Slashdot Mirror
Botnet Worm Targets DSL Modems and Routers
CoreDuo writes "The people who bring you the DroneBL DNS Blacklist services, while investigating an ongoing DDoS incident, have discovered a botnet composed of exploited DSL modems and routers. OpenWRT/DD-WRT devices all appear to be vulnerable. What makes this worm impressive is the sophisticated nature of the bot, and the potential damage it can do not only to an unknowing end user, but to small businesses using non-commercial Internet connections, and to the unknowing public taking advantage of free Wi-Fi services. The botnet is believed to have infected 100,000 hosts." A followup to the article notes that the bot's IRC control channel now claims that it has been shut down, though the ongoing DDoS attack on DroneBL suggests otherwise.
Glad I recently switched my router to Tomato. Works better than DD-WRT, too.
It is no measure of health to be well adjusted to a profoundly sick society. - Krishnamurti
Don't forget, Tomatoes get worms too!
A. How do we know whether our kit is vulnerable?
B. How to tell whether we are infected?
C. What to do about it if we are?
I'd guess most people, even geeks, just think of their router as a black box and don't know much about them as long as they keep on working.
Considering that TFA says one of the things the bot does is lock you out, I suggest that if you can log in, you are fine :-)
Repton.
They say that only an experienced wizard can do the tengu shuffle.
Not a big deal, you can just:
ssh to your router
ifconfig eth0 down
All fixed, not vulnerable anymore.
Okay, now this is scary.
Folks having OpenWRT/DD-WRT are usually a bit more savvy that the average user, so to see something specifically targeting such users is surprising.
And the fact it's gone this long without being noticed is even MORE frightening.
[End Of Line]
Who has their router set to allow access to the admin interface from the wan side? This is certainly not done by default. Is there some sort of browser hijack involved with this to gain access to the inside of the network?
The subject text box isn't the "write-the-beginning-of-the-message-until-space-runs-out-and-then-use-the-big-textarea-under-it" field. The big textarea under it is there for a clear reason.
Just sayin'.
Ok, TFA states
Get a shell on the vulnerable device (methods vary).
How will this supposed worm manage to login to the box? Brute force? Properly configured Linux will block login attempts for quite a while after several failures. SSH? Can't be compromised within a reasonable time. Telnet? Not supported on all routers I know.
The article doesn't go into the essential details, so I call FUD until proven otherwise.
Want to hear the voice of GOD? cat
I commented on this exact subject about 18 months ago. Amused to see the security industry finally catching up.
Every mans' island needs an ocean; choose your ocean carefully.
... administer your home router over the Internet? Who does that? If you don't have an open port, even on these boxen, how could you be attacked?
But, it seems to me that this is more likely an attack on stock Linksys boxen that re-flashes with a special DD-WRT designed to "phone home." Yes, DD-WRT/OpenWRT are also vulnerable if they have weak passwords, but the bulk is more likely the former.
(Disclaimer: My home router runs HyperWRT & is not listed in DroneBL.)
How so? At least on OpenWrt, SSH and Webif aren't even exposed to the wan side without manually changing the iptables rules first.
I guess it's the same on DD-Wrt.
The devices that were targetted appear to have some serious flaws, here's a cite from an analysis of the malware:
"Several revisions of the NB5 modem shipped with a flaw which meant that the web configuration interface was visible from the WAN side, accepting connections and allowing users to administer the modem using the default username and password of 'admin' from outside the LAN. Furthermore, some of these modems suffered from another flaw, meaning that by default, authentication was not enabled for the web interface - meaning no username or password was required."
It really boils down to the usual find-weak-logins style of attacks, only the target platform has changed.
errr, yeah, if you want to kill an ant with a nuke.
Or just change your password from the default and set ssh/web/telnet administration to local segment only.
Did you read the article?
The modem/router that Verizon provided for their DSL service had the firmware remotely upgraded. There is no way to avoid these updates. I hope it is secure. If someone roots that process, it will be the mother of all DDOS attacks.
A NYC lawyer blogs. http://www.chuangblog.com/
Apparently I'm one of the "100,000" that got infected by this botnet.
This morning my router would not connect to any websites, yet my modem when directly connected to my PC still did. I reseted the settings to default, disabled the vulnerabilities that got the idiots in and put a stronger 35 character username and password.
How did I get infected in the first place? I left on remote access. And possibly my username and password weren't that complex. Live and learn I guess.
You see, corn was very important in Japanese culture as it was originally from Japan, although an American Indian raid stole all plants and took them to America.
However, after they met Americans which are greasy and yellowy white just like popcorn, they stopped eating it altogether.
They put it over pizza so that the Yakuza can torture its victims. Japanese people are so scared of becoming fat like Americans that they would rather commit Hairy Curry also known as Sailor Fuku than eating corn pizza.
The difference is... when you get desperate enough to eat disgustingly bad pizza, your friends won't bring it up for the next ten years at every possible occasion.
If I have seen further it is by stealing the Intellectual Property of giants.
Some sex crust is so bad it's inedible too.
That's what she said :(