Slashdot Mirror
Botnet Worm Targets DSL Modems and Routers
CoreDuo writes "The people who bring you the DroneBL DNS Blacklist services, while investigating an ongoing DDoS incident, have discovered a botnet composed of exploited DSL modems and routers. OpenWRT/DD-WRT devices all appear to be vulnerable. What makes this worm impressive is the sophisticated nature of the bot, and the potential damage it can do not only to an unknowing end user, but to small businesses using non-commercial Internet connections, and to the unknowing public taking advantage of free Wi-Fi services. The botnet is believed to have infected 100,000 hosts." A followup to the article notes that the bot's IRC control channel now claims that it has been shut down, though the ongoing DDoS attack on DroneBL suggests otherwise.
Glad I recently switched my router to Tomato. Works better than DD-WRT, too.
It is no measure of health to be well adjusted to a profoundly sick society. - Krishnamurti
Don't forget, Tomatoes get worms too!
I actually RTFA, logged into my router, and I'm still not sure what to look for to see if we've been compromised.
What exactly are we looking for?
first post!
-edfardos
A. How do we know whether our kit is vulnerable?
B. How to tell whether we are infected?
C. What to do about it if we are?
I'd guess most people, even geeks, just think of their router as a black box and don't know much about them as long as they keep on working.
Not a big deal, you can just:
ssh to your router
ifconfig eth0 down
All fixed, not vulnerable anymore.
That's like saying CiCi's Pizza is the best dining experience of all time. It's not really pizza, but it is edible...
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Okay, now this is scary.
Folks having OpenWRT/DD-WRT are usually a bit more savvy that the average user, so to see something specifically targeting such users is surprising.
And the fact it's gone this long without being noticed is even MORE frightening.
[End Of Line]
Configure the device for IPv6, over a tunnel or whatever. The worm blocks your control ports using iptables, but not apparently ip6tables.
Who has their router set to allow access to the admin interface from the wan side? This is certainly not done by default. Is there some sort of browser hijack involved with this to gain access to the inside of the network?
The subject text box isn't the "write-the-beginning-of-the-message-until-space-runs-out-and-then-use-the-big-textarea-under-it" field. The big textarea under it is there for a clear reason.
Just sayin'.
Ok, TFA states
Get a shell on the vulnerable device (methods vary).
How will this supposed worm manage to login to the box? Brute force? Properly configured Linux will block login attempts for quite a while after several failures. SSH? Can't be compromised within a reasonable time. Telnet? Not supported on all routers I know.
The article doesn't go into the essential details, so I call FUD until proven otherwise.
Want to hear the voice of GOD? cat
I commented on this exact subject about 18 months ago. Amused to see the security industry finally catching up.
Every mans' island needs an ocean; choose your ocean carefully.
That's like saying CiCi's Pizza is the best dining experience of all time. It's not really pizza, but it is edible...
Sex is like pizza... Even when it is bad, it's still pizza.
... administer your home router over the Internet? Who does that? If you don't have an open port, even on these boxen, how could you be attacked?
But, it seems to me that this is more likely an attack on stock Linksys boxen that re-flashes with a special DD-WRT designed to "phone home." Yes, DD-WRT/OpenWRT are also vulnerable if they have weak passwords, but the bulk is more likely the former.
(Disclaimer: My home router runs HyperWRT & is not listed in DroneBL.)
How so? At least on OpenWrt, SSH and Webif aren't even exposed to the wan side without manually changing the iptables rules first.
I guess it's the same on DD-Wrt.
The devices that were targetted appear to have some serious flaws, here's a cite from an analysis of the malware:
"Several revisions of the NB5 modem shipped with a flaw which meant that the web configuration interface was visible from the WAN side, accepting connections and allowing users to administer the modem using the default username and password of 'admin' from outside the LAN. Furthermore, some of these modems suffered from another flaw, meaning that by default, authentication was not enabled for the web interface - meaning no username or password was required."
It really boils down to the usual find-weak-logins style of attacks, only the target platform has changed.
The commercial routers don't have this option. Um like D-link, Linksys, etc. Unfortunately they are the majority of home/small enterprise routers But this would be the trick to use.
Except anyone who's knowledgeable enough to set up a private/public key based ssh server on their router would have ditched that crippled factory default firmware in the first place and installed something more advanced like Tomato, which does have this feature.
The modem/router that Verizon provided for their DSL service had the firmware remotely upgraded. There is no way to avoid these updates. I hope it is secure. If someone roots that process, it will be the mother of all DDOS attacks.
A NYC lawyer blogs. http://www.chuangblog.com/
I'm going out on a limb and saying it probably did. I know the mangos and bananas in South East Asia taste way different than the mangos and bananas in America. I would expect the common corns are different too.
Computers allow humans to make mistakes at the fastest speeds known, with the possible exception of tequila and handguns
You see, corn was very important in Japanese culture as it was originally from Japan, although an American Indian raid stole all plants and took them to America.
However, after they met Americans which are greasy and yellowy white just like popcorn, they stopped eating it altogether.
They put it over pizza so that the Yakuza can torture its victims. Japanese people are so scared of becoming fat like Americans that they would rather commit Hairy Curry also known as Sailor Fuku than eating corn pizza.
they would rather commit Hairy Curry also known as Sailor Fuku than eating corn pizza.
I don't even know where to begin on this one...
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
The difference is... when you get desperate enough to eat disgustingly bad pizza, your friends won't bring it up for the next ten years at every possible occasion.
If I have seen further it is by stealing the Intellectual Property of giants.
While playing around with the fonera routers I already predicted issues like this: http://stefans.datenbruch.de/lafonera/whywedidit.shtml Consumer routers without decent firmware support are a even greater risk than unpatched windows systems; while access to the latter will probably be noticed, the profile of a hijacked routers stays low to its owner.
Life is just nature's way of keeping meat fresh.
Apologies. I spent the last few years building up an immunity to iocane powder.
Power does not corrupt - power attracts the corrupt.
There's lots of ways to exploit cheapo home routers, whether they're running custom firmware or stock stuff.
- Linksys firmwares have had shell execution vulnerabilities (that's how it was originally discovered that they were running Linux in the first place) as well as remote access vulnerabilities (where turning it off didn't actually work), among others.
- Many of the custom firmwares (DD-WRT in particular) are vulnerable to rather trivial XSS attacks. Yes, visit the wrong webpage with malicious javascript and your router can get owned.
- Not to mention the large number of routers with default passwords out there...
A mildly clever script could gain a large foothold quite fast, without even having to resort to password guessing.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
Some sex crust is so bad it's inedible too.
You're not supposed to eat the handle.
Give me Classic Slashdot or give me death!
This is not just flamebait, but a serious policy: IRC has been a popular protocol for years, but with the advent of more secure and less abused protocols, there is no modern excuse for permitting IRC through any network or system firewalls. That helps cut the painful-to-monitor control channel.
In fact, most corporate and institutional firewalls should only allow a few registered and useful protocols through their breaches, such as HTTP, HTTPS, SMTP, and SSH, and even those can often be funneled to a small set of securable servers. Yes, it interferes with the random-service-of-the-moment that some folks demand as their right. If they want such rights, they can pay the cost of running a host isolated by more secure firewalls and software management, outside the more trusted internal environment: folks should not expect both easy sharing of resources, and external access.
That's what she said :(
Wouldn't it be substantially easier to just set a really strong SSH password and use key-based auth if you need to configure your router remotely?
You're interrupting the flow of this conversation.
You may need to down a few pints before posting in this topic. Or at least this particular thread.
When you eat a really bad pizza, you can only really bring it up the once...