Slashdot Mirror
Foul-Mouthed Worm Takes Control Of Wireless ISPs Around the Globe (arstechnica.com)
Dan Goodin, reporting for Ars Technica (edited and condensed): ISPs around the world are being attacked by self-replicating malware that can take complete control of widely used wireless networking equipment, according to reports from customers. San Jose, California-based Ubiquiti Networks confirmed recently that attackers are actively targeting a flaw in AirOS, the Linux-based firmware that runs the wireless routers, access points, and other gear sold by the company. The vulnerability, which allows attackers to gain access to the devices over HTTP and HTTPS connections without authenticating themselves, was patched last July, but the fix wasn't widely installed. Many customers claimed they never received notification of the threat.ISPs in Argentina, Spain, Brazil have been attacked by the worm, said Nico Waisman, a research at security firm Immunity, adding that it's likely that ISPs in the U.S. and other places have also been attacked by the same malware. From the report, "Once successful, the exploit he examined replaces the password files of an infected device and then scans the network it's on for other vulnerable gear. After a certain amount of time, the worm resets infected devices to their factory default configurations, with the exception of leaving behind a backdoor account, and then disappears."
The backdoor it leaves behind has a username of "mother" and a password that almost rhymes.
I eat only the real part of complex carbohydrates.
I read the whole of TFA and left scratching my head as to why it was called foul mouthed.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
This is the first time I've seen anything that was more than a proof of concept attack for Linux.
File under 'M' for 'Manic ranting'
Patched almost a year ago, apparently... so... I would fault ISP admins for not having a patch cycle...
Many customers claimed they never received notification of the threat
In this day-and-age if you are not proactive in your network security, it's on you.
My eyes reflect the stars and a smile lights up my face.
Wait this can't be true. I been told Linux is safe for anything like this. Was told the only way is the user has to run something it will not auto run.
What then. Fucker in now way almost rhymes with mother.
Foul-Mouthed
If you're going to lead with that, you should at least explain it in the summary.
systemd is Roko's Basilisk.
They aren't talking about PAT'ing ports 80 and 443 to your web server. They aren't talking about machines in your corporate DMZ. They're talking about having your network equipment's management interface over HTTP/HTTPS exposed directly to the internet. I have a couple consumer-grade wifi routers that have that as an option (off by default and left that way!). Sadly (having worked for a couple ISP's in my day) I can say that some of them will enable management interfaces over WWW connections - SSH, HTTP, HTTPS, etc. I've even seen RDP exposed at one place I used to work.
Bottom line - yes this is a really bad (but long since fixed) vulnerability; anybody who gets bit by this pretty well deserves a bite wound or two.
Lost connection for 6 days because of this. They are applying the patch now at least... For now on I'm blocking ports 80, 8080, 443 and 21.
Yep, I see it a LOT. The paper based CCNA guys and gals do it ALL the time. I say let them eat cake, they should have deployed the updates 7-60 days after they were released. There are bugs and new features that need to be used and tested. I prefer OpenMesh for the low end, Ubiquiti for the SMB and Cisco LWAP units for the big boys. All others are a waste of money and you will eventually have to buy something better as the junk never gets fixed.
Meanwhile nobody uses that shit.
A better article would be "Microsoft software literally is complete spyware" but where the money goes...
is to Hell.
...had learned to code.