Failed (unknown) external access to Fritzbox

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › Failed (unknown) external access to Fritzbox

Hatch

816 posts

Ultimate Geek
+1 received by user: 57

#208483 13-Feb-2017 22:59

Whilst changing some wifi settings on my 7490 I noticed 5 entries this evening:

IP geo lookup shows the connection is from the Seychelles.

Googling the IP address shows that it is has been banned for allegedly being the source of hacking in from the last few years.

I have a static ip address and have had one for a few years. Any point in asking for a new static ip address.

I spoke to a 2degrees rep but she didn't really know what I was going on about. She did confirm that 2degrees weren't behind the access attempts via the Seychelles.

Any suggestions as to what I should/can do or is this merely run of the mill random attacks?

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#1719761 13-Feb-2017 23:28

I think the term is.. were all being brute forced.

You get the idea but I have pages of it.

13.02.17 23:14:29 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 23:00:25 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 22:46:21 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 21:21:59 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 21:07:55 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 20:39:47 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 20:25:43 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 20:11:39 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 19:57:34 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password).

Guess thats why the rename the default admin name. They need to nullroute that IP

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#1719762 13-Feb-2017 23:35

Infact. lets turn off HTTPs/internet from the services section for a while.

Hatch

816 posts

Ultimate Geek
+1 received by user: 57

#1719764 13-Feb-2017 23:38

Thanks that makes me feel "better". Not seen this activity in many years of Snap and 2D patronage, mind you I only scan the logs when there is a problem, which is rare.

Oblivian:

I think the term is.. were all being brute forced.

You get the idea but I have pages of it.

13.02.17 23:14:29 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 23:00:25 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 22:46:21 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 21:21:59 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 21:07:55 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 20:39:47 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 20:25:43 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 20:11:39 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password). 13.02.17 19:57:34 Login of user admin to the FRITZ!Box user interface from the IP address 80.82.64.127 failed (incorrect password).

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#1719765 13-Feb-2017 23:40

You mean like... http://www.geekzone.co.nz/forums.asp?forumid=85&topicid=208479

I noticed from early january the external hits from India, Vietnam, Poland, Russia.. all increased

michaelmurfy

meow
13581 posts

Uber Geek
+1 received by user: 10914

Moderator

ID Verified

Trusted

Lifetime subscriber

#1719766 13-Feb-2017 23:40

I'd strongly recommend turning off any external access to your routers services. It only takes a single exploit then they've got control over your whole network.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#1719767 13-Feb-2017 23:43

michaelmurfy: I'd strongly recommend turning off any external access to your routers services. It only takes a single exploit then they've got control over your whole network.

It would appear its how they manage the configurations and updates with CPS. They put a snapadmin user on with remote access afterall. And have seen it update before by them.

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

michaelmurfy

meow
13581 posts

Uber Geek
+1 received by user: 10914

Moderator

ID Verified

Trusted

Lifetime subscriber

#1719774 14-Feb-2017 00:49

Oblivian:

michaelmurfy: I'd strongly recommend turning off any external access to your routers services. It only takes a single exploit then they've got control over your whole network.

It would appear its how they manage the configurations and updates with CPS. They put a snapadmin user on with remote access afterall. And have seen it update before by them.

Crap that is bad. Opened to the world and not whitelisted to their own management network is a terribly bad security practice no matter how secure they think the Fritz!Box is. Any open ports on an embedded system is a terrible idea. I would say it could well be Mirai attempting to brute force.

2degreesCare

1537 posts

Uber Geek
+1 received by user: 274

Trusted

2degrees

#1720123 14-Feb-2017 16:53

Hi All,

This sounds a lot like the old exploit in the fritzbox firmware that has been patched for some time, it's almost as if the exploit remained after firmware updates, and is just now having access attempted (and failing as a result of the changes from the patching). Can those affected please message me with your broadband usernames, CWMP numbers from the bottom of the modems and current firmware version, and I'll check it out for you.

michaelmurfy:

Oblivian:

michaelmurfy: I'd strongly recommend turning off any external access to your routers services. It only takes a single exploit then they've got control over your whole network.

It would appear its how they manage the configurations and updates with CPS. They put a snapadmin user on with remote access afterall. And have seen it update before by them.

Crap that is bad. Opened to the world and not whitelisted to their own management network is a terribly bad security practice no matter how secure they think the Fritz!Box is. Any open ports on an embedded system is a terrible idea. I would say it could well be Mirai attempting to brute force.

Our CPE management is restricted to our management range only, and is only enabled on-request from our systems through TR-069 with our unique tokens. If the device has a snapadmin credential in it, this will be a very old config that has likely not successfully been migrated on to our managed system.

Thanks,

Ralph ^JOB

Oblivian

7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

#1720203 14-Feb-2017 21:23

2degreesCare:

Hi All,

This sounds a lot like the old exploit in the fritzbox firmware that has been patched for some time, it's almost as if the exploit remained after firmware updates, and is just now having access attempted (and failing as a result of the changes from the patching). Can those affected please message me with your broadband usernames, CWMP numbers from the bottom of the modems and current firmware version, and I'll check it out for you.

michaelmurfy:

Oblivian:

michaelmurfy: I'd strongly recommend turning off any external access to your routers services. It only takes a single exploit then they've got control over your whole network.

It would appear its how they manage the configurations and updates with CPS. They put a snapadmin user on with remote access afterall. And have seen it update before by them.

Crap that is bad. Opened to the world and not whitelisted to their own management network is a terribly bad security practice no matter how secure they think the Fritz!Box is. Any open ports on an embedded system is a terrible idea. I would say it could well be Mirai attempting to brute force.

Our CPE management is restricted to our management range only, and is only enabled on-request from our systems through TR-069 with our unique tokens. If the device has a snapadmin credential in it, this will be a very old config that has likely not successfully been migrated on to our managed system.

Thanks,

Ralph ^JOB

Interesting. I'm still on a 7340 BTW. However thought it was managed fine as it's had FW updates applied that aren't public? I had to get it added at some point as it was missed.

FRITZ!OS 06.10-29288 BETA

Or should I still be sending you deets (and probably turning remote access back on? :) )

2degreesCare

1537 posts

Uber Geek
+1 received by user: 274

Trusted

2degrees

#1721131 16-Feb-2017 11:54

Hi Oblivion,

If you are on a 7340, they are at the end of their support life through the manufacturer,t he firmware you have indicated there is the latest version, with that beta built to remedy past security issues and a couple of fixes of NZ use.

Can you please message the details, and we'll check this out further for you. It's likely the box just needs a reset, but we'd like to check it out first :)

Cheers,

Ralph ^JOB