4 ms·

It turns out that chknvram is one part of the asd service, and it regularly downloads signature files looking for malwares. * https://www.snbforums.com/threads

• iforgotpassword 3y ago
  In the comments of the article someone mentions that deleting the file solved the issue without a firmware update. Too bad they didn't save it before, a comparison with the newer working version would be nice. I guess Asus quickly discovered their mistake and removed the faulty file from their servers, but affected devices never got to the point where they'd look for a newer file but just choked on the local one.
• denton-scratch 3y ago
  > it regularly downloads signature files Why does a router need malware signature files? It has no business monitoring my traffic, except in accordance with the firewall rules that I set myself. From the article: > not keeping my firmware up to date I've had this (non-Asus) router for three years. I've never updated the firmware.
  • unpopular42 3y ago
    > I've had this (non-Asus) router for three years. I've never updated the firmware. Botnet operators are very grateful for your cooperation, you are helping them a lot
    • vultour 3y ago
      I've never updated the firmware on any of my routers, and I'll be happy to give you a million dollars if you can prove that it's part of a botnet. This pathethic holier than thou attitude is obnoxious, you really think 95% of routers are part of a botnet? Or that they're even accessible from the internet?
      • intelVISA 3y ago
        As 100% of Asus routers are part of the Asus botnet so I'll take my chances on that 5% with my custom, libre, hand-rolled breadboard router.
      • crazygringo 3y ago
        > you really think 95% of routers are part of a botnet? Or that they're even accessible from the internet? It's probably not 95%, but it's certainly significant. And yes, most consumer routers are obviously accessible from the internet, that's how they work (they're generally not behind a firewall, they are a firewall, and can have vulnerabilities). You might want to read up on it [1, key quotes below], and I know I certainly wouldn't be willing to wager my consumer router wasn't infected, because how would I ever have any idea? > Out of the box, most routers suck when it comes to security. Vulnerable firmware is an easy target. Backdoors have been discovered in just about every brand of router... It's possible you will never even know your device is infected... > When we're talking about routers, these aren't the enterprise-level gear made by the likes of Cisco, Sonicwall, or Palo Alto... We're talking about what you would get off the shelf at Wal-Mart or Best Buy — the D-Links, Netgears, and Linksyses of the world. > The problems start with the cheap, antiquated MIPS architecture used by a lot of these devices' processors... One substantial problem comes from a security flaw that goes back to 2001. Per one deep yet fascinating paper, the chips lack basic defensive abilities against malicious code execution. Combine this with manufactures commonly implementing out-of-date, vulnerable Linux kernels in their devices, and then putting this device on the edge of your network completely exposed to the internet. But to sum up -- not updating your router's firmware is a terrible idea. It's not something to be proud of. [1] https://www.cbtnuggets.com/blog/certifications/security/your-router-is-probably-a-zombie-in-a-botnet https://www.cbtnuggets.com/blog/certifications/security/your...
    • AviationAtom 3y ago
      If you don't expose any external services of the router then it's a bit hard for botnets to take advantage of your router. Most of these routers are likely becoming part of the botnet for enabling external web management and/or using default creds (especially if SSH is exposed externally). Security isn't exceptionally hard, if you actually put some effort into it.
      • chatmasta 3y ago
        There have been plenty of router exploits that begin with a pivot from a web browser to a poorly secured admin panel on the local network. Firewalling incoming traffic from the Internet to the router's management interface is no security panacea.
        • AviationAtom 3y ago
          Again, as I mentioned, the bulk of those rely on default creds. Many of the big manufacturers have been tackling that issue by forcing a password change at setup and not allowing an insecure default to be chosen.
        • numpad0 3y ago
          > a poorly secured admin panel on the local network Why is the web interface left on? Just turn that off, there shouldn't be much to do with that.
          • AviationAtom 3y ago
            Not sure you'll see this, with HN's lack of notifications, and so much time elapsed but here's the answer: Most consumer routers do not support disabling the web interface on the local network, as it's the primary (only?) means of administration for them. This attack relies on getting users to browse to an address with default creds by some means, with a URL prepended that will cause the desired action to occur. More often than not a popular action is to modify the DNS servers used, so that DNS traffic can then me manipulated to point to malicious servers used for the ultimate attack.
        • deleted 3y ago
    • than3 3y ago
      Don't forget the biggest botnet being ASUS who didn't disclose the scanning... or whatever else they happen to be doing without the explicit consent of the owner. Issues like this don't happen across such a wide area by accident. Basic professional practices have any updates tested beforehand on physical hardware at multiple stages before any push happens, and they leave it up to the user because pushing an update without the owner's explicit consent to a device they own, runs afoul of the same hacking abuse laws. The legal exposure is massive. It also doesn't account for the fact that firmware was attempted to be updated on devices which were set to not update. ASUS has a lot to explain. They didn't release any kind of statement so the lawyers and computer forensics people will likely need to get involved to get to the bottom of it. I look forward to eventually hearing about what really happened.
    • denton-scratch 3y ago
      Don't think so. The management interfaces are only exposed on the local network. If you could hack into my local network some other way (e.g. through Apache), you could probably attack the web interface on the router; but in fact no local network services are exposed to the internet.
      • mort96 3y ago
        It's a device that's directly exposed on the public Internet. Anyone in the world can send any package they want to it. It's not that uncommon for people to find bad bugs in network protocol stacks. An attacker wouldn't have to go through a web interface.
      • mrguyorama 3y ago
        There are a multitude of ways to trick consumer routers into letting an external request log into the web interface. That's also ignoring the multitude of ways to botnet them without using the web portal, as manufacturers suck at their job and often ship known exploited libraries and utilities. Some have had genuine back doors even.
    • Aeolun 3y ago
      Botnet operators are careful to not mess with my internet connection. If they want to use my router for other stuff while it’s not in use by me, who am I to complain.
  • Prickle 3y ago
    Well, for starters here is an article about malware specifically targeting ASUS routers. https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html https://www.trendmicro.com/en_us/research/22/c/cyclops-blink... Hopefully that clears up the first question of "why does it need malware signature files?" As for your router firmware? You should seriously update that. New exploits get found all the time. Hackers use compromised routers as parts of a botnet, a intermediary route, or as an access point with which to steal data with Man in the Middle attacks.
    • gcr 3y ago
      That’s an attack on the router itself, not the network traffic it carries. Signature files are only useful to scan network traffic.
      • Prickle 3y ago
        This was literally a discussion about the firmware of a router. How is it not relevant? This person has not updated their router's firmware in over 3 years. The viral traffic needs to get to the router in the first place. I assume that the means of reaching the router is literally via network traffic? What am I missing?
        • ploxiln 3y ago
          > Hopefully that clears up the first question of "why does it need malware signature files?" The malware signature files really don't help prevent your router joining a botnet. Firmware updates, maybe, maybe not. It is quite possible for other routers with less generally sloppy and advertised-feature-rich firmware to actually be more secure even without updates for 3 years. It's quite possible that they have no api endpoints available for super-easy mobile app integration remote management etc, just ssh from local subnet or physical serial console. There have been multiple cases of market-leading antivirus engines (symanted, mcaffee, etc) having sloppy code running with the highest possible privilege, parsing any files appearing on the system anywhere, and e.g. crashing a mail server that would otherwise be unaffected by the PoC samples being emailed through it by researchers. So, I also take some issue with people who have no understanding of how all this software around us is designed and built (in routers, in windows, on web servers) and thinking that just updating everything all the time and running antivirus is the best you can do. You really can do a lot better if you know what you're doing.
• tredre3 3y ago
  Love that thread. In typical SNB fashion everybody piles on OP for wanting to disable the scan that keeps his drives awake for days on end. They argue that he doesn't understand and he's stupid to want to be part of a botnet and that Asus obviously know what they're doing.
  • JdeBP 3y ago
    An extra fun part is that about 2/3rds of the way through in pops someone else pointing out that the closed source ASUS proprietary malware scanner decided that all of xyr /usr/lib/crt*.o files on a mounted disc volume were malwares and promptly deleted them. (-:
    • Kiro 3y ago
      Why are people mounting discs?
      • vardump 3y ago
        Probably they want to share files or to install extra software on the router?
        • Kiro 3y ago
          Why not just put the drive on the network? I'm getting downvoted but I'm just trying to understand how a router is able to delete things on an external disc.
          • nubinetwork 3y ago
            Some routers can also double as a budget NAS by plugging a USB hard drive into it. I've seen some that also double as print servers.
          • hiatus 3y ago
            How would you put the drive on the network? Attaching it to an always-on computer, or buy a nas device or something? It seems easier to plug it into your router if the firmware supports it.
• this_steve_j 3y ago
  A parsing error due to a signature-based malware definition file update is a totally plausible suspect! It would explain why the router is downloading “updates” but not firmware upgrades. Also, these signature files contain tons of hex strings and unusual characters used to identify the actual malware (IOCs). We rollback these updates all the time when a bad malware signature update pegs the AV scan daemon. They are released several times per month depending on the vendor. Someone more knowledgeable about ASUS asd can probably confirm/deny.
• smileybarry 3y ago
  The most annoying part is that security scanning is opt-in (I have it off) but I guess the service auto starts and auto downloads definitions anyway.