remote admin is enabled. That said, a malicious web page runs on the LAN and can attack the buggy routers from there. The bug was discovered by a company called CyCognito and they said that, in the worst-case scenario, a bad guy could exploit the flaw to take complete control of a vulnerable device. Cisco has issued updated firmware.

JUNE 2020

Cisco is the only router vendor vulnerable to Ripple20

List of Ripple20 vulnerability advisories, patches, and updates
by Ionut Ilascu of Bleeping Computer   June 25, 2020
TCP/IP software from a company called Treck is very buggy. The software is used in millions of IoT devices. And, in Cisco ASR 5000 Series routers. It is also in six other Cisco devices. Why is Cisco is using Treck software?

UPnP yet again

CallStranger - Data Exfiltration & Reflected Amplified TCP DDOS & Port Scan via UPnP SUBSCRIBE Callback
by Yunus Çadirci   June 8, 2020
UPnP (Universal Plug and Play) allows devices to find each other on local networks and establish connections to exchange data. Devices communicate on their own without human involvement. UPnP was introduced back in the early 2000s, and it is designed for use on trusted Local Area Networks, thus it has no security at all. Opening up UPnP to the Internet is a mistake, yet a recent Shodan query found over five million devices doing UPnP on the Internet. Some are security cameras, DVRs, printers and, of course, routers. In December 2019, security engineer Yunus Çadirci found a new bug in UPnP. The bug was by design, it was a flaw in the UPnP specification itself. The spec was updated in April 2020. Some implementations of UPnP are buggy, others are not. Miniupnp (after 2011) is not vulnerable to the CallStranger flaw. Older versions of Windows 10 vulnerable, the latest is not. Good luck figuring out which version of UPnP is installed on a device. It is very likely that most vulnerable devices will never have their software updated. If you can run Python, Çadirci created a python script that scans a network for vulnerable devices. Vulnerable devices can be abused to exfiltrate data, scan the Local Area Network or cause a network to participate in a DDoS attack. More specifically, the vulnerability is caused by the Callback header value in the UPnP SUBSCRIBE function. It can be controlled by an attacker.

APRIL 2020

More proof that ISP DNS should be avoided

TalkTalk customers unable to opt out of ISP's ad-jacking DNS - just like six years ago
by Matthew Hughes of The Register   April 20, 2020
When you try to contact a non-existing computer, by name, you should get an error message. Instead, some DNS providers show sponsored ads instead. Not the biggest problem in the world, but worse at TalkTalk where the ability to stop the sponsored ads does not always work. Worse, this prevents some customers from connecting to VPNs. The real solution is not use DNS servers from an ISP. Instead go with Quad9 or Cloudflare or OpenDNS or Google. For more about DNS, see the Test Your DNS page on this site.

Still more fallout from Linksys hack

Linksys asks users to reset passwords after hackers hijacked home routers last month
by Catalin Cimpanu of ZDNet   April 16, 2020
Linksys Smart WiFi is a cloud-based system for administering Linksys devices. Recently, Bitdefender detected an organized campaign to break into D-Link and Linksys routers and change the DNS server settings. In response, Linksys has locked all user accounts and is forcing users to reset their passwords. When the password is changed, Linksys will check the DNS server settings and remove the known bad ones. To me, this seems flawed - a bad guy could logon, change the password and then change the DNS servers the next day to some other malicious ones. The one real lesson here is to register your router with the hardware manufacturer.

MARCH 2020

A different take on the same hacking spree

New Router DNS Hijacking Attacks Abuse Bitbucket to Host Infostealer
by Liviu Arsene of BitDefender   March 25, 2020
This seems to be same story as the one below, but many details are different. For one thing, there is no mention of Windows 10 checking for the status of the Internet connection. Instead, it says that a number of popular websites (Amazon Web Services, Disney, Reddit and more) are targeted. And, it only mentions Linksys routers being hacked, nothing about D-Link. Neither article says how the bad guys are getting into the vulnerable routers. This article is from BidDefender and thus the focus is on Windows. So much so, that its no clear if any other OS can be victimized. From their perspective, the use of Bitbucket to deliver malware is interesting, I could care less. It also abuses TinyURL. Yawn. Most victims are in Germany, France, and the United States. As with the article below, the bad DNS servers are 109.234.35.230 and 94.103.82.249. If your router supports outbound firewall rules, it would be good to block these. The malicious web pages reside on 176.113.81.159, 193.178.169.148 and 95.216.164.181. What is not said here is testing a router for open ports (see the Test Your Router page here). Also, any device running a VPN client is immune to this. And, any browser configured to use encrypted DNS is immune to this. Defense is boring.

Hacked routers display scam COVID-19 virus warnings

Hackers Hijack Routers' DNS to Spread Malicious COVID-19 Apps
by Lawrence Abrams of Bleeping Computer   March 23, 2020
Yet another case of DNS hijacking. No surprise, the vulnerable routers are from D-Link and Linksys. The malicious DNS servers are 109.234.35.230 and 94.103.82.249. The article fails to mention my DNS Tester page which displays the currently in-effect DNS servers. Windows periodically connects to www.msftconnecttest.com to test whether the Internet connection is functional. Bad guys screwed with the DNS for this domain. When Windows runs a connectivity test, a browser opens to display the scam warning about COVID-19. The article says to configure your router to get DNS servers from your ISP. This is wrong. It is safer to use DNS servers from known trusted sources such as Cloudflare, Quad9, OpenDNS, NextDNS or Google, among others.

Industry wide flaw reported

pppd vulnerable to buffer overflow due to a flaw in EAP packet processing
by CERT Coordination Center - Vulnerability Note VU#782301   March 4, 2020
A new vulnerability that affects many router vendors was reported by Ilja Van Sprundel of IOActive. There are actually two bugs. The first is in the Extensible Authentication Protocol (EAP) packet processing in the Point-to-Point Protocol Daemon (pppd). The bug is an error in how the code validates the size of the input before copying the supplied data into memory. Exploiting the bug allows an unauthenticated remote attacker to cause a stack buffer overflow. The second logic flaw is in the eap_input() function which may not check if EAP has been negotiated during the Line Control Protocol (LCP) phase. This allows an unauthenticated attacker (the worst type of attacker) to send an EAP packet even if ppp refused the authentication negotiation. The vulnerable pppd code in eap_input will mistakenly process the EAP packet and trigger the stack buffer overflow.
Is your router vendor vulnerable? Results are trickling in. OpenWrt is vulnerable and a fix is being worked on. Synology is vulnerable and a fix is being worked on. TP-Link is vulnerable and a fix is being worked on. Ubiquiti Networks has put out an advisory with updated firmware to address this vulnerability. Apple and Draytek are not vulnerable. The worst responses, so far, have been from Asus, Eero, D-Link, Linksys, Netgear and pfSense. They have not said anything.

FEBRUARY 2020

Thousands of Asus routers hacked

FBI Warned Of Fraudster's Paradise: Up To 130,000 Hacked Asus Routers On Sale For A Few Dollars
by Thomas Brewster of Forbes   February 28, 2020
Somewhere between 50,000 and 130,000 Asus routers have been hacked and are being offered for sale alongside personal information on roughly a half million people. Why? Quoting: "The reasons for fraudsters to use such hacked routers are twofold. First, it masks the origin IP address of the fraudster. Second, fraud detection systems will block a transaction if it's taking place outside of the geolocation where the card is normally used. So if a fraudster has access to either a router in a similar location to their victim's typical transactions or their actual router, it's much less likely their illicit purchase will be blocked." The Asus bug dates back to at least 2018 and has been patched, but since Asus firmware updates are a manual process that is miserably explained, few people ever do it.

Wi-Fi bug - No big woof

Flaw in billions of Wi-Fi devices left communications open to eavesdroppng
by Dan Goodin of Ars Technica   February 26, 2020
A Wi-Fi vulnerability in chips made by Cypress Semiconductor and Broadcom, allows nearby attackers (within Wi-Fi range) to decrypt some over-the-air data. The good news is that its only a drip of data (several kilobytes) and the vulnerable data is only transmitted immediately after disconnecting from a Wi-Fi network. This is a bug in WPA2, but data transmitted via SSL/TLS still has that encryption going for it. Since very little data is transmitted in plain text, this is not a huge issue. The flaw was discovered by Eset. It affects routers from Asus and Huawei as well as iOS devices, Macs, Amazon Echos, Android devices and more. The flaw is known as Kr00k and billions of devices use the flawed hardware/firmware. The bug was discovered months ago, so many devices have available updates to fix this. However, there is no tester, so there is no way to know if any particular device is buggy or not. The big exception are Apple devices. Interestingly, devices that are not vulnerable become vulnerable if connected to a vulnerable router. Known vulnerable routers: Asus RT-N12, Huawei B612S-25d, Huawei EchoLife HG8245H and Huawei E5577Cs-321. What about the other 14,000 routers? Don't know. Eset said nothing about routers they tested and found were not vulnerable. Chances are other Asus routers are vulnerable. The RT-N12 is old and will probably never be patched. In fact, chances are Asus will never say anything about this. Update: Multiple Cisco products are affected by this.

Windows malware guesses Wi-Fi passwords

One of the most destructive botnets can now spread to nearby Wi-Fi networks
by Dan Goodin of Ars Technica   February 11, 2020
Mostly clickbait. The only danger is to Wi-Fi networks that are using a default password. Still, a good reminder about using VLANs. To me, the important point in this article is that the malware phones home to 87.106.37.146 and 45.79.223.161. You really need a router than can block outgoing connections to an IP address.

JANUARY 2020

Ubiquiti UniFi goes to the dark side

You spoke, we didn't listen: Ubiquiti says UniFi routers will beam performance data back to mothership automatically
by Robbie Harb of The Register   January 29, 2020
"Ubiquiti Networks is once again under fire for suddenly rewriting its telemetry policy after changing how its UniFi routers collect data without telling anyone." Clearly, the company can no longer be trusted. That said, they are still much better than Synology when it comes to exfiltrating data. The UniFi routers will collect two types of information, PII (personally identifiable information) and other stuff. You can opt out of the PII being sent (collected too?) in the user interface but not the other data. This leads to the question of exactly what type of data falls into each camp. So far, we don't know. The company claims that UniFi owners can stop the collection of "other data" by manually editing a config file. Exactly what file this is, is not clear in this article. Also, the article is just about UniFi, not any of the other lines from Ubiquiti such as AmpliFi, Alien or Edge. However, someone on Reddit said that an upcoming beta release for the EdgeRouter includes "anonymous crash reporting". In November 2019, you could block this phoning home by blocking domain trace.svc.ui.com. It is not clear if that still applies.

Travel Router discussion

The Privacy, Security, & OSINT Show - Episode 153
by Michael Bazzell   January 17th, 2020
A discussion of travel routers. The router he settled on is the GL.iNet AR750s Slate and I have a summary of it on the Resources page. I had purchased the same router months before this show aired.

Self promotion masquerading as router attack news

Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices
by Cong Zheng, Yang Ji and Asher Davila of Unit42   January 21, 2020
This is the least important router attack I have seen to date. In my opinion, it just self-promotion by Palo Alto Networks. Tomato is an open source alternative firmware for routers. It is not very popular, Unit42 (a division of Palo Alto Networks) found just over 4,600 Tomato routers exposed on the Internet. They also discovered a new variant of the Muhstik botnet that attacks Tomato routers by using the default userid/password to log in to the admin web interface which is on port 8080. Remote administration is off, by default, in Tomato so the number of vulnerable devices can probably be counted on one hand. Muhstik mainly uses infected devices for cryptocurrency mining and DDoS attacks. The usual stuff.

Netgear Routers

Leave your admin interface's TLS cert and private key in your router firmware in 2020? Just Netgear things
by Shaun Nichols   of The Register   January 20, 2020
This is not big critical issue. Netgear left a private key embedded in the firmware for their routers, firmware that anyone can download. In theory, a bad guy could use to impersonate the Netgear domain, routerlogin.net, that they tell customers to use to access the router web administration (they also use routerlogin.com). The exact details are not clear in the article, I don't think the author understands the issue. To me, the most important aspect of this occurred when the researchers that found the problem tried to communicate with Netgear. It went badly and there is no excuse for that. None. Also, if you report a Netgear bug, then silence is the rule. Also bad. Good reasons to avoid Netgear devices.

2019   top

NOVEMBER 2019

Lots of D-Link router bugs

D-Link Adds More Buggy Router Models to 'Won’t Fix' List
The bugs page has two stories from mid-November about bugs in D-Link routers. About a dozen routers are deemed too old to fix, so there will be no updates. The other story is about the D-Link DIR-878 router which was hacked by seven different groups at a recent hacking contest. D-Link has said nothing about the hacking and we are left to just guess which other D-Link routers have the same bug.

More ISP monitoring of your network coming soon

How does Plume get all these ISP partnerships? Open source software
by Jim Salter of Ars Technica   November 12, 2019
Increased monitoring of the network in your home by both your ISP and by Plume is coming. Quoting: "Plume now has partnerships with the first- and second-largest ISPs in the United States, as well as the first- and second-largest in Canada - and also with the National Cable Television Collective (NCTC), a membership organization comprising several hundred independent US cable companies. Earlier this month, we covered the announcement of a Plume partnership with J:COM, Japan's largest ISP ... The real value proposition for ISPs is better support, with faster and cheaper ISP development pipelines. Plume's virtual NOC makes it easy for a support technician to see just what's going on in a customer's network and, therefore, make helpful and accurate assessments about problems. If a customer calls in to complain that their Apple TV, Fire Stick, or Roku keeps buffering, a technician can see at a glance whether the problem is low signal strength or congestion, and they can offer advice accordingly."

Ubiquiti adds telemetry

Sure, we made your Wi-Fi routers phone home with telemetry, says Ubiquiti. What of it?
by Shaun Nichols of The Register   November 7, 2019
You didn't ask for it, we didn't tell you about it, but hey, it clears GDPR so what you gonna do? More details on this are on the Secure Routers page. This article adds nothing to what is on the Secure Routers page, but there are 107 comments as I write this. Ubiquiti owners don't know how good they have it compared to Synology owners. In my tests of the RT2600ac router I found that it phoned home all the time, it was none of our business why and you can't stop it.

OCTOBER 2019

Old routers, old bugs, new attacks

This aggressive IoT malware is forcing Wi-Fi routers to join its botnet army
by Danny Palmer of ZDNet   October 31, 2019
Three old Wi-Fi routers are vulnerable to malware that takes advantage of known vulnerabilities to rope them into a botnet. The malware is a new variant of software that first appeared in 2014, known as Gafgyt. The new variant attacks the Huawei HG532, the Realtek RTL81XX and the Zyxel P660HN-T1A. Vulnerable routers are found by net-wide scans. Interestingly, this latest malware kills any other malware on the router.

Apple adding some smart home features to 3 routers

Why we need Apple's HomeKit-enabled routers
by Jonny Evans of Computerworld   October 16, 2019
Back in June 2019, Apple announced upcoming HomeKit-enabled routers from Linksys, Eero and cable company Spectrum. Seems like a big nothing to me. The Pepwave Surf SOHO can do anything that needs to be done in terms of isolating devices in your home. Apple software will have three options: Restrict to Home, Automatic, and No Restrictions.

EoL lists for router manufacturers

Is Your Old Router Still Getting Security Updates?
by Chris Hoffman of How-To Geek   October 12, 2019
Router manufacturers are not forced to update router for any particular amount of time. And, since many compete on price and people buy the cheapest possible routers, the manufacturers have to cut corners somewhere and long-term support is an easy place to cut. After all, how many people will buy a router because the manufacturer promises extended security updates? So how do you tell if your router is still supported? Check the router manufacturer's website. The article has links to End-of-Life lists for eight router vendors. As a reader commented, however, it does not address the many people who use a router provided by their ISP.

SEPTEMBER 2019

Routers still buggy after all these years

SOHOpelessly Broken 2.0
by Independent Security Evaluators   September 16, 2019
In 2013 ISE first researched routers and IoT devices and found many bugs and flaws. Now, in 2019, things are no better. They discovered 125 security vulnerabilities across 13 routers and NAS devices. Or, as they would put it: Security controls put in place by device manufacturers are insufficient against attacks carried out by remote adversaries. Vendors tested: Buffalo, Synology, TerraMaster, Zyxel, Drobo, ASUS, Asustor, Seagate, QNAP, Lenovo, Netgear, Xiaomi and Zioncom (TOTOLINK). All 13 devices had at least one vulnerability that could be leveraged by an attacker to get remote access to the device's shell or administrative panel. They obtained root shells on 12 of the 13 devices, allowing them complete control. Six devices were as bad as bad gets: they could be remotely exploited without authentication. One of these was the Netgear Nighthawk R9000. The ASUS RT-AC3200 router had three types of bugs. This was also a test of the companies, just as much as their software. These companies never responded to ISE: Drobo, Buffalo Americas, and Zioncom Holdings.

Yet another LAN side protocol available on WAN is being abused

Yikes! Another DDoS Weapon, WS-Discovery Amplification Attacks
by A10 Networks   September 2019
What I have to say, is on the Bugs page as these devices should not be exposed on the Internet.

AUGUST 2019

The Wi-Fi networks at WeWork have bad security

WeWork's laughably weak Wi-Fi password is downright dangerous
by Sean Captain of Fast Company   August 21, 2019
WeWork is not even trying when it comes to their Wi-Fi security. The password they use is one of the worst anyone could possibly choose. And, yes, I said the password because they use the same one at multiple locations. The article also dinged them for using WPA2 Personal, which is not really fair. If the password was complex and rotated, this would be fine. That said, if they cared, they would use WPA2 Enterprise rather than WPA2 Personal. Turns out they do care, about making money. The bad Wi-Fi security is used as a lure to sell customers better security for more money. Not mentioned here is that routers can also isolate users from each other, a security feature hardly anyone uses and one that works with WPA2 Personal. Also not mentioned is the DNS environment at WeWork. These things don't come up, typically because the people writing these stories are Art History majors and not familiar with the technology.

Router and IoT firmware still not secure

Huge Survey of Firmware Finds No Security Gains in 15 Years
by Paul Roberts of Security Ledger   August 14, 2019
A study of thousands of device firmwares showed that the security is terrible and has not improved over the last 15 years. The report is from Cyber Independent Testing Lab (CITL), a non-profit organization that conducts independent tests of software security. Their Chief Scientist, Sarah Zatko said "Nobody is trying ... We found no consistency in a vendor or product line doing better or showing improvement. There was no evidence that anybody is making a concerted effort to address the safety hygiene of their products". CITL examined firmware from 18 vendors including ASUS, D-link, Linksys, NETGEAR, Buffalo, Belkin, TP-Link, QNAP, Ubiquiti and others. They did not look at the stuff on my Security Checklist page. Instead they looked a the use of non-executable stacks, Address Space Layout Randomization and stack guards (which prevent buffer overflow attacks). As an example, the ASUS RT-AC55U used none of these security features.

New VPN feature added to AmpliFi

Secure networking is now available to all AmpliFi users anywhere in the world with the AmpliFi Teleport App
by AmpliFi   August 15, 2019
My thoughts on this are on the Mesh Routers page.

Consumer Reports does a poor review of 29 routers

Many Wireless Routers Lack Basic Security Protections, Consumer Reports' Testing Finds
by Nicholas De Leon of Consumer Reports   August 6, 2019
It seems that no matter what computer related topic they cover, Consumer Reports does a poor job. This review of 29 routers is amateurish and, in large part, a waste of time. The advice offered for making any router more secure is less than the short list on the home page of this site. And, no mention of this site? This article does not have the individual router ratings, but I have seen them and they are mostly useless. There is no link here so as not to encourage anyone to read this article. I am working on a long rebuttal. My initial rebuttal is on the Secure Routers page.

Router botnet detected in the Philippines and Thailand

Don't let the crooks 'borrow' your home router as a hacking server
by Paul Ducklin of Sophos   August 7, 2019
SSH (Secure Shell) is the probably the most common program for remotely accessing computers. Your router may be running an SSH server for administrative purposes; perhaps so that your ISP can get into it and make changes. There are multiple ways that bad guys can abuse an SSH server and make money off it. Netlab 360 recently found several hundred Fibrehome routers, model AN5506, in Thailand and the Philippines infected with malware. The malware installed an SSH server on the routers, one that listens on the non-standard port 23455. This appears to be a zombie network of SSH tunnels that the bad guys are holding on to as ready-to-use proxies.

Opting out of Comcast public Wi-Fi in your home

Comcast Xfinity is Using your Router as a Wifi Hotspot, at your Expense. Here’s how to Opt Out.
by G.E. Miller of 20 Something Finance   August 1, 2019
Quoting: "Not only are you paying an outrageous $13 per month ($156 per year) ... to lease a sub-par modem, but Comcast is then using that very same modem that you are being overcharged for to provide the revenue-generating Xfinity WiFi service to other customers ... Disabling or opting your modem out of the Comcast Xfinity public wifi hotspot network is fairly simple on the surface, but there have been reports of customers running into issues, and you may have to periodically re-opt-out. Go here to manage your preferences and 'turn off' ..."

JULY 2019

Disney's Circle Internet filtering reviewed

Can Disney’s Circle really deliver a porn-free Internet?
by Jim Salter of Ars Technica   July 21, 2019
Not directly a router story, but close. Circle is available both as a standalone device or a service embedded in some Netgear routers. This article reviewed the first generation stand-alone device, a second gen model was recently released. Salter much preferred it inside the router. While he felt that Circle's filtering is best of breed, it does have some quirks and it is easier to escape a kids safe sandbox than it should be. Circle judges websites as either all good or all bad. This can be problem when you allow sites that contain both innocent and explicit content (e.g. Reddit, Flickr, Imgur). The external device intercepts all traffic using ARP spoofing. The upside is that it connects to a router the same way every other device does (Ethernet or WiFi). The downside is speed, it slows things down. Some high end switches and routers detect this as an attack and block the Circle device. A reader comment mentioned that it can block all new devices, by default.

Still more DNS server hijacking on Brazilian routers

Brazil is at the forefront of a new type of router attack
By Catalin Cimpanu of ZDNet   July 12, 2019
Avast reported that more than 180,000 routers in Brazil had their DNS settings changed in the first half of 2019. Basically, look at a webpage and your router gets hacked (assuming it has a default password). Malicious DNS servers send victims to scam websites with real names. Or, they replace legitimate ads with ads that are malicious or with ads that make the bad guys money. Multiple groups are doing this. Needless to say, no article on the subject mentioned my Test Your DNS page which is like missing the elephant in the room. Sad.

Yet another Cisco screw-up

Huawei cryptographic keys embedded in Cisco’s firmware
by SEC Technologies   No date
OK, the mistake is in software that runs on switches rather than routers, but close enough. Cisco firmware was found to contain digital certificates and keys belonging to Futurewei Technologies, a US-based R&D arm of Huawei. Yes, Huawei. Turns out Cisco was using a Huawei-made open-source package during testing and forgot to remove it before rolling out the software to the world. Oops. In fairness, this was not a threat to Cisco clients. On the other hand, based on feedback from SEC Technologies, Cisco also removed some unnecessary software and updated third party software, included in their firmware, that had multiple vulnerabilities. Of course, Cisco will focus on the oversight that caused no immediate threat and they not say anything about shipping software with known vulnerabilities. In part, this is a plug for an IoT Inspector service from SEC Technologies. It seems to work.

D-Link agrees to do good stuff

D-Link must suffer indignity of security audits to settle with the Federal Trade Commission
by Max Smolaks of The Register   July 3, 2019
Back in January 2017, the FTC accused D-Link of a long list of shoddy security practices, including, non-removable default passwords in IP cameras, command-injection flaws, leaked router security keys and plain-text password storage in its mobile app. The case was finally settled with D-Link agreeing to do good stuff. They will submit to security audits every two years for the next decade. They pledged to take security seriously for the next 20 years. Of course, they admitted no guilt. Two things stood out to me. First, they agreed to automatic firmware updates. Second, they will tell customers when their routers are no longer getting bug fixes. Quoting from the agreement: At least 60 days prior to ceasing security updates for a Covered Device, a clear and conspicuous notice to consumers who registered their Covered Device, through the communication channel(s) the consumer chose at the time of registration, and a clear and conspicuous notice on the product information page of the Covered Device on Defendant’s website that the Covered Device will no longer receive firmware updates..

JUNE 2019

Apple HomeKit will integrate with some routers

Apple breathes new life into HomeKit with a focus on privacy and security
by Kevin C. Tofel   June 5, 2019
The Apple smart home system, HomeKit, will add support for routers from Linksys, Eero and Spectrum. We don't yet know exactly what this means, there are no specifics. The concept is that smart home devices will be isolated from seeing the full home network (LAN). None of the articles about this mentioned that you can already isolate devices using a Guest Wi-Fi network. For more about isolating devices into Virtual LANs, see the VLAN page right here.

MAY 2019

I ran a test

Barbarians at the gate - Attacks/Probes of a router
by me   May 28, 2019
For a day, I left my router open to incoming connections looking for Microsoft Remote Desktop. There were 62 attacks/probes looking for a Windows machine to remotely control. The probes came from 20 different countries and from 7 different states in the US. One service, one day. Router security matters.

An unspecified brand of routers is being hacked to install malware on PCs

Hackers abuse ASUS cloud service to install backdoor on users' PCs
by Dan Goodin of Ars Technica   May 16, 2019
According to Eset, bad guys are abusing an ASUS self-update mechanism for their WebStorage software to install Windows malware. Eset believes (but can't be 100% sure) that the attacks are the result of router based man-in-the-middle interception that exploits HTTP connections to ASUS servers. Of course, the HTTP is on Asus, not the router. Also on Asus is incomplete code-signing to validate the authenticity of downloaded files. Eset found that most of the organizations that were hacked were using routers made by the same manufacturer, which they declined to identify. The routers have their web admin interface exposed to the Internet, security mistake number 7 on the short list on the home page of this site. Get a Chromebook.

A new take on Router Security

Airbnb host thrown in the clink after guest finds hidden camera inside Wi-Fi router
by Kieren McCarthy of The Register   May 8, 2019
I did not see this coming. A router in an Airbnb in China was found to have a peephole drilled into the front of it, right next to the LEDs that indicate Ethernet activity. The hole looked very much like the Ethernet LEDs. Blending in with the crowd. The hole was connected to a camera that was inside the router.

Still another Critical Cisco bug

Sinister secret backdoor found in networking gear perfect for government espionage: The Chinese are – oh no, wait, it's Cisco again
by Iain Thomson of The Register   May 2, 2019
This bug is as bad as bad gets. An unauthenticated, remote bad guy can connect to the buggy devices as the root user. The NSA must have loved this one. The issue is a default SSH key pair. Bad guys only need to open an SSH connection via IPv6 to a vulnerable device using the SSH key pair to get root access to the system. In summary: BACKDOOR. BACKDOOR. BACKDOOR. This was discovered and reported by Oliver Matula of ERNW Enno Rey Netzwerke. Be sure to scroll down this page for other brutal flaws in Cisco software. Cisco also fixed 22 high severity bugs and 18 considered medium severity. Seem like lots of bugs to you?

APRIL 2019

Me on using a router to defend against IoT and Windows 10

Why I like my router
by Michael Horowitz   April 26, 2019
Tracing network activity to see if you have a vulnerable IoT device. Blocking vulnerable and insecure IoT devices. Defending against Windows 10 spying with DNS.

DNS changing attacks on consumer routers

Ongoing DNS hijackings target Gmail, PayPal, Netflix, banks and more
by Dan Goodin of Ars Technica   April 5, 2019
As long there are consumer routers that don't self-update or have been abandoned (no more bug fixes) this hardly qualifies as news. That said, yet again, bugs in consumer routers are being exploited to configure the routers with malicious DNS servers. As always, the malicious DNS servers send victims to scam copies of real websites. For some reason, the fact that the malicious DNS servers, in this case, were hosted by Google seems noteworthy. It is not. Most of the buggy routers are from D-Link, again, not news. They are the D-Link DSL-2640B, DSL-2740R, DSL-2780B, DSL-526B and 260E. In addition, some routers from Secutech and TOTOLINK were attacked. The true disgrace here is the reporting about this from people that do not really understand the topic. As a result, the defensive measures offered by Ars Technica and ZDNet are, to be kind, sub-optimal. Looking for Extended Validation certificates, for example, is not mentioned. Heck, the scam sites in this case are particularly low rent, served over HTTP, so just looking for DV certificate would be sufficient defense. And, I have a list here of many websites that report on your DNS servers. Using them avoids the need to log in to the router which too many people are unable to do. And trusting router vendors to fix flaws, the knee jerk reaction, is being unjustifiably optimistic. In Google's case it is shifting blame too.

Excellent router security article

TP-Link router zero-day that offers your network up to hackers
by Paul Ducklin of Sophos   April 2, 2019
An excellent article about router security. As the title suggests, the focus of the article is the recently disclosed flaw in a TP-Link router, but the article is a worthwhile read for everyone as it includes a defensive strategy against ISP supplied devices. And, it is another example of a consumer router company not caring about security.

MARCH 2019

Huawei clearly does not care about router security

Huawei bungled router security, leaving kit open to botnets, despite alert from ISP years prior
by Gareth Corfield of The Register   March 28, 2019
This is something we have seen before from router vendors. Huawei routers had a known bug and the company fixed the bug in some of their routers but not all of them. Do the least amount of work possible to make the spotlight go away. An ISP told Huawei about a trivially exploitable remote code execution flaw back in 2013. The bug meant that the HG523a and HG533 routers/gateways could be hijacked by bad guys. Huawei fixed the vulnerability sometime in 2014. However, other Huawei devices in the HG series, suffered from the same flaw and remained vulnerable for years. The bug, in UPnP, was discovered, yet again, years later. Again, a patch was issued. This article leaves out an important point. The bug in the UPnP software is only half the story. That UPnP is exposed to the Internet, is actually a larger flaw. This too, goes back to 2013.

Cisco yet again, again

RedTeam Pentesting
On March 27, 2019, German security firm RedTeam Pentesting issued three advisories about bugs in the Cisco RV320 Dual Gigabit WAN VPN Router. The biggest severity is to Cisco's reputation. These bugs were initially identified in September 2018, and the first three advisories about them were released Jan. 23, 2019. Cisco issued fixes, but, the fixes were flawed. These routers were reported being attacked in January 2019 - there is a summary of this below on this page.

Talos finds 11 flaws in Cujo not-so smart firewall

Vulnerability Spotlight: Multiple Vulnerabilities in CUJO Smart Firewall, Das U-Boot, OCTEON SDK, Webroot BrightCloud
by Cisco Talos   March 19, 2019
Cujo sits between your router and modem (logically or physically) and offers security protection (but no privacy protection). The device contains 11 bugs. In the worst case, the bugs could allow attackers to take complete and permanent control of the Cujo. All the bugs have been fixed and Cujo should auto-update. The Cujo website says nothing about this. Consider that when deciding whether to trust them.

Router advice from Readers Digest is just as bad as you would expect

This Is How Often You Should Be Rebooting Your Router
by Erin Kayata of Readers Digest   no date
Really? Router advice from Readers Digest? On the upside, it's not all bad. Re-booting a router can't hurt and, as the article says, its a good thing to do when there are problems. Also, there is some malware on routers that is removed by rebooting. But, an expert claims rebooting will fix slow Wi-Fi. Things go further downhill with the author claiming that regularly turning a router on and off makes for "a faster connection." And, if witches are haunting the router, rebooting gets rid of them (just joking). The article says that rebooting can "prevent yourself from being hacked" which is not true. The ultimate heap of baloney is this: "According to Consumer Reports, your Internet provider assigns a temporary IP address to each of your devices which can change at any time. If your router doesn’t catch the change, your connection can become slow." My joke about haunted witches is closer to the truth.

Another company buying router bugs

As Phones Get Harder to Hack, Zero Day Vendors Hunt for Router Exploits
by Joseph Cox of Motherboard   March 7, 2019
Obtaining vulnerabilities for mobile phones is getting harder, so companies that sell exploits are increasingly looking for attacks that target routers instead. The article is mostly about Crowdfense which buys zero day exploits from researchers and sells them to government agencies. They are now offering a total of $15 million to hackers with exploits for sale which includes up to $100,000 for router attacks. Zerodium does the same thing, see the January 2019 section below.

FEBRUARY 2019

Cisco yet again

Management Interfaces in Three Models of Cisco Networking Devices Are Vulnerable to RCE Attacks
by Ryan Seguin of Tenable   February 27, 2019
This is as bad as bad gets. Quoting: "Cisco has released a security advisory for CVE-2019-1663, a remote code execution (RCE) vulnerability present in the remote management interface on certain router and firewall devices, the RV110W, RV130W, and RV215W. The vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code through malicious HTTP requests." Patches have been released. To be remotely hacked the routers must have remote administration enabled and it is disabled by default. The bug is critical, yet it was first discovered October 25, 2018. The delay in issuing a fix strikes me as much too long. These are old devices. For example, the RV215W was reviewed by PC Magazine in January 2013 and the review noted it did not have gigabit Ethernet and Wi-Fi was only on the 2.4 GHz band.

JANUARY 2019

Two buggy Cisco routers are being attacked

Hackers are going after Cisco RV320/RV325 routers using a new exploit
by Catalin Cimpanu of ZDNet   January 27, 2019
Bad guys are trying to exploit two just-patched flaws in two Cisco routers. The patches were released on January 23, 3019. Proof of concept code to exploit the bugs was released the next day. The day after that, the attacks started. The first flaw (CVE-2019-1653) lets an attacker get device configuration details without a password. The flaws exist on both the LAN and WAN side. The second bug (CVE-2019-1652) allows an attacker to run admin commands on the device, again without a password. Here too, the articles I read did not say if this bug is LAN or WAN side, or both. It is estimated there are 6,247 vulnerable Cisco RV320 routers, and 3,410 vulnerable Cisco RV325 routers. The vast majority of them are on the networks of US based ISPs. More information about the bugs is on the Bugs page. The RV320 was first released in June 2013. It now sells for about $140. It is dual WAN and supports SSL, PPTP and IPSec VPNs. No Wi-Fi. The true takeaway, for me, is whether Cisco is a trustworthy router vendor. Earlier this month, there was this story: Cisco warns: Patch now or risk your security appliance choking on single rogue email and they seem to have lots of bugs: Cisco Security Advisories and Alerts.

Japanese government to do some hacking

Japanese government plans to hack into citizens' IoT devices
by Catalin Cimpanu of ZDNet   January 27, 2019
Me: The article starts in the middle, not the beginning. On a secure network, the IoT devices can not be accessed from the Internet. While IoT devices need to make outgoing connections, they should not be allowed to accept unsolicited incoming connections from every bad guy in the world.
Article summary: The Japanese government has authorized its employees to hack into IoT devices in Japan find insecure ones. They will start looking for routers with default passwords and common passwords. The Japanese are worried about the Summer Olympics in Tokyo 2020, specifically that hackers might abuse IoT devices to launch attacks against the Olympics.
Me: This is a good thing to do, but it will not protect the Olympics - attacks can be launched from anywhere. You can test your our own router using the many tests on my Router Tester page. You can also see what the outside world has found on your public IP address on my Shodan page.

Clickbait from Wired

Your old router is an absolute goldmine for troublesome hackers
by Amit Katwala of Wired UK   January 14, 2019
I consider this article is clickbait, not because of any exaggerations or lies, but because of its focus on the bad stuff. Hair on fire and all that. It omits defensive steps people can take, steps that are the sole reason for this website. In fact, it omits me, after I was interviewed by email by the author. And, great editing: "ISPs could be doing more to educate, for example by regular email bulletins to provide guidance and firmware updates, but that could potentially users them vulnerable to phishing scams." All that said, things are indeed bad.

Maybe avoid router brands targeted by Zerodium?

How to Sell Your 0day Exploit to ZERODIUM
by Zerodium
Quoting: "ZERODIUM is the leading exploit acquisition platform for premium zero-days and advanced cybersecurity capabilities. We pay BIG bounties to security researchers to acquire their original and previously unreported zero-day research ... at ZERODIUM we focus on high-risk vulnerabilities with fully functional exploits and we pay the highest rewards (up to $2,000,000 per submission)." They pay for bugs in these brands of routers: ASUS, Cisco, D-Link, Huawei, Linksys, MikroTik, Netgear, TP-Link, and Ubiquiti. Perhaps, using a different brand makes you safer? It is always better to be a lesser target.

Spectrum/Charter to start using Cujo in 2019

Charter Communications Goes With CUJO AI For Customer Security and Privacy
by Julio Urquidi   January 8, 2019
There is, as yet, no meat on the bones of this story. Still, a Spectrum executive said it will provide "... Spectrum Internet customers advanced security, privacy and additional control over their in-home networks..." Being lied to is commonplace, so no surprise, that it will reduce privacy not increase it. And, customers have all the control they could possibly want as things stand since Spectrum lets you replace all their hardware with your own. Even using their hardware, they do not (as far as I know) prevent customers from making configuration changes to the router/gateway they provide. My brief take on Cujo is on the Resources Page.

Avast report says the worst router attacks are still to come

Hacking attacks on your router: Why the worst is yet to come
by Danny Palmer of ZDNet   January 3, 2019
Avast issued a report with predictions for 2019 and this article summarizes the router section. Quoting: "Cyber criminals are only scratching the surface when it comes to exploiting vulnerabilities in routers ... and the worst is yet to come, with attackers set to use compromised devices for a wider variety of malicious activities." Some reasons why: VPNfilter was real bad. People don't update router firmware. People ignore routers and won't know if theirs gets hacked. Poor passwords and default passwords. Malware source code has leaked so anyone can use it. The defensive advice offered by the FBI is lame.

Exposed router ports attacked yet again

Hacker Streaming PewDiePie Videos on Exposed Chromecast Devices
by Lawrence Abrams of Bleeping Computer   January 2, 2019
A new hacking campaign is targeting Chromecast adapters, Smart TVs, and Google Home. At the moment, the attackers are merely playing a video urging victims to subscribe to a YouTube channel. Pretty harmless. However, the attacks could turn mean very easily. According to a website the attackers created, they can remotely play media on your device, rename your device, factory reset it, reboot it, force it to forget all wifi networks, force it to pair to a new Bluetooth speaker/wifi point. In addition, exposed devices leak information: the current WI-Fi network name, saved Wi-Fi networks, the bluetooth devices an exposed device has paired with, the alarms that are set, and much more. The hackers claim they were able to retrieve approximately 123,000 vulnerable devices using Shodan, with 100,000 actually being accessible. The exposed TCP ports are 8008, 8009, and 8443, which are normally used for management functions.

2018   top

DECEMBER 2018

Brutal bug in Orange routers reveals Wi-Fi passwords to anyone

Over 19,000 Orange modems are leaking WiFi credentials
By Catalin Cimpanu of ZDNet   December 24,2018
Nearly 19,500 Orange Livebox ADSL gateways are leaking their WiFi SSID and password to a remote unauthenticated users. An attacker is exploiting a vulnerability (CVE-2018-20377) that was first described in 2012. Yes, 2012. All the bad guys have to do is request the URL get_getnetworkconf.cgi. What a disgrace. Most of the vulnerable devices are assigned to customers in France and Spain.

Netgear router fails to find updated firmware

Security Now Podcast Episode 694
by Steve Gibson of grc.com   December 18, 2018
Gibson read a letter from a listener who was having poor Wi-Fi performance on a Netgear router. The router said the installed firmware was the latest, but eventually, the listener checked the Netgear website and, sure enough, there was updated firmware. Installing the update restored the Wi-Fi performance. The question this raises, is whether the router was infected with malware which blocked it from reporting newer firmware. Had the listener read the Ongoing Care and Feeding section on the home page of this site, he would have rebooted the router periodically just for good luck. Rebooting clears up many malware infections.

A very different take on router security

A look at home routers, and a surprising bug in Linux/MIPS
by Parker Thompson, Sarah Zatko, Mudge Zatko of Cyber Independent Testing Lab   December 7, 2018
Quoting: "At Cyber-ITL, our mission is to empower consumers to protect themselves by reporting on the security of popular products. We reviewed 28 popular home routers for basic hardening features. None performed well ... We analyzed the firmware images of 28 popular home routers, checking for basic code hygiene and software safety features. What we found was disappointing: none of the routers made consistent use of basic software safety features like ASLR, stack guards, and DEP - features which have been standard in desktop environments for over 15 years ... These findings suggest an industry-wide failure to audit and test the security of the software running on these products. Indeed, our review shows that even the most basic practices are being largely ignored. The absence of these security features is inexcusable: the features discussed in this report are easy to adopt, come with no downsides ... while none of the routers we reviewed scored well, the Linksys WRT32x scored the best ... there is little consistency in terms of security practices even within the models of the same brand ... this poor showing implies an apathetic attitude towards applied consumer safety and security..." It is not clear to me just how important these features are. As I understand them, they defend the OS from attack by malware. However, a router is not a general purpose OS. The only software running on the router is software provided by the hardware manufacturer. No one runs a web browser on their router.

NOVEMBER 2018

Yet another way to abuse UPnP

Hackers are opening SMB ports on routers so they can infect PCs with NSA malware
by Catalin Cimpanu of ZDNet   November 28, 2018
UPnP has been a problem for routers for years. It is one of the first things that should be disabled. UPnP was only meant to be used on a Local Area Network but the morons that program many routers exposed it on the Internet. Its like a doctor operating on the wrong leg. Routers that expose UPnP to the Internet have been abused time and time again. In this latest twist, bad guys are re-configuring the router to allow them access to shared folders on a victim's network. They are attacking and abusing Windows file sharing that runs on TCP ports 139 and 445 (among others). Akamai detected this malware campaign and they call it EternalSilence. They report that of the 277,000 routers with vulnerable UPnP services exposed online, 45,113 have been compromised this way. As if copying all the shared files wasn't enough, by exploiting assorted bugs, this type of access can also infect both Windows and Linux computers with malware. Akamai said "Administrators will have problems detecting the malicious NAT injections, as there is no administrative visibility into them on an injected router." I have my doubts about that as I have seen routers expose this type of information. They also say: "The best way to identify if a device is vulnerable or actively being leveraged for UPnProxying is to scan an end-point and audit it's NAT table entries," but it is not clear if this scanning is done from the LAN side or the WAN side. Frankly, the suggested defensive steps from Akamai are useless. And neither the ZDNet, Register or Ars articles add anything of value. Port forwarding requires knowledge of the LAN side subnet. It is not clear if the bad guys can learn this from the router or if they merely guess at default values.

Germany weighs in on Router Security

Germany pushes router security rules, OpenWRT and CCC push back
by Richard Chirgwin of The Register   November 20, 2018
"Last week, in a attempt to address broadband router security, the German government published its suggestions for minimum standards – and came under immediate criticism that its proposals didn't go far enough." The rules are guidelines for manufacturers, they are not enforceable laws. This site has guidelines for everyone else. Vendors that adhere to the guidelines can indicate this with a sticker on their routers. The German Federal Office for Information Security (BSI), said the guidelines were the result of consultations with vendors, network operators, and consumer advocates. Hard to imagine more of a consumer advocate for router security than me. I was not contacted. Among their suggestions that are slightly off the beaten path: Guest Wi-Fi networks should not have access to device configuration, factory resets should put the router into a secure state, and all personal data should be deleted during a factory reset. The Chaos Computer Club (CCC) and OpenWrt both felt the guidelines did not go far enough and demanded that: "Vendors have to inform customer before buying the product for all devices being sold in Germany, how long the device will get security updates in case problems are found" and "the customer must have the possibility to install custom software on their devices..." There will always be some disagreement, but this is a first step, one that no other country has taken.

Let us not forget bad D-Link security

Uncle Sam, D-Link told to battle in court over claims of shoddy device security: Judge snubs summary judgment bids
by Richard Chirgwin of The Register   November 6, 2018
The Federal Trade Commission (FTC) filed a lawsuit against D-Link in January 2017 complaining of assorted bad security practices, including hard-coded passwords, command-injection vulnerabilities, misplaced security keys, and plaintext password storage. They claim there was misrepresentation because D-Link touted the advanced security of its products. More below. The legal battle is going to trial on January 14, 2019.

A large router botnet thanks to a 5 year old bug

IoT botnet infects 100,000 routers to send Hotmail, Outlook, and Yahoo spam
by Catalin Cimpanu for ZDNet   November 7, 2018
The past two months have seen the rise of the new BCMUPnP_Hunter botnet composed of roughly 100,000 home routers. Analyzed by the Netlab team at Qihoo 360, the botnet exploits a five-year-old bug in the Broadcom UPnP SDK which is embedded in thousands of router models from multiple vendors. The vulnerability is as bad as bad gets, a remote un-authenticated attacker can execute malicious code the router. The botnet scans for routers with an exposed UPnP interface on port 5431. The botnet is sophisticated and newly programmed by someone quite good at their craft. Infected routers both send SPAM and function as proxy nodes to hide the location of the bad guys.

OCTOBER 2018

Routers hacked in Poland to send SMS messages

The camera makes fun of the SMS bill
by CERT Orange Polska   October 31, 2018
Assorted devices, including routers, that use SIM cards for Internet access were hacked to send SMS messages to foreign countries, earning the bad guys money from the SMS termination. Some hacked devices were: D-Link DWR-921 4G LTE routers, Teltonika RUT240 industrial routers, Dahua CCTV devices (disputed) and Digi modems. It is thought that the devices were vulnerable because of default passwords. The D-Link DWR-921 router also has a known Directory Traversal bug that lets attackers download a configuration file with a unencrypted passwords. This router will not be fixed by D-Link and it suggested to throw them away. Both articles are in Polish but Chrome translation is good enough to get the gist.

Hacker takes pity on MikroTik routers

A mysterious grey-hat is patching people's outdated MikroTik routers
by Catalin Cimpanu of ZDNet   October 12, 2018
In fairness to MikroTik they have been patching reported bugs quickly. However, its no surprise, that their customers do not install the patches. A lone person has taken pity on unpatched MikroTik routers and is patching them so they can not be abused by bad guys. Using the name Alexey, this person has bragged about this on a Russian blogging platform. He adds firewall rules that block access to the router. On this site, the Test Your Router page links to many online services that test your router for open TCP/IP ports. The same for the Shodan page. The worst bug (CVE-2018-14847) was patched in April 2018. It lets a bad guy download the user database file. Once decrypted, this gives bad guys access to the username/password to log in remotely. Alexey claims to have patched over 100,000 MikroTik routers. To put this in perspective, there are over two million MikroTik routers in use and over 420,000 show signs of infection. Bad guys who are installing malware on these routers are not closing WAN side ports, so they can still be modfiied.

Xiongmai video surveillance devices are extremely insecure

Using a router to defend against Xiongmai video devices
by Michael Horowitz (me)   October 10, 2018
OK, the Xiongmai devices in question are not routers. But, they are so terribly insecure that security firm SEC Consult recommends throwing them in the trash. In contrast, I suggest a number of ways to isolate them while continuing to use them despite their many security issues. My suggestions can apply not just to Xiongmai devices but to all insecure IoT devices.

MikroTik devices must be patched

October 7, 2018: RouterOS from MikroTik was patched with the latest bug fixes at the end of August and in September (they maintain different branches of their firmware). Four bugs that were just patched were found by Jacob Baines of Tenable Research. And, a bug that was patched back in April 2018 was much more serious than previously believed. Only 30% of MikroTik devices have been patched. Details are on the Bugs page. New attacks will surely follow.

Good news

Netgear sent me an email message, informing me of the availability of new firmware for the EX3800 range extender. The email included a link to How do I upgrade firmware on my NETGEAR WiFi Range Extender? Well done.


SEPTEMBER 2018

GhostDNS, yet another DNS changing router attack

70+ different types of home routers(all together 100,000+) are being hijacked by GhostDNS
by Netlab 360   September 29, 2018
Starting September 20, 2018, Netlab noticed an existing malware campaign ramp up its attacks with new scanners. Radware blogged about this campaign back in August (2018), but Netlab says it goes back even further. They call it GhostDNS and it now attacks more than 70 different routers. They have seen it infect over 100,000 routers, so far. Malicious DNS servers are used to send victims to fake/scam versions of websites. Rather than using a similar domain name (citibank.edu instead of citibank.com) users deal with the real domain name but are directed to a scam site nonetheless. They have observed GhostDNS targeting at least 52 domains so far, including major banks, telcos, ISPs, media outlets, Avira and Netflix. The GhostDNS malware campaign consists of: Shell DNSChanger, Js DNSChanger, PyPhp DNSChanger, a Phishing Web System, a Web Admin System and a Rogue DNS System. There are over 100 attack scripts. Routers are attacked from both sides, from the WAN and from the LAN. 88% of infected routers are in Brazil. Some companies making vulnerable routers are D-Link, Tenda, TP-Link, Roteador and (of course) MikroTik. The full list of known vulnerable routers is in the blog posting. Netlab 360 has been working to take components of GhostDNS off-line. The best defense against all types of DNS attacks is to be familiar with and look for indications that a website uses Extended Validation.

A sophisticated botnet with no obvious purpose

Torii botnet - Not another Mirai variant
by the Avast Threat Intelligence Team   September 27, 2018
The Telnet honeypot of security researcher Vess On Security was attacked by a new botnet coming from Tor exit nodes. Hard to imagine that devices still leave themselves exposed to Telnet. The malware contains unprecedented levels of sophistication, yet it has has no obvious purpose. It can exfiltrate data in quite a few different ways and supports multiple layers of encrypted communication. While it phones home on TCP port 443, this is deceptive because it does not use TLS. While most IoT malware is flushed when the device reboots, Torii uses six different methods to maintain persistence. The malware is modular in design and can infect devices running MIPS, ARM, x86, x64, PowerPC, and SuperH, among others.

Still more about VPNfilter

Researchers find Russian VPNfilter malware was a Swiss Army hacking knife
by Sean Gallagher of Ars Technica   September 26, 2018
Reminder of old news: VPNfilter had been detected on a half million routers in 54 countries. And, it is the rare malware that survives a reboot of the router.
New news: The VPNfilter router malware is worse than originally thought. New features were discovered that exploit the entire network connected to the infected router. Run for the hills. Or, better yet, run away from consumer grade routers. The newly discovered features are: inspect and redirect HTTP traffic passing through the router, SSH client, SSH server, file transfers using the SCP protocol, nmap port scanner, network reconnaissance from the hacked router, scan for Mikrotik devices, a firewall, port forwarding to an outside network, a SOCKS5 virtual private network proxy server that runs on TCP port 5380, a Reverse-TCP VPN that connects the hacked router to the bad guys over a VPN (used to both steal data and for remote command and control). Quoting: "VPNfilter was clearly built for long-term use as a network exploitation and attack platform." Keep in mind, that this is, in part, an advertisement for Talos themselves. These quotes illustrate my point:
"The sophistication of VPNFilter drives home the point that this is a framework that all individuals and organizations should be tracking. Only an advanced and organized defense can combat these kinds of threats, and at the scale that VPNFilter is at, we cannot afford to overlook these new discoveries."
  and
"The sophisticated nature of this framework further illustrates the advanced capabilities of the threat actors making use of it, as well as the need for organizations to deploy robust defensive architectures to combat threats such as VPNFilter."
Also proving my point is that the blogs from Talos are very short on defensive measures. No mention of this website, you can be sure. Just new stuff for Snort and Clam. If you don't know how to use these tools, then I am sure Talos can help. They released a program to decrypt the Winbox protocol and failed to mention that Mikrotik fixed the bugs, so all anyone has to do is install the latest firmware. They did not offer the link below to test port 5380.

Buggy routers have an average of 186 bugs each. Not a typo.

You can't secure your network without securing your routers - and your users' routers
by David Braue of CSO Online   September 27, 2018
Quoting: "The American Consumer Institute Center for Citizen Research conducted an audit of 186 Wi-Fi routers from 14 different manufacturers, using Insignary’s Clarity application to scan the embedded firmware for unpatched security vulnerabilities. Fully 83 percent of examined routers were found to have known vulnerabilities in their code, with an average of 186 vulnerabilities per router ... the report warned that vendors' frequent usage of open-source code had left many routers exposed." The article cites a trifecta of problems: lots of new vulnerabilities being discovered, router manufacturers often-slow response in fixing these bugs and, of course, router owners who typically don't update the router firmware. Testing was done in July 2018 on the latest firmware for each router, so the real world situation is certainly worse. Only 31 routers had no bugs and they were not identified. I don't know who the American Consumer Institute is and I am always skeptical of a report without an author. There is a chance that this is a disguised press release for Clarity. That they don't mention the good routers also points to this being an ad disguised as a study. And, in the days after the study was released, they blogged about every story in the media that mentioned the study. Just what you would do if the study was really an advertisement.

MikroTik routers attacked abusing bugs with available fixes

Unpatched routers being used to build vast proxy army, spy on networks
by Sean Gallagher of Ars Technica   September 5, 2018
Researchers at Netlab 360 have discovered that thousands of MikroTik routers have been compromised by malware attacking a vulnerability first revealed April 2018. MikroTik issued a fix back in April, but more than 370,000 MikroTik devices are online and still vulnerable. Of those, more than 7,500 are actively being spied on by attackers. The spying is done by forwarding a copy of network traffic to a bad guy. This is done using the built-in packet-sniffing capabilities of MikroTik routers. The sniffer, which uses the TZSP protocol, can send a stream of packets to a remote system using Wireshark or other packet capture tools. The vast majority of the packet capture streams were being sent to an IP address in Belize. Also, 239,000 of MikroTik devices have been turned into SOCKS 4 proxies. The malicious proxy network is using the non-standard TCP port 4153. It is not clear what the proxies are being collected for, but they are continuously scanning for other vulnerable routers.

Lots of Cisco bugs

Cisco Releases 16 Security Alerts Rated Critical and High
by Ionut Ilascu of Bleeping Computer   September 5, 2018
Cisco published 30 security advisories on vulnerabilities in its products. Half of the bugs are considered high or critical severity. Three are security problems with critical impact. One critical bug affects the RV-series firewalls and routers, specifically RV110W Wireless-N VPN Firewall, RV130W Wireless-N Multifunction VPN Router, and the RV215W Wireless-N VPN Router. The two routers and the firewall are also vulnerable to directory traversal (CVE-2018-0426), command injection (CVE-2018-0424) and information disclosure (CVE-2018-0425) bugs, all having a high severity.

Yet another botnet

New Hakai IoT botnet takes aim at D-Link, Huawei, and Realtek routers
by Catalin Cimpanu for ZDNet   September 3, 2018
A new botnet, Hakai, was first spotted in June 2018. Then, in July, it started to exploit a vulnerability in Huawei HG352 routers (CVE-2017-17215). By mid-August it was targeting more devices and vulnerabilities. Hakai now goes after three different bugs in D-Link routers, one of which involves HNAP. D-Link routers that support HNAP do not let you disable it, but D-Link is moving away from HNAP so anyone with a D-Link router should look for new firmware as it might eliminate HNAP. It also targets Realtek routers and IoT devices using a vulnerable version of the Realtek SDK where the miniigd SOAP service allows remote attackers to execute arbitrary code on the device using a malicious NewInternalClient request. The article does not offer any way of detecting if a specific IoT device is vulnerable or not. The botnet also targets Telnet looking for devices with the port open and simple or default passwords. The Hakai codebase also seems to have leaked as there are two different Hakai-based botnets, Kenjiro and Izuku, spreading online. The article says nothing about what the botnet does to the routers that it infects. It also says nothing about what an infected router might do to the rest of us.

AUGUST 2018

The NSA used hacked routers to help decrypt VPNs

NSA Cracked Open Encrypted Networks of Russian Airlines, AL Jazeera, and Other "High Potential" Targets
by Micah Lee of The Intercept   August 15, 2018
The article is about VPNs, but it included a point about using compromised routers to assist in breaking VPN traffic: "In 2014, The Intercept reported on the NSA's plans, dated August 2009, to use an automated system called TURBINE to covertly infect millions of computers with malware. The revelations described a piece of NSA malware called HAMMERSTEIN, installed on routers that VPN traffic traverses. The malware was able to forward VPN traffic that uses the IPSec protocol back to the NSA to decrypt."
The March 2014 article by Ryan Gallagher and Glenn Greenwald referred to here, said this about routers: "The NSA has specifically tailored some of its implants to infect large-scale network routers ... By compromising routers ... the agency can gain covert access to monitor Internet traffic, record the browsing sessions of users, and intercept communications. Two implants the NSA injects into network routers, HAMMERCHANT and HAMMERSTEIN, help the agency to intercept and perform "exploitation attacks" against data that is sent through a Virtual Private Network..." The article also pointed out that the NSA uses hacked routers to deliver malware to targeted machines.

D-Link routers in Brazil hacked to change DNS servers

In-the-wild router exploit sends unwitting users to fake banking site
by Dan Gooding of Ars Technica   August 10, 2018
A flaw or flaws in D-Link gateways (a gateway is a combination modem and router) allows bad guys to remotely change the DNS server that the routers tell connected devices to use. DNS translates domain names, such as RouterSecurity.org into numeric IP addresses. All computer communication is based on numeric IP addresses. A small number of techies may hard code DNS servers into their computing devices, but the vast majority of computing devices use the DNS servers assigned to them by the router. A malicious DNS server will translate the name of a bank into the wrong IP address, one that hosts a scam version of the banking website. If a victim logs in to the scam website, the bad guys learn their banking password. According to Radware, bad guys have been using malicious DNS servers to send potential victims to scam versions of two Brazilian bank websites, Banco de Brasil and Unibanco. The web browser will display the correct banking URL while at the scam website, but the use of extended validation certificates should indicate that the displayed site is a scam. I checked. Both banks do use EV certificates so an educated user would not be fooled. Also, the browser should issue a warning about the self-signed certificate used by the scam sites. Known vulnerable D-Link devices include the DSL-2740R, DSL-2640B, DSL-2780B, DSL-2730B, and DSL-526B. Also, the Shuttle Tech ADSL Modem-Router 915 WM. These attacks were first noticed by Radware on June 8, 2018. The bugs being exploited date back to 2015 and have since been fixed. Vulnerable devices can be hacked without any interaction from the end user. In large part the bugs stem from the web interface being available to LAN side devices without authentication. Finally, Goodin claims that specifying your own DNS servers on your computing device over-rides those in the router. This is not always true, certainly not true with my favorite router the Pepwave Surf SOHO.

The Sky is NOT falling

New Method Simplifies Cracking WPA/WPA2 Passwords on 802.11 Networks
by Lawrence Abrams of Bleeping Computer   August 6, 2018
This story is sad. The news is trivial, so much so, as to be almost irrelevant. Yet, every outfit did a story that the sky is falling. Not even Steve Gibson was able to put this in perspective and point out how un-important it was. The tech press is truly disgraceful. Consider this statement from the normally reliable Bleeping Computer site "While previous WPA/WPA2 cracking methods required an attacker to wait for a user to login to a wireless network and capture a full authentication handshake, this new method only requires a single frame which the attacker can request from the AP...". The fact is that Wi-Fi attackers never had to wait, they could force any and all currently connected devices off the network. Pretty much any Wi-Fi device would then try to log back in automatically. In fairness, this was a rare article to mention that this newly discovered technique "does not make it easier to crack the password for a wireless network." Many articles outright lied about this. And, some articles mentioned that the new technique only works on routers that have a certain feature enabled. No one bothered to research which routers have that feature enabled. That's not sexy. Have any router companies commented on which, if any of their routers are vulnerable to this new attack? One article had a quote from Eero saying that none of their devices are vulnerable. No one bothered asking any other router vendors. Eero did not publish anything on their website. And, finally, to put this in perspective, let us not forget that Google knows nearly every Wi-Fi password in the world as I blogged back in 2013. And, if Google knows it, the US Government can compel them to turn it over. No hacking needed.

Back to bad news - MikroTik routers at ISPs hacked

Mass MikroTik Router Infection – First we cryptojack Brazil, then we take the World?
by Simon Kenin of Trustwave   August 1, 2018
Quoting: "I noticed a huge surge of CoinHive in Brazil. After a quick look I saw that ... these were all MikroTik network devices ... all of these devices were using the same CoinHive sitekey, meaning that they all ultimately mine into the hands of one entity ... the attacker indeed mainly focused on Brazil ... MikroTik routers are used by Internet providers and big organizations, and in this case it seem that the Reddit post's author's ISP had their router compromised ... the exploit was for a vulnerability patched by MikroTik on April 23rd (2018) .... using this exploit you can get unauthenticated remote admin access to any vulnerable MikroTik router ... the attacker used the device's functionality in order to inject the CoinHive script into every web page that a user visited ... This is a warning call and reminder to everyone who has a MikroTik device to patch as soon as possible, this attack may currently be prevalent in Brazil, but during the final stages of writing this blog, I also noticed other geo-locations being affected as well ... Let me emphasize how bad this attack is. The attacker wisely thought that instead of infecting small sites with few visitors, or finding sophisticated ways to run malware on end user computers, they would go straight to the source; carrier-grade router devices. There are hundreds of thousands of these devices around the globe, in use by ISPs and different organizations and businesses ..." This is, to me, a new type of bad. Any website sitting behind a hacked MikroTik router may deliver malware. One thing does not makes sense in this report. Kenin says that all web page passing through an infected router get modified, but, TLS should protect web pages from being modified in-flight.

New thing here - some good news

OpenWrt 18.06 released (Linux OS for your router, first major update in years)
by Brad Linder of Liliputing   August 1, 2018
Quoting: "OpenWrt is an open source, Linux-based operating system designed to run on hundreds of routers and other embedded devices. It can add new features to your networking gear and give you more control over the software running on the hardware in your home. This week the developers released OpenWrt 18.06, which is a big step for a couple of reasons." Some changes: Spectre and Meltdown mitigations, improved firmware upgrade procedure, auto rollback functionality, new Linux kernel, an updated toolchain, some type of support for Wireguard VPNs, and, of course, bug fixes.

JULY 2018

Bank fails to use VLANs

Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M
by Brian Krebs in Krebs on Security   July 24, 2018
Hackers used phishing emails to break into The National Bank of Blacksburg in Virginia bank - twice. In May 2016, "The email allowed the intruders to install malware on the victim’s PC and to compromise a second computer at the bank that had access to the STAR Network, a system ... that the bank uses to handle debit card transactions for customers. That second computer had the ability to manage National Bank customer accounts and their use of ATMs and bank cards. Armed with this access, the bank says, hackers were able to disable and alter anti-theft and anti-fraud protections, such as 4-digit personal identification numbers (PINs), daily withdrawal limits, daily debit card usage limits, and fraud score protections." This first break-in cost the bank $569,000. The second break-in was in January 2017. "This time not only did the intruders regain access to the bank’s STAR Network, they also managed to compromise a workstation that had access to Navigator, which is software used by National Bank to manage credits and debits to customer accounts ... the hackers used the bank’s Navigator system to fraudulently credit more than $2 million to various National Bank accounts." Most of the article is about a lawsuit between the bank and its insurance company. Boring. Clearly the problem here is network segmentation or VLANs. No employee should be reading email messages on a computer that has network access to the core banking systems.

Port 5555 being attacked

Open ADB Ports Being Exploited to Spread Possible Satori Variant in Android Devices
by Hubert Lin, Lorin Wu and Vit Sembera of Trend Micro   July 23, 2018
Quoting: "... we found a new exploit using port 5555 after detecting two suspicious spikes in activity on July 9-10 and July 15 ... the activity involves the command line utility called Android Debug Bridge (ADB), a part of the Android SDK that handles communication between devices ... the first wave of network traffic came mainly from China and the US, while the second wave primarily involved Korea ... we determined that the malware spreads via scanned open ADB ports .... It attacks ADB by uploading the payload via TCP port 5555 ... It is reasonable to believe that the same author was behind this sample and Satori ... According to data from Shodan, over 48,000 IoT systems are vulnerable to ADB exploitations. Not all vulnerable systems are exposed as they are usually hidden behind routers with NAT ... However ... they can be made accessible either manually or via UPnP NAT traversal. All multimedia devices, smart TVs, mobile phones, and other devices without additional protection are easy targets for this malware regardless of the user's password strength."

Still more attacks on buggy routers

eSentire Observes an Increase in Exploitation Attempts Against Routers
by eSentire   July 20, 2018
eSentire observed exploitation attempts targeting consumer routers made by Dasan and D-Link. The D-Link DSL-2750B with firmware 1.01 to 1.03 is susceptible to this attack. So, too are Dasan GPON routers utilizing ZIND-GPON-25xx firmware and some H650 series. Dasan never issued bug fixes. If these devices get attacked, it can result in remote code execution. An article about the D-Link routers appeared in Ars Technica in June (see below).

Huawei Router botnet built exploiting only one bug

Router Crapfest: Malware Author Builds 18,000-Strong Botnet in a Day
by Catalin Cimpanu of Bleeping Computer July 19, 2018
A bad guy built a botnet of over 18,000 routers in the span of a single day. The botnet has been spotted by NewSky Security, and their findings have been confirmed by Qihoo 360 Netlab, Rapid7, and Greynoise. It was built by exploiting a vulnerability in Huawei HG532 routers (CVE-2017-17215). The bug can be exploited via port 37215. This was no zero day, the bug is high profile and had been exploited by many previous botnets. Clearly no one patches their routers. Also, ISPs fail to block incoming connections on port 37215.

Yikes

Hackers Breach Russian Bank and Steal $1 Million Due to Outdated Router
by Catalin Cimpanu of Bleeping Computer   July 19, 2018
What was outdated about the router, no one said. The victim of the hack was PIR Bank. Their network was infiltrated in late May 2018 and the money transferred out on July 3, 2018. The hacker group is known as MoneyTaker, according to Group_IB, and the amount stolen this time was at least $920,000 in US dollars. Group-IB said: "The router had tunnels that allowed the attackers to gain direct access to the bank’s local network .. This scheme has already been used by this group at least three times while attacking banks with regional branch networks." Tunnels? As in VPN?

Press Release: new free Avira security product

Avira Home Guard: One out of every four routers is vulnerable to hackers
by Avira   July 19, 2018
This is a press release for a new free product from Avira. It is software that runs on Windows and Android and does a LAN scan to find devices and security issues with them. The text says that many routers have open ports, bit its not clear if the product finds LAN side or WAN side open ports. Avira may be selling FUD. Don't know. Hope to kick the tires on this soon. I later learned that Trend Micro has a similar product that runs on Windows, MacOS, iOS and Android. Trend is upfront of the data that is sent to them, Avira says nothing about this.

Netgear FTP password flaw exploited to steal military documents

Year-old router bug exploited to steal sensitive DOD drone, tank documents
by Sean Gallagher of Ars Technica   July 11, 2018
Quoting: "In May, a hacker perusing vulnerable systems with the Shodan search engine found a Netgear router with a known vulnerability - and came away with the contents of a US Air Force captain's computer. The purloined files from the captain - the officer in charge of the 432d Aircraft Maintenance Squadron's MQ-9 Reaper Aircraft Maintenance Unit ... included export-controlled information regarding Reaper drone maintenance. The vulnerability, which makes it possible for an attacker to remotely execute commands and gain access to the root directory of the router via FTP, was disclosed by Netgear over a year ago ... [it] allowed attackers to ... gain access to the local network. They could then either grab files passing over the network or gain access to devices on it." An article in SFGate, from February 2016, Netgear: Add a password or risk losing your data, says the flaw stems from the promise of convenience: "An owner can plug in a flash drive or a hard drive into a home router and access the data remotely. Turning a USB stick into a private cloud is an enticing perk - and one that’s becoming expected as people grow accustomed to accessing their information from anywhere ... When people attempt to remotely access their data, they are prompted to enter a user name and password. If customers have not established their own unique log-ins, Netgear routers grant access without requiring a password at all." Netgear's point of view was that users are responsible for preventing this. They should change the FTP password as the manual says. The article also says that Netgear did not respond to questions about the specific devices affected by the design flaw.

JUNE 2018

Many routers should be illegal

Those Harder to Mitigate UPnP-Powered DDoS Attacks Are Becoming a Reality
by Catalin Cimpanu of Bleeping Computer   June 28, 2018
Every consumer router that I am aware of ships with UPnP enabled. Less tech support calls that way. But, UPnP can be abused to make Denial of Service attacks harder to defend. Quoting: "Security researchers are continuing to see DDoS attacks that leverage the UPnP features of home routers to alter network packets and make DDoS attacks harder to detect and mitigate ... " UPnP was designed for LAN side use only, but many routers are mis-configured and support it on the WAN side. Then too, routers implement it wrong. Specifically, UPnP supports port forwarding to open up a LAN side device directly to the Internet. But, some routers do not validate that the target IP address is really internal, so UPnP allows port forwarding to a public IP address - to a victim of DDos attack. This has been called UPnProxy. This also allows changing the source port number which makes DDoS attack mitigation much harder.

Old D-Link DSL gateways being hacked. No surprise.

Widely used D-Link modem/router under mass attack by potent IoT botnet
by Dan Goodin of Ars Technica   June 20, 2018
Bad guys are exploiting a bug in very old D-Link DSL-2750B DSL gateways in an attempt to make them part of the Satori botnet. The bug has been known for roughly 2 years but the devices have been abandoned by D-Link and the ISPs that gave them out. If you have such a device, it needs to be replaced. This is yet another reason to not use any hardware from your ISP, when possible. The bug allows remote command execution without any authorization needed. The vulnerability can be exploited using the "cli" parameter that directly invokes the "ayecli" binary. Vulnerable firmwares are from 1.01 up to 1.03. It is also possible to retrieve the admin password, wifi password, etc. Attack code exploiting the bug was published last month. Netlab 360 first reported Satori was exploiting this bug on June 15th. They also found it exploiting a bug in a XiongMai router. D-Link representatives did not respond to Ars Technica seeking comment. No surprise there. There is no mention of the device on the D-Link website for the US. I know someone who had one of these from Verizon. As of August 2016, it was running firmware version 5.4.12.1.44.2.1 (not a joke) which was released Nov. 14, 2013.

MikroTik router serving as Command and Control

Chinese Cyber-Espionage Group Hacked Government Data Center
by Catalin Cimpanu of Bleeping Computer   June 15, 2018
In November 2017, according to Kaspersky Lab, bad guys hacked a data center belonging to a Central Asian country and embedded malicious JavaScript code on government websites. The code re-directed victims to malicious websites hosting exploitation tools that attempt to infect victims with a remote access trojan (RAT). The attackers hacked a MikroTik router to host the command and control server of the RAT. The hacked router controlled and retrieved data from infected victims, providing an additional layer of anonymity between the bad guys, victims, and forensic investigators. This is believed to be the first time that bad guys hosted a C&C server on a router. MikroTik is also on the VPNFilter list of vulnerable manufacturers. Why? According to Rapid 7, most MikroTik devices are not maintained.

Further proof that VPNFilter was inevitable

VPNFilter's Potential Reach - Malware Exposure in SMB/Consumer-grade Devices
by Bob Rudis of Rapid7   June 7, 2018
Rapid7 scanned the Internet looking for devices from the 11 manufacturers whose routers are known to be vulnerable to VPNFilter. Of those, they counted the ones with an open Telnet port and found just over 453,000 devices. Quoting: "... poorly configured and maintained devices remain at-large just waiting for attackers to regain control ... To ... understand the potential scope of the problem (and not with just VPNFilter), Rapid7 Labs researchers used banner scan results from Project Sonar and Censys to try to get a count of the device families targeted by VPNFilter. The initial numbers for the spread of VPNFilter were in the 500,000 device range and ... the potential for exploitation of all types in these device families (VPNFilter and beyond) is much, much larger ... we picked the most egregious port - telnet - to see what is there since - if telnet is exposed, the devices are seriously, egregiously poorly configured and are likely already compromised in other ways, let alone potential victims for VPNFilter (in any form) ... While we cannot determine if these devices are, in fact, compromised by the latest round of VPNFilter exploits, their mere presence on this singular cleartext port is a clear indicator that we have a long way to go reduce the number of candidates for compromise."

MAY 2018

VPNfilter router hack - an inevitable disaster

New VPNFilter malware targets at least 500K networking devices worldwide
by Talos division of Cisco   May 23, 2018
If you own a crappy router, it is likely to get hacked. That is the lesson to be learned here. And, by crappy, I mean anything from your ISP or a consumer router. You can stop reading now.
The story: State sponsored bad guys, probably Russians, have hacked a lot of routers (at least 500,000 in 54 countries is the estimate) with really nasty malware. Talos, working with law enforcement and others, found devices from Linksys, Mikrotik, Netgear, TP-Link and QNAP (a NAS not a router) infected. They listed specific models but clearly said their list was incomplete. Nonetheless many articles left out the incomplete part, leaving the impression these were the only vulnerable models. In reality, every device from these vendors needs to be considered vulnerable. There is no easy way to tell if a device is infected with VPNFilter. The exact method of infection is not known and Talos has not completed its research. As shown on the Bugs page here, there are many router bugs just waiting to be exploited. Heck, being a bad guy targeting routers is like being a kid in a candy store. Talos said "...most devices targeted ... have known public exploits or default credentials that make compromise relatively straightforward." In other words, easy pickings. While the initial router infection may have been easy, the malware is, nonetheless, fairly sophisticated. For one thing, it is installed in sections, a main controller is installed first and it then downloads other components. The initial component learns the IP address of where it should download the rest of itself in a very clever way. It downloads an image, and looks in the image metadata for an IP address. Also, this is only the second router malware that can survive reboots of the router. The malware/botnet has been around for a couple years and grew slowly until May 8, 2018 when it increased 28 fold with almost all new infections in the Ukraine.
So what? The malware can do assorted bad things and Talos is not sure it has detected everything. It can certainly steal website credentials and brick the router it is running on. And, as with other router hacks from the last few months, it can be used to hide the true location of bad guys doing bad things. If the FBI breaks your door down thinking you did a bad thing on the Internet, it might be due to VPNFilter. Speaking of the FBI, they said VPNFilter can do "information collection, device exploitation, and blocking network traffic." Finally, it monitors modbus traffic on TCP port 502. Modbus is an Industrial Control Systems (ICS) protocol. A report from JASK said "Western Europe and North America may be at increased risk for a potential ICS attack against critical infrastructure."
Solutions offered: Reboot you router is the big headline everywhere. Good reporters note that all routers should be rebooted, bad reporters point to the few that have been verified as vulnerable. Rebooting is also called power cycling. Simply put, unplug a router from the electricity, wait a short bit and then plug it back in. What is sometimes missing is that this only removes part of the malware, not all of it. Specifically, it removes the add-on components, but not the initially installed component. The malware that is left is harmless in and of itself, but it still leaves the router open to re-infection. Fully removing the malware requires a hard reset to restore the router to a factory fresh state. The downside to this is that any changes made to the default configuration will need to be re-done and hardly anyone knows every change that was made. Some routers can save their current configuration which begs the question if this is restored after a reset, are you still safe? No one has addressed this. Certainly if the malware changed DNS servers, you do not want to restore the bad ones. Finally, a factory refresh may be a waste of time, if the bug that led to the infection in the first place is not fixed. And, again, we do not know how the initial infections are done. Everyone also says to update the firmware. No one points out that this may be useless. Many routers are abandoned and their firmware is not updated and bugs are not fixed. Other solutions are not solutions, just re-cycled words. For example: change default passwords and turn off Remote Management. Well, duh.
Solution not offered: Use a Pepwave Surf SOHO router. Steve Gibson was the only person to question whether a factory reset really removed the malware. He suggested installing new firmware as the best approach for removing existing corrupted firmware. But that begs the questions: if a router already is running the latest firmware, can you re-install it on top of itself? Which leads me to wonder, how long before the malware prevents any firmware updates? Infected devices did TCP scans on ports 23, 80, 2000 and 8080 which Talos wrote are indicative of Mikrotik and QNAP NAS devices. A secure router has no open ports. The Test Your Router page lists many tests you can run against your router looking for open ports. Rebooting a router every now and then is a good idea in general, nothing to do with VPNFilter specifically. There are many router hacks that are removed by rebooting. I recommend periodic reboots on the home page of this site.
Unknown: What does a factory reset of a router really do? Does it install new firmware from a read-only copy? If so, how old is this firmware? Or, does it simply reset the configuration options but make no changes to the installed firmware? NO ONE addressed this issue. Then too, why is it that 3 of the 4 affected companies say nothing about a factory reset in their instructions to their customers? Strange.
Mystery: Who owned toknowall dot com, the domain seized by the FBI? Did the bad guys register it or was an innocent website hacked?
Detecting an infection:
June 30, 2018: Symantec has a VPNFilter checker at www.symantec.com/filtercheck. Interestingly, it is only available via HTTP, not HTTPS. Exactly what it does is not explained, Symantec says only that it tests for the presence of the ssler plugin. How it tests or what exactly it tests is not explained. Also, the plugin is but one component of VPNFilter and Symantec is clear that a router that gets a clean bill of health on their test, "...may still be compromised by other threats or components of VPNFilter." On this page, Symantec says that a list of vulnerable routers is available in their blog. There are multiple mistakes with this. Depending on the release of firmware, a router may or may not be vulnerable. Also, the list of known vulnerable routers is wrong as it omits information from at least two vendors that know exactly the vulnerability that led to infection. They just copied a list from Talos.
June 9, 2018: It seems that you cannot detect the presence of the VPNFilter malware just by looking at your router. The second Talos report mentioned that the router does port forwarding of port 80 to 8888, but did not say if this was visible in the router interface. The report also mentioned that it disables gzip compression, but no one has said how to detect this. Likewise, it tries to downgrade HTTPS to HTTP which is perhaps the easiest means of detection, but many websites force HTTPS all the time. All the detection mentioned anywhere involves monitoring traffic leaving the suspect router, which means connecting the router to something other than a modem. In effect, doing a Man-in-The-Middle attack on the suspect router. The MiTM device could look for the use of http : / / api.ipify.org?format=json which the malware uses to learn its public IP address. It could also look for outgoing requests to the domain seized by the FBI, toknowall dot com. Talos has published many Indicators of Compromise.
Update June 2, 2018: I re-read the Talos blog and it clearly says that rebooted routers can be fully re-infected. Quoting: "If the attempt to the backup domain fails, stage 1 opens a listener that waits for a specific trigger packet to open a connection for the actor to connect interactively to the device ... when any packet arrives on any port, the listener performs a series of checks to identify a trigger packet. If the packet meets a predefined set of criteria, it will extract an IP address from the packet and attempt a stage 2 download." Surely the bad guys know the IP addresses of all infected routers, even those that were re-booted. They may lose track of some because the re-boot may assign a new public IP address, but still, they should be able to fully re-infect many of the rebooted routers. And, the malware listens for a trigger packet on all ports making it impossible to do port scans to find infected devices.

Bug in DrayTek routers is being both exploited and fixed

May 21, 2018: A bug in DrayTek routers was reported by the company and is in the process of being fixed by new firmware. Bad guys have been abusing the flaw to modify the DNS servers in the routers. Details are on the Router Bugs page.

WICKED botnet exploits known bugs in Netgear routers

A Wicked Family of Bots
By Rommel Joven and Kenny Yang of FortiGuard Labs   May 17, 2018
If the WICKED botnet can connect to port 8080 on a router it will try to exploit a flaw in Netgear DGN1000 and DGN2200 v1 routers from October 2017. If it can connect to port 8443, it will try to exploit a command injection flaw in Netgear R7000 and R6400 routers from March 2017. If you have a Netgear router, you can test TCP port 8443 and test TCP port 8080. The best result is "Stealth." If one of the ports are open, make sure you have the latest firmware installed.

Harder to detect DDoS attacks thanks to UPnP

New DDoS Attack Method Demands a Fresh Approach to Amplification Assault Mitigation
by Avishay Zawoznik, Johnathan Azaria and Igal Zeifman of Imperva   May 14, 2018
It was recently reported that routers with UPnP exposed on their WAN side (the Internet) were being abused by bad guys to make their own customized equivalent of the Tor network to hide their actual location. That was bad enough. Now, Imperva has found that bad guys are also abusing devices that expose UPnP, in DDoS attacks that are harder to detect because the source port is a scam. They searched Shodan and found over 1.3 million devices exposing UPnP on the Internet.

Bugs in Every major router

Zerodium buys bugs, including those in routers. On May 7, 2018, the company CEO, Chaouki Bekrar, tweeted: "Since @Zerodium has added routers to its bounty program, we have received at least one pre-auth RCE #0day exploit for every major router. We all know that the security of routers and IoT devices is completely fucked up but it's still scary to see how deeply fucked they are." Translating: pre-auth means pre-authorization which, in turn, means no password needed. RCE is Remote Code Execution, the most severe type of bug.

Dasan GPON routers being attacked

Vulnerabilities Affecting Over One Million Dasan GPON Routers Are Now Under Attack
by Catalin Cimpanu of Bleeping Computer   May 4, 2018
The bug being exploited was disclosed in late April 2018. At first, I did not believe it, my reasons are on the Bugs page. Seems I was wrong and these are real router vulnerabilities. Over a million routers are said to be vulnerable. No article has yet addressed whether the bugs can be exploited remotely, locally or both. The bugs are CVE-2018-10561 and CVE-2018-10562. GPON (Gigabit Passive Optical Network) supports internet connections via fiber optics lines. Most of the vulnerable routers are in Mexico, Kazakhstan, and Vietnam.
Update May 21, 2018: These same routers appear to have another zero day flaw that bad guys are exploiting. See GPON Routers Attacked With New Zero-Day by Catalin Cimpanu for Bleeping Computer.

APRIL 2018

Hacking a home network

The Digital Vigilantes Who Hack Back
by Nicholas Schmidle for The New Yorker magazine May 7, 2018 issue
The article mentions a security company that got a request from the C.E.O. and general counsel of a multinational corporation. A employee who left the corporation had not returned their company laptop and was suspected of having shared proprietary information with a competitor. They wanted to know if the security company could "hack into the former employee's home network, assess whether the company laptop was connected to it, and, if so, erase any sensitive files." Doing so, would require access to the MAC address of the devices connected to the former employee's home network. That, in turn, requires router access. The security company said, for the article, that from a technical standpoint "such a hack would not be difficult."

Apple FINALLY comes clean, no more AirPort routers

Apple officially discontinues AirPort router line, no plans for future hardware
by Zac Hall of 9to5Mac   April 26, 2018
"Apple is officially exiting the wireless router business and selling off its remaining inventory of AirPort products. This includes the AirPort Express, AirPort Extreme, and both models of AirPort Time Capsule." Why would anyone buy the remaining inventory? Especially since the last new model was released five years ago. Apple seems to hate their customers. Back in Nov. 2016, Bloomberg reported that Apple had disbanded the team responsible for developing Apple's routers. Yet, it took till now to make it official. And, even now, they have not lowered the price of remaining inventory. The article says that the router will be supported for years to come, but they are, after all, Apple fanboys. I doubt there will ever be another firmware update to the AirPort routers. As for replacements, needless to say, I recommend the PepWave Surf SOHO router. It is, however, a single device and Peplink does not offer a mesh router system. At the moment, I would recommend Eero, based on my experiences with tech support. However, I have only kicked the tires on Eero, Google Wifi and AmpliFi.

UPnProxy- the UPnP abuse will never die - no progress in 5 years

UPnProxy: Blackhat Proxies via NAT Injections
by Akamai   undated (sometime this month)
UPnP was intended to be used on a LAN and, as such, all devices were considered trusted and the protocol has no security at all. It's an old protocol. Back in January 2013 it was discovered that millions of routers were exposing UPnP on their WAN side (the Internet) by mistake. For more on this see the Bugs page. Here we are, 5 years later and this is still true. It seems nothing was done about the millions of buggy/vulnerable routers from 2013. Last month, Symantec wrote about a cyber espionage group known as the Inception Framework abusing UPnP to forward traffic from one router to another to another to another, etc. This lets bad guys hide the true source of their bad deeds. The link and summary are on this page, under March 2018. Now, Akamai is reporting the same thing and they call it UPnProxy. Akamai says it detected over 4.8 million routers that expose various UPnP services via the WAN interface. Again, there should be none, UPnP was only intended for LAN side use. Of these exposed routers, Akamai says over 65,000 home routers are currently being abused. No need for a VPN or Tor when you bounce your Internet data through dozens of other people's routers. This is a gift to spammers, phishers, botnets and the like. It is a bit like having a dedicated bad-guy-only version of Tor. Akamai was kind enough to shame the buggy and vulnerable devices and their manufacturers. Asus is a disgrace, they have a large number of vulnerable devices. Some other manufacturers on the list are D-Link, Ubiquiti, Netgear and ZyXel. Peplink was not on the list. Akamai also blamed ISPs because they are in a position to block UPnP traffic that was never meant to traverse the Internet in the first place. Comcast deserves credit here, they block UDP port 1900. This story did not get nearly enough attention. My guess is that it is beyond the technical comprehension of the many Art History majors that cover technology. Steve Gibson's discussion of UPnProxy (link below) is the only one worth reading/hearing.
- - - -
WHAT YOU CAN DO: How can you tell if your router exposes UPnP to the Internet at large? Steve Gibson has the only test that I am aware of. It is part of his Shields Up! service, the link is below. Every consumer router that I have seen ships with UPnP enabled. So, first off, disable UPnP in your router and then test to see if it was disabled on the Internet/WAN side of the house. Akamai noted that UDP port 1900 is what makes a vulnerable router discoverable. Click here to test if UDP port 1900 is open on your router. Also, check if your router is doing any port forwarding at all. Nothing to do with UPnProxy, all forwarded ports are holes in the router firewall and thus potential security weaknesses. For an Asus router go to System Log, then the Port Forwarding tab. If you see nothing, then you are safe, at the moment. In this screen shot, we see five ports are being forwarded. These are normal forwarding rules in that the destination is a computer on the LAN - they all start with 192.168.1. Victims of UPnProxy would see a public IP address in the "Redirect to" column. I have no idea why UDP port 54051 is being forwarded on this Asus router. For a TP-Link router, go to the Advanced tab, then NAT forwarding, then UPnP. Again, nothing being forwarded is good. In this screen shot, we see two forwarding rules, both to an "Internal IP Address" (starting with 192.168.0). I don't know if any routers let you disable or delete a UPnP created forwarding rule. As we can see in these two screen shots, neither Asus nor TP-Link supports this. But, at least they do report on UPnP created port forwarding. I tried the emulator for a couple Linksys Smart routers and they do not seem to report on this at all. Exposing UPnP also opens up your router to attack which Akamai described in their report. It basically converts Remote Administration to Local Administration. To defend against this, change the port number(s) used for local administration and change the LAN side IP address of the router. And, of course, change the router admin password, and, when possible, the router admin userid too. All that said, the Defensive Computing thing to do is to replace a router exposing UPnP on the Internet. It shows the manufacturer is incompetent.

The Russians Are Coming, The Russians Are Coming

Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices
by the Department of Homeland Security, the FBI and the National Cyber Security Centre in the UK   April 16, 2018
Russian cyber actors do not need to leverage zero-day vulnerabilities or install malware to exploit devices. Instead, they take advantage of: devices with legacy unencrypted protocols or unauthenticated services, devices insufficiently hardened before installation, and devices no longer supported with security patches. These factors allow access to both intellectual property and U.S. critical infrastructure that supports the health and safety of the U.S. population. Network devices are ideal targets. A malicious actor with presence on an organization’s gateway router has the ability to monitor, modify, and deny traffic to and from the organization. Whoever controls the routing infrastructure of a network essentially controls the data flowing through the network.
The Russians, like many others, are abusing Cisco Smart Install enabled devices. There is more about abusing Smart install below, dated April 6th. Details on the Smart Install flaws are on the Bugs page under March 2018. Also being attacked are Generic Routing Encapsulation (GRE) and Simple Network Management Protocol (SNMP). The National Cyber Security Centre (NCSC) is an arm of British intelligence agency GCHQ.
From my Defensive Computing perspective, there is nothing special about Russia, all Internet-facing devices are scanned all the time. I blogged about this last month, Routers are constantly being probed - examining a firewall log

Hacked routers with malicious DNS servers lead to Android malware

Roaming Mantis uses DNS hijacking to infect Android smartphones
By Suguru Ishimaru of Kaspersky Lab Securelist   April 16, 2018
Android malware, dubbed Roaming Mantis, is distributed through router DNS hijacking. When a user attempts to access any website via a compromised router, they are redirected to a malicious website. For example, if a web browser tried to access www.securelist.com, it would be redirected to a rogue server that had nothing to do with the security research blog. The nature of the malicious website is hidden from the victim because the web browser displays the original URL. The malicious web page implores the victim to update to the latest version chrome. Victims that install the banking malware have their login credentials stolen. The malware can read SMS messages so it also steals the secret verification code used for two-factor authorization. The article goes into details on the malware, but says nothing about how the routers may have been hacked. It also offers bad advice: "If you have any concerns about the DNS settings on your router, please check the user manual and verify that your DNS settings haven't been tampered with, or contact your ISP for support." Better advice is to use the DNS server tester pages listed here to learn what your DNS servers are.

Hacking routers is the latest thing among bad guys

Cyber-Espionage Groups Are Increasingly Leveraging Routers in Their Attacks
By Catalin Cimpanu of Bleeping Computer   April 12, 2018
According to Costin Raiu, director of the Global Research and Analysis Team at Kaspersky Lab, the number of Advanced Persistent Threats leveraging routers for attacks has gone steadily up in the past year, and the tactic has become quite widespread in 2018. Maybe I should put ads on this site. Their research uncovered the LuckyMouse APT which uses routers for hosting their command and control servers, which, Raiu said, is unusual. They believe that the routers were hacked through an SMB vulnerability which allowed the bad guys to upload CGI scripts. He also pointed out that the US government released a document saying that router attacks have been the preferred attack vector for a number of malicious actors for a number of years, yet, the number of reports about router malware and router attacks are few and far between. Thus, Raiu concludes that there's a lot going on that we don't see.

Looks like the Boston Red Sox need better computer nerds

The Red Sox clubhouse's Wi-Fi password does not rank high for creativity
by Nik DeCosta-Klipa of Boston.com   April 12, 2018
Yankee manager, Aaron Boone, was being interviewed after a game at Fenway Park against the Boston Red Sox when the camera showed a bulletin board on the wall next to Boone. On the bulletin board was the Wi-Fi network name and password. This got some attention because the password was the miserably insecure - "baseball". The Red Sox could hardly have chosen a worse password. They took it well, however, tweeting "Guess we need a new WiFi password". As I explain, Wi-Fi passwords need to be at least 14 characters long to resist brute force attacks. However, for a high value target such as the visitors clubhouse at Fenway Park, I would certainly go with a longer password. When you consider all the schools near Fenway Park (Harvard and MIT come to mind), churning out fresh new techies, I would make the password still longer. The password was not their only mistake, an SSID of "clubhouse" gives away too much information. Why not call it "VisitorsClubhouse" and take away all mystery. Better network names would have been BlueSky or ColdWeather or JoesNetwork. See more about picking an SSID. Some of the suggestions on Twitter for new passwords, shown below, were not half bad.

A suggestion that made me laugh was to use "JarrodSaltalamacchia," noting that potential hackers are bound to get it wrong. Saltalamacchia used to catch for the Red Sox. My guess is that the same person that chose the old password will choose the new one, so it will probably be "baseball123." It won't take the kids from MIT too long to crack that one.

ISPs keep customers ignorant

What most people think it looks like when you change router's admin password, apparently
by Kat Hall of The Register   April 12, 2018
A survey, by the British comparison website Broadband Genie, reported that 82 per cent of responders have never changed their router password. The article is unclear however about whether it is referring to the router password or to a Wi-Fi password. The survey also found that 52 per cent have not changed their Wi-Fi network name (SSID). This advertises to bad guys that the owner of this network is technically clueless, which may invite attack. 48 per cent of responders said they were baffled as to why they would need to make these changes. A pessimist might assume that ignorant customers make fewer tech support calls. This article is just as guilty as the ISPs it is trying to shame. It notes that bad things can happen if the DNS servers in the router are changed, but fails to mention that you can test for this fairly easily. My Test Your Router page lists many websites that report on the currently used DNS servers.

Two router surveys by PC Magazine

April 11, 2018: PC Magazine just published their Readers' Choice Awards 2018: Routers and NAS Devices. Asus won the router award for the seventh straight year. Just days earlier, Akamai issued a white paper, UPnProxy: Blackhat Proxies via NAT Injections that detailed problems with UPnP. The Akamai paper listed buggy devices. Asus had quite a few buggy routers: DSL-AC68R, DSL-AC68U, DSL-N55U, DSL-N55U-B, MTK7620, RT-AC3200, RT-AC51U, RT-AC52U, RT-AC53, RT-AC53U, RT-AC54U, RT-AC55U, RT-AC55UHP, RT-AC56R, RT-AC56S, RT-AC56U, RT-AC66R, RT-AC66U, RT-AC66W, RT-AC68P, RT-AC68R, RT-AC68U, RT-AC68W, RT-AC87R, RT-AC87U, RT-G32, RT-N10E, RT-N10LX, RT-N10P, RT-N10PV2, RT-N10U, RT-N11P, RT-N12, RT-N12B1, RT-N12C1, RT-N12D1, RT-N12E, RT-N12HP, RT-N12LX, RT-N12VP, RT-N14U, RT-N14UHP, RT-N15U, RT-N16, RT-N18U, RT-N53, RT-N56U, RT-N65R, RT-N65U, RT-N66R, RT-N66U, RT-N66W, RTN13U, SP-AC2015 and the WL500. Peplink, my preferred router vendor, was not on the radar screen of PC magazine readers.

Cisco devices are being hacked all over the world

What happened to the Internet: attack on Cisco switches
by Kaspersky   April 6, 2018
At the end of March 2018 Cisco released 34 bug fixes of which three were deemed critical. Details are on the Router Bugs page. By April 6th, there was a massive attack against Cisco switches. These devices are used in data-centers across the globe. The attacks are exploiting a bug in the Cisco Smart Install Client software. The Smart Install protocol does not require authentication and should not be exposed to the Internet. Yet, there it is. Kaspersky blames the nerds working in datacenters for failing limit access to TCP port 4786. Or, they should have disabled Smart Install altogether. A simple command tests if Smart Install is running and another command can disable it. Hackers have attacked networks in a number of countries including Iran where they left the image of a U.S. flag on screens along with a warning: "Don't mess with our elections." Some hackers claimed to have fixed the bug on vulnerable devices in the U.S. and UK. One report said the flaw apparently affected 200,000 router/switches. Talos found 168,000 devices exposed by the Cisco Smart Install Client. Motherboard reported 166,000. Attackers are able to reset the devices back to their default configuration and display a message to the victims. The attack on some ISPs cut off Internet access for their subscribers. Talos observed hackers exploiting the vulnerability to target critical infrastructure. Joseph Cox of Motherboard said that the attack seems relatively unsophisticated. Taols, which is owned by Cisco, believes that some of the attacks are from nation-state actors. Sounds better than a bunch of 14 year old kids.

The better to spy on you, my dear

Chinese city shops ordered to start using government-approved routers
by Shannon Liao of The Verge April 5, 2018
The eastern Chinese city of Qingdao will force shops and restaurants that offer Wi-Fi hotspots to use government-approved routers. The stores have to buy the routers themselves at a cost of either $16 or $63. Failure to use the mandated routers incurs a penalty of up to $18,589. The routers are made by BHU, which boasts on its website about a "long-term close collaboration" with local police in China. Do I need to even mention that in August 2016 an expert found multiple security flaws in a Bhu router (see the Router Bugs page). There were three different ways to gain admin access to the router and it also injected suspicious looking third party JavaScript into HTTP traffic. Qingdao is not the first city to mandate a government-approved router. Free routers were given to shops in Chifeng, a city in Inner Mongolia, in 2016. Multiple cities in China have been told to install a "security management system."

MikroTik routers used in DDoS attacks

Mirai-Variant IoT Botnet Used to Target Financial Sector in January 2018
by Priscilla Moriuchi and Sanil Chohan of the Insikt Group. April 5, 2018
In late January 2018, three European financial institutions were hit by DDoS attacks powered by a new variant of the Mirai botnet. The botnet that hit the first company consisted of at least 13,000 devices. The Insikt Group used IP geolocation, service banners from Shodan, and additional metadata to analyze the composition of the botnet and found that the attack was 80 percent comprised of compromised MikroTik routers, with the remaining 20 percent composed of various IoT devices ranging from vulnerable Apache and IIS web servers, to routers from Ubiquity, Cisco, and ZyXEL. All of the compromised MikroTik devices had TCP port 2000 open, which is usually reserved for MikroTik’s bandwidth test server protocol. This port is usually enabled by default in new MikroTik devices. No MikroTik devices with TCP 2000 disabled (a recommended security measure in production environments) were discovered within the botnet.

MARCH 2018

Multiple reports of DNS hijacking on Asus routers

Asus RT-AC66U DNS hacking
by Mpuk7   at the SmallNetBuilder forum   March 10, 2018
Because I maintain this website, someone emailed me asking about their Asus router that had its DNS hijacked. As we both looked into it, there seems to be a lot of that going around. The person who posted this claimed to have the latest Asus firmware, a long password and they had even changed the default router userid. Of course, the latest firmware, at least with consumer routers, always includes old software with known bugs. I am not qualified to review the Asus router log, but this one made it obvious the router was running some old software with known bugs. The router had remote administration enabled, which is almost always a mistake. Two interesting quotes from these reports: "I tried Asus support but they were immensely useless" and another person said Asus was as helpful as a chocolate teapot :-) Two of the bad DNS servers were 185.183.96.174 and 185.117.75.242.
Update March 16, 2018: David Redekop suggested this might be the flaw that was abused here: ASUS Patches Root Command Execution Flaws Haunting Over a Dozen Router Models. Routers enabled for Remote Administration using HTTP rather than HTTPS would be vulnerable to this.

MikroTik routers hacked to infect Windows PCs

Kaspersky Lab uncovers Slingshot, the spy that came in from the router
by Kaspersky   March 9, 2018
It is not known how the MikroTik routers were hacked. Currently routers are configured using either a web interface or a mobile app. In the previous century they were administered with Windows software. The hacked routers were administered with Windows software known as Winbox. Winbox, for whatever reason, downloads some Windows executable files (DLLs) from the router. The hacked routers had malicious DLLs that infected the Windows computer used to configure the router. This was professional spyware of the highest caliber. The infections seem to be very targeted, with only around 100 PCs known to be infected. The spyware was extremely effective at stealthy information gathering, hiding its traffic in marked data packets that it can intercept without trace from everyday communications. Operation slingshot seems to have started in 2012 and was still active in February 2018. The MikroTik router firmware no longer installs software on Windows computers. Winbox is still a thing, but they also have a web interface. Kaspersky software can defend against this. So too, can a Chromebook.

FEBRUARY 2018

Ellen Nakashima, of the Washington Post, wrote Russian spies hacked the Olympics and tried to make it look like North Korea did it. Quoting: "Apart from accessing the computers, GRU cyber-operators also hacked routers in South Korea last month ... according to Western intelligence agencies. Such access could enable intelligence collection or network attacks..." The article also has a quote from security expert Jake Williams of Rendition Infosec: "Anyone who controls a router would be able to redirect traffic for one or more selected targets or cause total disruption in the network by stopping the routing entirely."

JANUARY 2018

An old D-Link HNAP flaw exploited by a new botnet

Masuta : Satori Creators' Second Botnet Weaponizes A New Router Exploit.
by Ankit Anubhav, Principal Researcher, NewSky Security   January 23, 2018
Quoting: "We analyzed two variants of an IoT botnet named 'Masuta' where we ... discovered a router exploit being weaponized for the first time in a botnet campaign ... The weaponized bug introduced in PureMasuta botnet is in the HNAP (Home Network Administration Protocol) which itself is based on the SOAP protocol. It is possible to craft a SOAP query which can bypass authentication by using hxxp://purenetworks.com/ HNAP1/GetDeviceSettings. Also, it is feasible to run system commands (leading to arbitrary code execution) because of improper string handling. When both issues are combined, one can form a SOAP request which first bypasses authentication, and then causes arbitrary code execution."

MikroTik and Ubiquiti Routers defaced due to default passwords

Tens of Thousands of Defaced MikroTik and Ubiquiti Routers Available Online
by Catalin Cimpanu of Bleeping Computer   January 10, 2018
If you don't change the default password, you get what you deserve. It seems that, as a prank, someone has been changing the names of routers. Ankit Anubhav of cyber-security company NewSky Security, first ran across this back in July. He estimates that over 40,000 Ubiquiti routers have been defaced along with 7,300 MikroTik routers. The names given to the routers are "HACKED FTP server," "HACKED-ROUTER-HELP-SOS-WAS-MFWORM-INFECTED," and "HACKED-ROUTER-HELP-SOS-HAD-DEFAULT-PASSWORD."

2017   top

DECEMBER 2017

Satori botnet abusing routers

Warning: Satori, a Mirai Branch Is Spreading in Worm Style on Port 37215 and 52869
by Li Fengpei of Qihoo 360 Netlab   December 5, 2017
Quoting: "About 12 hours ago ... we noticed a new version of Satori (a mirai variant which we named Satori), starting to propagate very quickly on port 37215 and 52869. Two new exploits ... have been added ... during last recent 12 hours we have seen 263,250 different IPs scanning port 37215, and 19,403 IPs scanning port 52869." They have not yet disclosed information on the flaw involving port 37215. The bug being exploited on port 52869 is derived from CVE-2014-8361. It is not clear, to me at least, if this is the same botnet that Dan Goodin wrote about below.
UPDATE: Script Kiddie Responsible for Large Satori Botnet by Lucian Constantin in Security Boulevard December 22, 2017. Security researchers at Check Point Software believe that the Satori botnet of more than 250,000 routers was created by an amateur hacker with limited skills. The botnet abuses a known bug in the Miniigd UPnP SOAP service on port 52869 and a new bug in Huawei HG532 home gateways on port 37215. Huawei exposed a configuration service intended to only be used on the LAN side to the Internet. It is scary that a relatively unskilled attacker can build a large botnet capable of devastating attacks. It highlights the poor state of router and IoT security across the internet.

Starbucks Wi-Fi hacked in Buenos Aires

Starbucks Wi-Fi hijacked customers' laptops to mine cryptocoins
by Lisa Vaas of Sophos   December 14, 2017
A Starbucks in Buenos Aires was secretly infecting customer computers to mine cryptocoins. The mining was noticed by Noah Dinkin. It was a JavaScript miner from CoinHive for generating Monero. Starbucks responded that they don't run the Wi-Fi, that it was out of their control but they would contact their ISP.

A botnet spreads by attacking un-named flaws in Huawei Home Gateways

100,000-strong botnet built on router 0-day could strike at any time
by Dan Goodin of Ars Technica   December 5, 2017
First off, clickbait. There are many botnets that could strike at any time. It is, sadly, the new normal. The buggy devices are the Huawei EchoLife Home Gateway and the Huawei Home Gateway. The bug was first disclosed by Check Point Software on Nov. 27, 2017. The botnet spreads both by abusing a bug and also by guessing 65,000 different userid/password combinations. It does not abuse Remote Administration. This is the second botnet, after Reaper, to spread by abusing flaws in routers. There is much we do not know:
--There are multiple Huawei Home Gateway models and it is not clear if some or all are buggy
--What firmware versions have the bug?
--What userid/passwords is the botnet guessing
--Defense. The article says nothing at all about defending against the flaw. Typical of clickbait.
--Does Huawei know about the bug? Acknowledge it? Have they issued a fix?

JUNE 2017

UPnP abused by Windows malware

McAfee Discovers Pinkslipbot Exploiting Infected Machines as Control Servers; Releases Free Tool to Detect, Disable Trojan
by Sanchit Karve of McAfee Labs   June 16, 2017
Pinkslipbot (also known as QakBot or QBot) is a notorious banking-credential harvester that has been active since 2007. It primarily targets users and enterprises located within the United States. The malware uses a new and complicated cloaking strategy to hide the location of its Command and Control servers. It uses two layers of HTTPS proxies made up of around 500,000 infected PCs. Anyone trying to find the IP address of the control server will instead see the proxy system shielding it. Pinkslipbot uses universal plug and play (UPnP) to open ports in the router firewall.

For years, the CIA has targeted routers

CIA has been hacking into Wi-Fi routers for years, leaked documents show
by Zack Whittaker of ZDNet   June 15, 2017
Secret documents, dated 2012 and leaked by WikiLeaks, reveal that the CIA has been targeting and compromising routers for years in an effort to carry out clandestine surveillance. One tool, known as CherryBlossom, allows the agency to monitor a target's Internet activity, redirect their browser and scan for information. The documents, which have not been verified, suggest this has been going on for years. CherryBlossom runs on 25 router models from 10 different manufacturers, and it's likely that modifications would allow the implant to run on at least 100 more routers. Among the brands are Asus, Belkin, Buffalo, Dell, Dlink, Linksys, Motorola, Netgear, Senao and US Robotics.

MAY 2017

Privacy issues with Trend Micro software in Asus routers

Review: ASUSWRT router firmware
by Daniel Aleksandersen of Ctrl.blog   May 2, 2017
The stock firmware that runs Asus routers is called ASUSRWRT and it has a somewhat hidden privacy issue. If you use any of the following features, it will collect and transmit data about which websites you visit to Trend Micro: Apps/traffic Analysis, Bandwidth Monitor, Network Analyzer, Network Protection (AiProtection), Parental Controls (including time scheduling), Quality-of-Service, Web History and Network Map. This is spelled out in a EULA from Trend Micro. If the software thinks a website URL is potentially fraudulent, it sends the URL to Trend. In addition, executable files or content that is identified as potential malware is also send to Trend. Finally, email messages identified as spam or malware are sent to Trend, despite the fact that they may contain sensitive data. Quoting: "The EULA also contains language holding the router's owner responsible for notifying their friends, family, and house guests who connect to the internet through the ASUS router that any network activity may be recorded and shared with Trend Micro."

APRIL 2017

More abuse of TR-069

Thousands of Hacked Home Routers are Attacking WordPress Sites
by Mark Maunder of Wordfence   April 11, 2017
We have seen this story before. ISPs leave the TR-069 port, number 7547, open to the world at large rather than restricting access to themselves. Just more support for my recommendation to avoid using a router from an ISP. Wordfence reports that Shodan found over 41 million devices are listening on port 7547.

FEBRUARY 2017

Dealing with a hacked Netgear router

Router assimilated into the Borg, sends 3TB in 24 hours
by Chris Lee of Ars Technica   February 26, 2017
Interesting story by someone who is not a networking expert. His Netgear R6400 router was hacked. The article goes into the symptoms of the problem and the debugging steps that he took to figure out the problem. After realizing the router had been hacked, a factory reset did not fix the problem which tells me that the router was running malicious firmware. DD-WRT was not much help. In the end, the router was a paperweight.

JANUARY 2017

Feds Accuse D-Link of Failing to Properly Secure Routers and Webcams
by Chris Morran of consumerist.org   January 5, 2017
Federal regulators have accused D-Link of leaving its routers and webcam devices vulnerable to hackers. A lawsuit alleges that D-Link "failed to take reasonable steps to protect their routers and IP cameras from widely known and reasonably foreseeable risks of unauthorized access." D-Link is also accused of misleading the public about the security of their devices. This is going to trial in January 2019.
This is the second time the FTC has gone after insecure routers. In February 2016, they went after Asus for their insecure routers. At least Asus took their medicine, D-Link, in contrast, cried foul.

Thailand ISP ignores router flaws

Router vulnerabilities disclosed in July remain unpatched
by Michael Mimoso of Kaspersky Threatpost   January 17, 2017
The first sentence of this article is all you need to read: "Details on serious vulnerabilities in a number of routers freely distributed by a major Thai ISP were published on Monday after private disclosures made to the vendors in July went unanswered." As I say elsewhere on this site, don't use a router provided by your ISP. TrueOnline, the largest broadband company in Thailand, gives their customers three buggy routers: ZyXel P660HN-T v1, ZyXel P660HN-T v2 and Billion 5200 W-T. Multiple bugs (default admin accounts and command injection vulnerabilities) were found and disclosed by Pedro Ribeiro of Agile Information Security. Most of the vulnerabilities can be exploited remotely, some without authentication. It is likely that the same flaws exist in other ISP customized routers in other countries. A ZyXel representative told Threatpost the router models are no longer supported. Billion ignored a request for comment from Threatpost.

2016   top

OCTOBER 2016

In October 2016, Brian Krebs wrote about malware that targeted Asus and Linksys routers. The software turned the routers into SOCKS proxies, which help bad guys hide their location, much like Tor. Bad guys were using these hacked routers for "or a variety of badness, from proxying Web traffic destined for cybercrime forums to testing stolen credit cards at merchant Web sites." Plus, access to these hacked routers was being sold in exchange for Bitcoin.

This is why Router Security matters

IoT Home Router Botnet Leveraged in Large DDoS Attack
by Daniel Cid of Sucuri   September 1, 2016
This is a blog post about a DDoS attack that Sucuri fought off for a client. The attack used three different botnets, one of them composed of routers. Sucuri detected over 11,000 compromised routers from eight different vendors. Quoting: "The largest number of routers being exploited came from Huawei-based routers. They varied between versions: HG8245H, HG658d, HG531, etc." Other routers were from MikroTik, Ubiquiti, NuCom, Dell SonicWall, VodaFone, Netgear, and Cisco-IOS.

FEBRUARY 2016

Building router hacked

Building automation systems are so bad IBM hacked one for free
by Darren Pauli of The Register   Feb 11, 2016
Quoting: "An IBM-led penetration testing team has thoroughly owned an enterprise building management network in a free assessment designed to publicize the horrid state of embedded device security ... they found exposed administration ports ... gaining access to a D-Link panel enabled to allow remote monitoring ... by adding an extra carriage return after the page request it was possible to bypass the router's authentication. They found command injection vulnerabilities in the router and found a list of commands in the firmware source code. They found a cleartext password in the router's var directory that not only granted more router pwnage but, thanks to password-reuse, allowed them to compromise the building management system." No mention of who made the router, let alone a model number.

2015   top

In August 2015, Jeff Atwood blogged about how two people he knew fell victim to compromised routers (see Welcome to The Internet of Compromised Things). In one case, the infected router inserted ads onto all HTTP web pages. Quoting:

It's becoming more and more common to see malware installed not at the server, desktop, laptop, or smartphone level, but at the router level ... I write about this because it recently happened to two people I know ... This is way more evil genius than infecting a mere computer. If you can manage to systematically infect common home and business routers, you can potentially compromise every computer connected to them. Router malware is the ultimate man-in-the-middle attack ... [bad guys] can direct you to phishing websites at will - if you think you're on the "real" login page for the banking site you use, think again.

In May 2015, Scott Hanselman wrote about an infected router at his local sandwich shop that "... started to redirect me to a fake 'update your flash' and download a 'Install flashplayer_10924_ i13445851_il345.exe' malware file .... This affects their PoS (Point of Sale) system, tablets, iPhones ... It's a MitM attack (Man in the Middle) where x number of HTTP GETs work fine and then every few hundred the router returns it's own HTML."

Victims don't have do anything to have their computing devices infected with malware. A hacked router can corrupt the self-update mechanism of either the operating system or a specific application. In June 2015 a case like this got a lot of publicity; the pre-installed Swift keyboard on Samsung smartphones self-updated in an insecure way that could be corrupted by anyone able to modify network traffic. A hacked router is one source, so too is a malicious ISP, a bad guy on the LAN or malware running on another LAN-resident device. Because the keyboard software ran with very high system privileges there was almost no end to what malware it was tricked into installing could do.

Australian ISP Optus screws up

Optus must hire checkbox champion after epic router, voicemail borking
by By Darren Pauli of The Register March 27, 2015
Australia's second-biggest telco, Optus, shipped hundreds of thousands of routers with open internet ports and default credentials. Going back as far as 2008, they shipped 300,000 Cisco and Netgear modems that exposed management ports and contained default access credentials.

2012   top

When visiting popular websites, the router can install malware by prompting users to install a plug-in. Here is a screen shot of this from 2012 in Brazil. See also Info Stealer Poses as Google Chrome Installer from Trend Micro written in May 2012.


Top 
Page Created: April 11, 2018      
 Last Updated: December 20, 2024 5PM CT
Viewed 364,787 times
 (149/day over 2,446 days)     
Website by Michael Horowitz      
Feedback: routers __at__ michaelhorowitz dot com  
Changelog
Copyright 2015 - 2024