11 ms·
Over 65,000 Home Routers Are Proxying Bad Traffic for Botnets, APTs
- ge0rg 9y agoThe full Akamai report linked from the article also outlines that this technique (accessing UPnP from the Internet while pretending to come from the LAN) allows to expose the router's LAN services (e.g. web interface) on the Internet. I wouldn't be surprised if it could be also used to scan your LAN and to connect to any local machines, to access unauthenticated resources and to brute-force your passwords.
- deleted 9y ago[deleted]
- bhouston 9y agoA lot of people have insecure computers/file servers inside of their local firewall.
- Sukotto 9y agoOk. What specific steps should we be doing to ensure a home router is configured safely? Please assume a consumer grade router given by the ISP and _maybe_ another one bought off the shelf at a box retailer. Also assume unable or unwilling to flash firmware.
- ge0rg 9y agoDisable UPnP in the router settings. In theory, that should close the hole. Disable remote maintenace / web access. Many router web UIs have exploitable flaws that can be used to bypass password authentication. Ensure that you are always running the latest firmware version. If there are no up-to-date versions / the router is too old, you might complain to the ISP. However, they might try to sell / rent you the latest and greatest router model then.
- prepend 9y agoIt looks like this exploit gets around disabled remote maintenance, since it makes remote traffic seem local. Disabling upnp will do it. I’m going to set up blocking all inbound on 1900 on ISP’s router stopping traffic before it gets to my home router. I might finally be grateful for being forced by the isp to use their hardware for nothing other than a hop between my network’s router and the isp’s network.
- EADGBE 9y ago> Disable remote maintenace / web access By this do you mean a public remote address/login or the generic 192.168.0.X login page when on the serving network?
- chrisper 9y agoMake sure companies care about their products and not only about money. My Swiss ISP is providing in-house developed hardware and it's quite good. I was quite surprised.
- ourmandave 9y agoSide note: If there's one tech support job for friends and family I don't mind doing it's helping them replace the slow modem their ISP is "renting" them. I was paying $60 per year for a DOCSIS 2 modem. Replaced it with a DOCSIS 3 for $90. Huge speed boost for almost free.
- tbihl 9y agoAnd based on the last 3 providers I've had, you were getting a steal at $60/yr
- commandlinefan 9y agoI've been begging my wife for years to let me upgrade the crap modem that the ISP is loaning us. She's terrified that if I touch anything, it's all going to break, and since she works out of the house, she won't be able to get online. Sigh...
- herbst 9y agoWell the one my ISP gave me did not only crash regularly but also auto enabled WPS, and a remote telnet administration port every other day which was insecure as fuck. These were only the obvious flaws. Sometimes your only choice is changing the ISP.
- cleanyourroom 9y agoDisable upnp. Define port forwarding statically where necessary.
- ShorsHammer 9y agoHad experience with multiple ISP's pushing their own heavily marked-up and broken routers. I assume its a good money maker. If only there was a slither of corporate responsibility and associated punishment, probably a big ask from governments benefiting handsomely from the vulnerabilities despite the loss to the citizens they represent. Guess it could be considered a new form of taxation? National security only really extends the physical domain.
- dcow 9y agoI don't really think this is one of those cases unless I missed some trend recently where the govt is using misconfigured routers to access home networks... This is an overly scary article about running upnp on the wrong interface.
- ShorsHammer 9y agoSorry perhaps I don't understand your point, but the research in this article is entirely about governments and bad actors penetrating home networks for their own use.[1] Are you suggesting private APT's exist? Seen no evidence so far that it's anyone but a dozen nations who lamely try to rebrand every now and then. UPnP is a world of trouble in general, but even moreso for the average person disabling it in a house full of kids. There's needs to be responsibility taken by any large tech company pushing insecure products on their customers. [1] researchers at Symantec had uncovered parts of this proxy network due to their ongoing investigation into the “Inception Framework,” and the APT group behind it.
- dcow 9y agoSorry perhaps I don't understand your point, but the research is about governments and bad actors penetrating home networks for their own use. Source? This isn't a new report. All it talks about is that misconfigured upnp is used by one APT framework (see: https://www.symantec.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies https://www.symantec.com/blogs/threat-intelligence/inception...).
- riobard 9y agoYet another misuse of 1.1.1.1 in the figures. Actually, it was a mistake NOT reserving more human-friendly IP blocks for documentation/example purpose. The three /24 blocks reserved all fail blatantly because nobody remembers them, and they look as unsuspicious as normal blocks. 1.2.3.0/24 would be a much better choice because people would easily remember them and know it's not "real", just like you would not take a phone number 123-4567 on a filled form as "real" (even though it might be). Next time you make anything, please remember to design for human.
- tinus_hn 9y agoIf you make it foolproof, the world will just create better fools.
- ge0rg 9y agoExcept that everybody knows that the "fake" phone number prefix is 555: https://en.wikipedia.org/wiki/555_(telephone_number) https://en.wikipedia.org/wiki/555_(telephone_number) ;-)
- IncRnd 9y agoExcept that not everybody knows that. I use the # for information at stores, when asked for a #, and the cashiers usually have no idea what 555-1212 means. In my sample, the vast majority of people do NOT know.
- throwawya1w2 9y agoI thought my home network was secure. Last week, I turned on my Surface and its lock screen had a "remote session active" screen. Before I could do anything, it turned itself off. When I turned it back on, it showed "low battery" and turned off. I have no idea if this was a bug or somebody remotely accessed it. I had everything updated to the latest software/firmware. Remote desktop itself was disabled on the surface (though it had "allow remote assistance" enabled"). I didn't have router web administration enabled. Router admin password as well as wifi password were unique, 15-20 chars long and I never used them anywhere else. Same thing for my Microsoft account that I use for Windows login. Wifi also had MAC address filtering enabled. There was only one more person using my network, and its unlikely they would do this because I don't think they know my password. And I don't think they are that technically knowledgeable other than to use a PC for browsing. I also had a Synology NAS with OpenVPN. Router was configured to forward the VPN port, but Synology's firewall was configured to allow connections only from 2 IP ranges that my phone gets when on mobile network. Strangely, after this incident, I turned off the VPN and now my NAS goes to sleep properly. It never used to sleep before. I sit right next to the NAS and I could hear the HDDs reading/writing all the time, although slowly. I always used to think may be someone was slowly copying files from my NAS. I had earlier setup a pfsense box purely for ad blocking and to keep out Google/Microsoft creepware. But I had stopped using it because of the learning curve. Now, I am learning how to properly configure it. Its kind of amusing if you think about it. In olden days, people had to worry about physical attack of their house. Nowadays, I am more worried about these virtual attacks.
- throwawya1w2 9y agoRegarding pfsense, I want to add some more info just so that people may not getting any wrong idea about it. I stopped using pfSense because I had enabled many block lists in pfBlockerNg and it was blocking sites like Github. Now, I am learning how to properly configure it. I also setup an ELK dashboard yesterday night. This is a heatmap of the scans in last 30 minutes. https://imgur.com/a/cU5F0 https://imgur.com/a/cU5F0
- tinus_hn 9y agoRouters and NAT only protect against incoming connections. If someone can force your computer to make an outbound connection there is no protection.
- techload 9y agoI'm surprised that there are no TP-Link routers on the list of affected manufacturers.
- milankragujevic 9y agoMe too, but I'm quite disappointed that Netis is on the list, with literally every model they made, and I have installed about 50 routers from Netis for neighbors because I thought they were "not that bad" given they cost $10 with a 2 year warranty. But, I was wrong.
- mondoshawan 9y agoSurprised to see Ubiquiti on that list. Thankfully, the EdgeRouter series doesn't show up there! Still, I'll be blocking port 1900 and focusing more on defense in depth on my home net... The irony is that back when I was a teenager adminning our home routers, I'd always disable UPnP simply because of what it is -- at the time it stood to reason that any consumer POS device could bypass the firewall with it and do horrible things from the inside out. Nowadays I've become a bit lazy because I think I'm pretty fatigued at fighting this kind of junk.
- dralley 9y agoGood. I updated the firmware on my Archer C7 anyway, though.
- AndyMcConachie 9y agoThis Phrack article predates their 2011 reference to successful UPNP exploit by 3 years. http://phrack.org/issues/65/5.html#article http://phrack.org/issues/65/5.html#article UPNP is a mess and I'm not even sure if there is a way to proplerly make it secure.
- sokoloff 9y agoTo save some googling, as neither this article nor the Akamai report defined “APT”: https://en.m.wikipedia.org/wiki/Advanced_persistent_threat https://en.m.wikipedia.org/wiki/Advanced_persistent_threat
- tbihl 9y agoAt this point, if you're reading an Akamai report, APT probably stands alone as a term. On a list of abbreviations their readers should know, it's not quite 'IP address', but surely it's ahead of 'DNS'.
- kuon 9y agoWhy is UPnP even a thing? I mean, with NAT hole punching you can do P2P, and if you are hosting anything (web server or even bit torrent), manually forwarding a port should be within your reach. I've been using an OpenBSD based router for years with no UPnP support and never had any issue (like unable to play online games or anything). I'm really curious why it's present on all home routers.
- puwhfgwheg 9y agoHole punching is ineadequate for routers with address-dependent NAT mappings or with DS-Lite/CGNAT. With UPnP-IGD or NAT-PCP/PMP the CPE can forward the port mappings to the AFTR/CGN.
- deleted 9y ago[deleted]
- LinuxBender 9y agoUPnP / SSDP is a half baked standard will be a thing for the foreseeable future unfortunately. I say half baked, because with just a little effort and critical thinking, users would have full control over the interaction between their systems and their routers. For starters, a lot of gaming companies now depend on people having this so that the users run the servers instead of the gaming company having to pay for the infrastructure. They won't begin to explain to kids how to forward ports. Many app makers now assume this as well and certainly do not want to explain to non technical users how to forward ports to a machine on their network. IoT is just leveraging an existing precedence.
- kuon 9y agoI guess that's how we end up with situations like http://www.insecam.org/ http://www.insecam.org/ I think this kind of knowledge should be common, I mean, you should have a "network" course at school, learn how to forward ports and basis about how internet works. Well, this is another discussion.
- always_good 9y agoNothing is going to change until this kind of stuff affects the financials of the people using these bad router configs, compromised internet of thing devices, malwared computers, and anything else that creates a bunch of outbound traffic. It should be impossible to be unaware that your home network's outbound is saturated all month. It's ridiculous.
- rando444 9y agoSo the way to get the elderly, non-tech savvy, and low usage users to buy a new router is to make them suffer financially?
- notyourday 9y agoI know I'm a strange fellow, but I am having a hard time to understand why consumer grade routers are such garbage. I have been using 2x wall-mounted industrial mini PCs running Debian to cover 2400 sq two story house. They just work. They have no software that is tricky or unknown. Hell, the one that has a cross connect to the cable modem even run a firewall. Speeds blow consumer routers out of the water. I even have a guest network so the visitors can access internet and not see anything else they are not supposed to have access to. Cost? $300 for both.
- ryandrake 9y agoYou can buy these things for $15. How much rigorous design, care, and quality testing do you think they get? To these companies, “software” is just a line on the BOM, like a screw or plastic piece. It’s something you source as cheaply as possible and pour into the product as the last step in the assembly line. It’s amazing that these devices even work.
- outworlder 9y agoTrue. But you can get Mikrotik routers for about $50, which are great. Also you can choose to have a dedicated router with no wireless, and have a dumb access point dealing with the wireless part. However, ordinary consumers won't bother.
- xiao_haozi 9y agoYou don't happen to have a writeup about your hardware selection and how you configured these do you? I've been thinking of going this way in a new house.
- notyourday 9y agoI have a pile of notes that I was planning on organizing and publishing over next week or so. I will get back to this thread or submit it when it is done.
- gvb 9y ago
- orliesaurus 9y agoHow do I know if my router is affected? EDIT: nvm, here is the list https://www.akamai.com/us/en/multimedia/documents/white-paper/upnproxy-blackhat-proxies-via-nat-injections-white-paper.pdf https://www.akamai.com/us/en/multimedia/documents/white-pape...
- kevinSuttle 9y agoScript doesn't appear to be formatted for copy/paste...
- trumped 9y agoMy router is affected but I would never enable UPnP or remote management ...
- milankragujevic 9y agoI sent an Email to Telecom Serbia warning them that ZTE ZXHN H1X8N XDSL modems they've been giving to customers are vulnerable and they should push new settings through CWMP that disable UPnP.
- 0xffff2 9y agoHow many home routers are there in the world? 65,000 actually sounds like a shockingly low number to me.
- campuscodi 9y agoAkamai found evidence of compromise on 65,000. Said around 4 million were vulnerable.
- alexharrisnyc 9y agoWe have found a large amount routers hitting our servers at my current job using routers with poor or no security. It seems as if they tend to be using email password dumps and just going through their lists through these routers trying to log into our site.
- jacksmith21006 9y agoOne of the reasons went to using the Google WiFi as home as did not want to worry about things like this or keeping my network gear up to date.