Botnet targets openwrt/dd-wrt devices

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Botnet targets openwrt/dd-wrt devices

freitasm

BDFL - Memuneh
79306 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#31615 24-Mar-2009 14:46

Reports are coming of a botnet worm that infects DSL modems and routers, including those running openwrt/dd-wrt:

- is the first botnet worm to target routers and DSL modems
- contains shellcode for many mipsel devices
- is not targeting PCs or servers
- uses multiple strategies for exploitation, including bruteforce username and password combinations - harvests usernames and passwords through deep packet inspection
- can scan for exploitable phpMyAdmin and MySQL servers

mjb

996 posts

Ultimate Geek

Trusted

#203032 24-Mar-2009 14:50

linky not good... :(

contentsofsignaturemaysettleduringshipping

freitasm

BDFL - Memuneh
79306 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#203034 24-Mar-2009 14:52

mjb: linky not good... :(

Linky thing fixed by the LinkMeister now...

Ragnor

8223 posts

Uber Geek

Trusted

#203070 24-Mar-2009 17:46

Hmm that's cheeky but I note it requires remote/wan side login/admin to be turned on.

So basically don't let your router accept logins web/ssh/etc from anywhere outside your home network which is normally the default setting and use a strong password that can't be bruteforce/dictionary hacked.

stevonz

397 posts

Ultimate Geek

Trusted

#203304 25-Mar-2009 17:35

This report http://apcmag.com/new-worm-can-infect-home-modemrouters.htm states that over 30 different Linksys models, 10 Netgear models, and a variety of other cable and DSL modems can be affected...

Cheers, Stevo

freakalad

231 posts

Master Geek

#203710 27-Mar-2009 12:55

Simple & effective solution for now would be to make use of strong username/password combination, & not allow for remote access other than over VPN.

Aslo, disable/remove stuff like wget & other mechanisms that would allow for the download of remote code.

http://www.bit-tech.net/news/bits/2009/03/26/worm-targets-linux-routers/1?tcs=nl
http://it.slashdot.org/article.pl?sid=09/03/23/2257252
http://dronebl.org/blog/8
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=49370&highlight=psyb0t

If the box was initally set up retty securly, you should be OK.
Keep an eye out for upcoming updates

- J

FLOSS'er, aspiring Maker