Asus routers (cable type) security warning.

This hack is happening , people are seeing their routers accessed and reset. Something/body is logging in using the owners credentials ( which is clearly recorded in the logs ) they get in on the first attempt.

Telnet, SSH , UPNP , Access from Wan are all suspect.

There are a number of threads at the SNB forums .

http://www.snbforums.com/threads/security-reminder-t...

http://www.snbforums.com/threads/was-my-routers-user...

http://www.snbforums.com/threads/malicious-access-on...

http://www.snbforums.com/threads/what-does-this-log-...

Whether this problem is with both factory and 3rd party firmware isn't yet known . Many users rarely look at their logs and wouldn't be aware of anything happening.

Edited by deleted (Tue 03-Jan-17 06:37:49)

Home routers in general are facing a mass onslaught at the moment.

Looking through my firewall logs, there have been 177 attempts to connect via telnet, SSH or ports associated with the Mirai malware in the last forty minutes.

Looking through my mail server logs earlier, I noticed a UK Virgin Business static IP address which seemed to be infected with something that was trying to slam spam to my mail server. A quick poke around on Shodan and it seems the router has port forwarding open to a vulnerable Hikvision IP Camera which is now happily part of a botnet.

Email spam is at a very high level at the moment too; 2,917 emails rejected as spam or malware in the past six days on my two mail servers. That's far higher than usual.

Indeed there is a constant flow of bots attempting to find access , however this is something new.

Routers have been accessed using the owners username and password and they do this in one attempt. Once in they alter ports and settings , If owners change the settings back and replace the password, the attacker is back in the same day.

Since I block all incoming requests on my router (which is the default setting), I don't bother logging them. However, I am getting 4-6 requests per minute -- so probably around 300 requests per hour.

Nothing new in the world of router security. None of these services should be accessible from the WAN.

People should be asking themselves, why are they using cleartext protocols like telnet in the first place?