15 ms·
A 100k Botnet Turns Home Routers to Email Spammers
- degenerate 8y agoA much better, more thorough analysis, complete with affected router model numbers, graphs, charts, and area affected map are at the source post: https://blog.netlab.360.com/bcmpupnp_hunter-a-100k-botnet-turns-home-routers-to-email-spammers-en/ https://blog.netlab.360.com/bcmpupnp_hunter-a-100k-botnet-tu...
- givinguflac 8y agoCame here to ask for this. Thank you very much.
- reaperducer 8y agoIceland and India are either the best or the worst places to be to avoid this exploit. The map doesn't have a scale, so it's hard to tell. Aside from that, it's very interesting and a good, quick read. Makes me sad that Apple got out of the router business.
- spudlyo 8y agoIs there any reason we can't replace the link on the front page with this one? It's clearly a much better article.
- dang 8y agoWe've changed the URL to that from https://nakedsecurity.sophos.com/2018/11/12/botnet-pwns-100000-routers-using-ancient-security-flaw/ https://nakedsecurity.sophos.com/2018/11/12/botnet-pwns-1000.... Thanks!
- mark-r 8y agoI think you just killed the site. I get a 504 error.
- eikenberry 8y agohttps://web.archive.org/web/20181112153533/https://blog.netlab.360.com/bcmpupnp_hunter-a-100k-botnet-turns-home-routers-to-email-spammers-en/ https://web.archive.org/web/20181112153533/https://blog.netl...
- mark-r 8y agoThanks for that! The usual Google cache wasn't working for me in this case.
- deleted 8y ago[deleted]
- mr_toad 8y agoServer seems to be down.
- deleted 8y ago[deleted]
- CNJ7654 8y agoLol, I love the phrasing of the title. Like they unearthed an old and forgotten mezoamerican curse against a broadcom executive's ancestor.
- testplzignore 8y agoHow many home routers aren't compromised or have known vulnerabilities? It would interesting if a study looked at a random sample of the population of home routers to determine this. Go to people's homes and actually check. These articles always seem to look at it from the "how many compromised routers have we found so far" angle. I suspect that if the story was "90% of home routers have known unpatched vulnerabilities", these security issues would be taken more seriously by the companies responsible for them. And if they don't act, regulate them out of existence.
- lbriner 8y ago> And if they don't act, regulate them out of existence. Sounds easy but doesn't work IRL. The service providers don't build the units and rely on the supplier. The supplier might have patched it but wants money, the ISP doesn't want to pay. Maybe the patch breaks something else and the ISP don't want to put that on all their users. Also, not all vulnerabilities are equal. Some are more serious than others and require patching urgently, others less so. And not all ISPs can push a patch so how do you tell everyone to update and what happens when it doesn't work and 1M people are calling Customer Support?
- toomuchtodo 8y agoComcast has functionality where they will email and/or text you if your connection has botnet or other nefarious activity on it and will disconnect you until it's resolved. Not a fan of them, but it's something they get right. https://i.imgur.com/cYKXtII.png https://i.imgur.com/cYKXtII.png
- paulie_a 8y agoIf an ISP can't push reliable updates to their hardware they shouldn't be in business. Vulnerabilities should be prioritized of course. But I honestly don't mind when someone creates a worm that bricks crappy devices that isps know are vulnerable. It's a public service at that point.
- codetrotter 8y ago> regulate them out of existence When the main players of an industry demonstrate unwillingness to take it upon themselves to resolve problems that negatively affect society at large, something needs to be done for sure. I am generally in favor of regulation, and it might be the answer in this case also. However, I worry that the regulations that would be introduced to fight router vulnerability might lead to a situation where router owners no longer have the possibility of flashing third-party firmwares such as DD-WRT. In my opinion, being able to flash third-party firmwares is more important than a lot of people might realize. Firstly, router makers necessarily target the market as a whole, and as such the factory firmwares found in consumer grade routers are generally lacking in advanced features that only a small portion of the market has a need/desire for. Secondly, open source firmwares can more readily be audited for backdoors. Of course, backdoors could still exist in parts of the router hardware that are not controlled by the main firmware though... Anyway, the reason I worry that regulation might threaten the possibility of running third-party firmware is two-fold: 1. The regulations might specify that bootloaders need to be locked down, etc. 2. Router makers might decide to lock down the routers even if the regulations don’t directly require it, in order to be able to prove that security demands are met. 3. Router makers might use regulation as an excuse to lock down routers even if there is no real reason to do so.
- commandlinefan 8y ago> Universal Plug-n-Play And, like so many other attempts to "simplify" supposedly complex configuration, in addition to being a massive security hole to attackers, it's almost useless to the home users for whom it was meant because it only works under a very narrow, mostly undocumented set of assumptions and if any of those assumptions are invalid, it fails silently.
- nerdponx 8y agoIf I have UPnP disabled, am I safe?
- greglindahl 8y agoThere's no way to be "safe". You might be safer if you disable UPnP, it certainly decreases the attack surface.
- creeble 8y ago> There's no way to be "safe". You're implying that all routers are vulnerable?
- flylikeabanana 8y agoI think the point is that any software system is vulnerable
- creeble 8y agoVulnerable to this particular exploit? Your router is either vulnerable to this exploit, or it's not. Afaict from the article, the exploit relies on a UPnP-enabled router; if UPnP isn't enabled, I don't believe your router is vulnerable.
- kibibu 8y agoNo routers are invulnerable.
- jrochkind1 8y agoIs there any easy way to check if your router is vulnerable/compromised? Or instructions for disinfecting it as well as patching it? Like, based on actually being exploitable or compromised, not firmware versions or whatever. I actually suspect mine is compromised, it's been behaving funny for a month or two, needing to be restarted a lot. (Which, ironically, is a signal of a _buggy_ compromise, your router of course be compromised and you'd never know it if the malware was well-behaved enough to stay out of the way of your usual use). I can (painfully) update the firmware... but I don't trust that the vendor's most recent firmware actually solves it. Nor do I trust that once compromised a firmware update is enough to eliminate the malware. For such a widespread compromise... we could use more user-friendly (or even relatively techy but not a network engineer user-friendly) instructions for... what to do. I guess the reality is that most (non-techy) users will, if they notice at all (due to malware that buggily causes things not to work well for intended uses, instead of staying out of the way), will just decide their equipment is "broken", throw it out and buy new stuff... that hopefully won't get compromised again. Which I guess works for the consumer network harder vendors.
- spudlyo 8y agoIf I were you I'd check to see if your router can run one of the several open source firmware packages like OpenWRT, dd-wrt, or Tomato. In my personal experience the OpenWRT/lede team is on top of security issues, and the router web interface and tooling is completely fine. I'd be confident that flashing your device with modern open source firmware would solve the problem, but if you're paranoid just recycle the device and get a new one. In any event, I don't see a solution for you that doesn't involve some homework.
- rubatuga 8y agoYeah, you can start by resetting the NVRAM of the router, (30-30-30 reset) then get a flash chip clip, read the data off the router flash using a raspberry pi, and compare it to the firmware binary from the router manufacturers website.
- deleted 8y ago
- deleted 8y ago[deleted]
- josteink 8y agoAnd OpenWrt users everywhere feel totally superior once again. Seriously though: this is why you don’t let your device run unvetted firmware by vendors who don’t provide updates. Load it with a Linux-distro you can update yourself to keep it rolling and secure.
- muxator 8y agoPersonally, I can no longer even conceive running the standard firmware on a critical piece of my home's infrastructure. Plus: good performance, a lot of flexibility, and a nice web interface (if one wants it). OpenWrt has really been a good experience for me.
- OJFord 8y agoI keep looking into it and keep stopping at 'what should I buy'. I'm willing to / assume I need to buy new hardware. What do I buy that will run it well, and continue to?
- rubatuga 8y agoBuy the Archer C7 version 2, and install the optimized version of openwrt: https://github.com/infinitnet/lede-ar71xx-optimized-archer-c7-v2 https://github.com/infinitnet/lede-ar71xx-optimized-archer-c... This build gets ~750 mbps NAT speed as opposed to vanilla openwrt, which is around ~300 mbps.
- deleted 8y ago[deleted]
- josteink 8y agoWhile I think this is a really good OpenWrt-router, with good value for money and easy installation... It is fair mentioning that this model is discontinued from TP-Link and you will probably have to buy it second hand. It also comes in at least 5 revisions, with various levels of support, making life a little bit more difficult for the average, uninformed buyer. As a side note: I have a 350mbps symmetrical FTTH link and I've had no issues maxing this line with regular, official OpenWRT builds. Unless you need significantly higher speeds and can prove that official builds can't do it, I see no reason to go with unofficial, unsupported builds.
- deleted 8y ago[deleted]
- gammateam 8y agopwn: the second derivative of getting owned
- grezql 8y agoI wish this botnet would delete the infected hosts facebook accounts. Like it asks fb for deletion, then hides the confirmation mail. After 30 days when the account is permanently deleted , it would erase itself from the host + patch the vulnerability. I would've awarded the worm author the prize for contributing to the mental wellbeing of the society.
- rbanffy 8y agoWhat if someone did that, but to use the routers for some charitable distributed computing project? Or mining crypto currencies and giving the proceeds to the router's owners? Or perhaps a globally distributed weather prediction system that automatically detects network enabled weather stations and predicts weather everywhere for free? Or a distributed P2P social network?
- aplummer 8y agoI like the outside the box thinking for positive, however the environmental impact of crypto makes the latter seem like a net negative, given the compute efficiency :/
- rbanffy 8y agoSure, but if the increase in power usage is marginal enough, maybe it'd be worth it for the router owner and be useful for the community at large. Even if it's a crime to do it without permission ;-)
- cliffy 8y agoIt's morally wrong. You don't suddenly have the right to use someone else's personal belongings as you see fit just because they left a door or window unlocked.
- rubatuga 8y agoWhat if the router was being unused? What if the power usage was minimal? I think it is unethical not to utilize resources that are being wasted.
- dymk 8y agoI hope your parents taught you to ask before invading somebody's personal property. Are you okay with XYZ Tech Company snooping on your private messages, emails, or credit card transactions? The impact that you'd see would be minimal (aside from more targeted ads, perhaps), and it's data which would otherwise be "wasted" if nobody was mining it.
- black-tea 8y agoIt's interesting to me that "pwn" has entered the respectable lexicon. If I were to talk about "haxxors" or "warez" I don't think I would be taken very seriously on here. I guess it's because "pwn" occupies a meaning not fully encompassed by any other word. There is "root" which is itself a slang term but it's too specific, I suppose, and "compromised" is just too long,
- macintux 8y agoI can say "pwn" is not something I would ever write in a serious document, but I'm also an old fart.
- WrtCdEvrydy 8y agoIt depends on the age... usually for the board, we use 'compromised', because every one of those guys is scared of compromising pictures coming out (snorting milk powder off a friend's breasts for example)
- stochastic_monk 8y agoI imagine that most lingo dialects have a subset of terms which export more easily. A concise hacker community-originating term for compromise seems like a prime candidate.
- Bucephalus355 8y agoThey are currently talking about creating a cyber civilian corps that would be under the Department of Homeland Security. The purpose would be some yet to be defined “assisting businesses and state / local governments in crisis”. However maybe we should have them knocking on doors having ppl set up their home network. Obviously a lot of responsibility is being pushed back on companies to make this easier, but still we have all these old devices out there humming along. https://www.newamerica.org/cybersecurity-initiative/reports/need-c3/3-a-us-cyber-civilian-corps-how-would-it-be-organized-and-staffed/ https://www.newamerica.org/cybersecurity-initiative/reports/...
- jsjohnst 8y agoIt’s been talked about for years under DHS. I was part of one of the early iterations of it called NetGuard. I have zero hope for any such initiative after the experience despite thinking its sorely needed.
- 9712263 8y agoSo, what is the most secured option for the moment? Buy a x86 box and turn it into a router? But it consumes more power than a low-power router, and buying more network adapter is not that cheap. I am currently using the open source tomato firmware. However, since there is a bug/feature in the router so that I cannot flash an image too large, or otherwise it would not work. Also, the configuration is limited to 32 KB, if configure too much, then the configuration file will become gibberish and some random feature in the router would be missing, and required a factory reset to fix. So, I am stuck with an older version of tomato which guarantee some kind of vulnerability is not fixed. Not sure what I can get in the form size of a router. Raspberry pi may work but too few ports available. I heard that the CPU would get hot for intense network traffic.
- varjag 8y agoFind a not too old Cisco integrated services router, set it up to drop everything coming from outside, and run DHCP network(s) on the inside. Use WiFi routers in bridge/access point mode. Drawback is they tend to be noisy, but if you have a basement/closet..
- NullPrefix 8y agoYou only need two network adapters, other devices could be connected by a switch.
- walrus01 8y agoFor something really small the ubiquiti edgerouter devices which run their EdgeOS are a good choice. If there's a serious security vulnerability on the WAN-facing interface it will be patched. They run a fork of Vyatta. Ubiquiti employs most of the old Vyatta development team, who did not go to Brocade when Vyatta was acquired. Or build a really small low power x86 system with a few Intel gigabit NICs in it and run open source VyOS.
- eikenberry 8y agoSo the ERLite-3? https://www.ubnt.com/edgemax/edgerouter-lite/ https://www.ubnt.com/edgemax/edgerouter-lite/
- weinzierl 8y agoGermany is a nice white spot on the map because they all run their Fritz boxen, which seem to be unaffected by BCMPUPnP_Hunter.
- jothezero 8y agoThe kind of subject I love...!!
- SlowRobotAhead 8y agoReminds me I haven’t updated my pfSense router in awhile. Nor have I ever heard about a flaw like this for them as it were. But also, can we stop with “pwns” in a serious website? Almost makes me think the comment section would start with someone saying “First!”.
- Scoundreller 8y agoI’ve said it before: it shouldn’t be that hard for someone handy with a soldering iron to “harden” their router: Look up the Pinout for the flash chip, find the write-enable line, and put it on a switch to lock firmware updates. This won’t protect you against non-persistent malware, but it will prevent malicious updates. One could attach a bit of logic and an LED to this line to switch on when a flash is attempted. Then you know something bad is in the stream.
- albertgoeswoof 8y agoWhat about non malicious security updates?
- Scoundreller 8y agoFlip the switch when you want to allow them (but why accept random OTA updates?). The LED logic should signal you when there's an update coming in OTA, and you can verify for yourself if there's a legitimate update (and possibly load it yourself).
- trulyrandom 8y agoI must be missing something, but why are all these routers publicly listening on port 5431?
- mr_toad 8y agoPorts 5431 and 1900 are used for UPnP. I can’t think of any good reason they should be listening on an external interface, but maybe the port scanning is happening on the inside.
- trulyrandom 8y agoThat's the thing, it looks like they are listening externally: https://www.shodan.io/search?query=Server%3A%20Custom%2F1.0%20UPnP%2F1.0%20Proc%2FVer https://www.shodan.io/search?query=Server%3A%20Custom%2F1.0%.... I tried a couple of those IPs and can reach all of them on 5431.
- rthille 8y agoYeah, DNS rebinding attacks can allow malicious Javascript running inside the network attack the router from the LAN side.
- stevenicr 8y agoI think it's time for windows, and ios, and firewall / antivirus companies to scan for info about the routers used and alert people that their network is easily hacked, may already be hacked, and is in danger of being used by criminals to attack other countries and companies. Extra info such as, the router you are using has not had any available firmware updates for 3 years and likely needs to be replaced. It's obvious we are not going to get this info to most people from the IOT manufacturers. This could be quite beneficial for those who hook up thier phones to different wifi networks as well - a pop up showing that their router / internet gateway model has been shown to be used in at least 100,000 other malware exploits, and should not be trusted like your cell connection - It's time to start shaming and naming - the bad guys already know how to get this info, we need to make it easier for the end users to become aware. A service that will email you when firmware is available for your equipment, or your equipment is listed on shodan, blackhathacksrus, or other places may be beneficial as well. Set it up to take serial numbers scanned with an app, and give notices on recalls and physical theft recovery. We obviously need something, and possibly many things tp help with this. I can't believe a certain router company a few years ago did not offer to send a rebate if I returned their no-longer-updated-hardware when I emailed them inquiring about a published exploit and lack of updates. I no longer use that brand or suggest it. They could of kept a customer and made things better, they did neither.
- achillean 8y agoWe actually offer such a monitoring service at Shodan, though it's largely aimed at companies so you need to use the API. Here's an article on how to setup a real-time monitor for your network: https://help.shodan.io/guides/how-to-monitor-network https://help.shodan.io/guides/how-to-monitor-network
- jammygit 8y agoHow exactly does one go about buying a router that is not going to turn evil? Is there some company with open source software and easy setup, or some other easy solution?