Slashdot Log In
Botnet Worm Targets DSL Modems and Routers
Posted by
kdawson
on Mon Mar 23, 2009 08:12 PM
from the new-vector dept.
from the new-vector dept.
CoreDuo writes "The people who bring you the DroneBL DNS Blacklist services, while investigating an ongoing DDoS incident, have discovered a botnet composed of exploited DSL modems and routers. OpenWRT/DD-WRT devices all appear to be vulnerable. What makes this worm impressive is the sophisticated nature of the bot, and the potential damage it can do not only to an unknowing end user, but to small businesses using non-commercial Internet connections, and to the unknowing public taking advantage of free Wi-Fi services. The botnet is believed to have infected 100,000 hosts." A followup to the article notes that the bot's IRC control channel now claims that it has been shut down, though the ongoing DDoS attack on DroneBL suggests otherwise.
Related Stories
Submission: Botnet worm that targets DSL modems and routers by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Tomato (Score:3, Interesting)
Re: (Score:3, Informative)
Re:Tomato (Score:5, Informative)
any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices)
This does not exclude Tomato, especially if your router is set up as mentioned or you have weak passwords.
Parent
Re:Tomato (Score:5, Informative)
If you allow ssh access from the wide internet, and you have a weak password for root, you are probably still vulnerable..
Parent
Re: (Score:3, Insightful)
> If you allow ssh access from the wide internet...
Why would you do that?
> ...and you have a weak password for root...
Why would you do that?
Re:Tomato (Score:5, Informative)
> If you allow ssh access from the wide internet...
Why would you do that?
`ssh -i ~/.ssh/myrouter.key root@my.router.ip '/usr/sbin/wol -i 192.168.0.255 00:11:22:33:44:55'`
But there is no reason on earth to use SSH with password authentication. Ever.
4096bit keys with 30+ character passphrase is my standard at the moment.
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Note that with a strong root password and usage of a non-standard port will help keep the bots away. Even better if you disable password authentication for SSH and use a key instead.
Even better yet would be setting up a user acount with a non-common name and su'ing or sudo'ing to do the administrative stuff. As an example, both OpenBSD and Solaris default to blocking root access by ssh. Another nifty ssh trick is to set it up sshd to drop most connection attempts after two attempts in a minute.
Re:Tomato (Score:4, Interesting)
That would be nice, but it is not easy to do. The Linux distros that run on embedded routers are mostly set up to have only a single, root, user. DD-WRT is definitely this way, and I think Tomato is as well. It might be possible to rebuild it with multiple users but that is definitely not how it's designed right now.
Personally what I'd recommend is not having any of the router's management interfaces exposed to the WAN side of things, for any reason, ever. If you think you might need to administer the router remotely, set up a hardened system inside the LAN somewhere, forward a nonstandard port to sshd on it, and then log into that machine and do SOCKS port-forwarding to connect to the router. This is how I run my home network and it takes literally only a second or two longer to connect to the router this way, versus if I had it directly accessible.
Parent
Re:Tomato (Score:5, Insightful)
If you allow SSH access from the wide internet and you allow passwords, you are probably still vulnerable.
Really, just use SSH with private/public keys and you'll be okay.
Parent
Re:Tomato (Score:4, Informative)
If you allow SSH access from the wide internet and you allow passwords, you are probably still vulnerable.
Really, just use SSH with private/public keys and you'll be okay.
Another alternative is to close port 22 and use a non-standard, high-numbered port instead. Not as secure but most automated attacks don't scan all 65536 ports looking for an open one. If I disable passwords I'm always afraid that the one time I really need to get into my LAN will be the one time I don't have my private keys with me.
Parent
Re: (Score:3, Insightful)
The commercial routers don't have this option. Um like D-link, Linksys, etc. Unfortunately they are the majority of home/small enterprise routers But this would be the trick to use.
Except anyone who's knowledgeable enough to set up a private/public key based ssh server on their router would have ditched that crippled factory default firmware in the first place and installed something more advanced like Tomato, which does have this feature.
Re:Tomato (Score:5, Insightful)
If you allow ssh access from the wide internet, and you have a weak password for root, you always were vulnerable. Now the vulnerability is just being exploited in a more automated way.
Parent
Re:Tomato (Score:4, Informative)
Glad I recently switched my router to Tomato. Works better than DD-WRT, too.
Why does this article make you glad you switched?
The same thing that makes OpenWRT/DD-WRT vulnerable seems to be part of Tomato.
FTFA
"any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices)."
From Tomato Features list:
"CLI (using BusyBox) with access via TELNET or SSH (using Dropbear)"
Parent
Re: (Score:3, Informative)
By default, Tomato doesn't allow remote (from WAN port) administration. I don't know about the other WRT firmwares, but Tomato at least is secure from this exploit by default.
Re:Tomato (Score:4, Informative)
dd-wrt doesn't allow admin from WAN either, unless you tell it to.
And you can tell it to do that intelligently, using SSH on a nonstandard port, enabling tunneling, and using public key auth.
Parent
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
That's like saying CiCi's Pizza is the best dining experience of all time. It's not really pizza, but it is edible...
Sex is like pizza... Even when it is bad, it's still pizza.
Re:Hackers. (Score:5, Funny)
The difference is... when you get desperate enough to eat disgustingly bad pizza, your friends won't bring it up for the next ten years at every possible occasion.
Parent
Re: (Score:3, Interesting)
Re:Hackers. (Score:4, Funny)
Some sex crust is so bad it's inedible too.
Parent
Tomato (Score:3, Funny)
Don't forget, Tomatoes get worms too!
What to do about it? (Score:5, Insightful)
B. How to tell whether we are infected?
C. What to do about it if we are?
I'd guess most people, even geeks, just think of their router as a black box and don't know much about them as long as they keep on working.
Re:What to do about it? (Score:5, Informative)
A. Is your password "admin," "root," "password," or some other such simplistic shit? Can you log into it remotely? If so, you're vulnerable.
B. Does SSH still connect? Can you get to your router's web page? If so, it's not infected.
C. It's a router, not something of any great intrinsic value. Nuke the firmware and start over. (Reset, boot_wait, JTAG - lots of ways to nuke a new firmware into these things without having network access to them. Listed previously are some good terms to Google for.)
I'd guess that most people, even geeks, don't run dd-wrt, tomato, or openwrt on their router unless they've got a pretty good clue about what's going on.
On the other hand: The average Joe, who just buys a WRT54G (aka: black box) from Wal-Mart, plugs it into his cable modem, and logs into the "linksys" SSID from his laptop isn't affected by this worm, since the default configuration doesn't allow remote access from the Internet at all.
Parent
Re:What to do about it? (Score:5, Funny)
> ...the default configuration doesn't allow remote access from the Internet at all.
True. The crackers have to use the bot that controls his pc and the default password that he didn't change.
Parent
Re: (Score:3, Interesting)
I recall reading a while ago about a javascript exploit that would attempt to log in to your router using the default admin login/password. It had a list of a few hundred different defaults to try. If it got in, it would mess with your DNS.
I'm not sure what came of that..
Re:What to do about it? (Score:5, Insightful)
The average Joe, who just buys a WRT54G (aka: black box) from Wal-Mart, plugs it into his cable modem, and logs into the "linksys" SSID from his laptop isn't affected by this worm, since the default configuration doesn't allow remote access from the Internet at all.
But it does allow access from the LAN side, so all that takes is one owned client connecting to that AP. It could even spread via laptops physically roaming to different hotspots (maybe not AT&T etc, but think of an independent coffee shop owner who should not have to be a networking guru).
Routers seem like a nice prize indeed. Always connected and on a public IP, and there's millions of them!. I'm surprised it's taken this long.
It's hard enough for most people to just hook one of these up, much less wipe a rootkit from it.
Parent
Re:What to do about it? (Score:5, Interesting)
I'd guess that most people, even geeks, don't run dd-wrt, tomato, or openwrt on their router unless they've got a pretty good clue about what's going on.
Really?
1. The article claims between 80,000 - 100,000 infected routers.
2. Neither DD-WRT nor OpenWRT allow connections from the outside world by default.
3. The worm brute-forces passwords.
From this we can conclude that there are at least 80-100K geeks who opened their connections to the outside world and used weak passwords. This does not sound like people with a "pretty good clue" to me.
Parent
Re: (Score:3, Informative)
I use pwgen for pretty much all my passwords. It has some nice options to restrict/expand the allowed set of characters, and should be a standard installable package on most distros.
Its main advantage is that it creates passwords with a mix of vowels and consonants so you get an almost word-like password. If creating a password I'll need to remember, I usually set it to create 10 or 20 and skim through for something that seems memorable to me. If creating passwords for services that I just need to enter som
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Actually, the worm also exploits some vulnerabilities in the HTTP servers in some of these models.
Easy fix (Score:5, Funny)
ssh to your router
ifconfig eth0 down
All fixed, not vulnerable anymore.
Scary Targets... (Score:4, Insightful)
Okay, now this is scary.
Folks having OpenWRT/DD-WRT are usually a bit more savvy that the average user, so to see something specifically targeting such users is surprising.
And the fact it's gone this long without being noticed is even MORE frightening.
Re: (Score:3)
If you let anyone on the internet ssh into your linux boxes, and your root password is "admin" or somesuch, why is it surprising that someone will eventually exploit you?
This virus does not target "savvy users". Like most viruses, it targets idiots.
Re:Scary Targets... (Score:5, Insightful)
any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices).
Anyone Savvy enough to want to run OpenWRT/DD-WRT should hopefully be savvy enough to have a decent password. I'm guessing by DMZ it means open slather access to the device. Open Slather + Weak Password = Your Own Stupidity
Parent
Preventative workaround (Score:3, Informative)
Configure the device for IPv6, over a tunnel or whatever. The worm blocks your control ports using iptables, but not apparently ip6tables.
Re: (Score:3, Informative)
errr, yeah, if you want to kill an ant with a nuke.
Or just change your password from the default and set ssh/web/telnet administration to local segment only.
Did you read the article?
Admin interface open on the WAN side? (Score:5, Interesting)
Needs more detail (Score:5, Interesting)
Ok, TFA states
Get a shell on the vulnerable device (methods vary).
How will this supposed worm manage to login to the box? Brute force? Properly configured Linux will block login attempts for quite a while after several failures. SSH? Can't be compromised within a reasonable time. Telnet? Not supported on all routers I know.
The article doesn't go into the essential details, so I call FUD until proven otherwise.
Re:Needs more detail (Score:5, Insightful)
1. Be granted root access to the vulnerable device.
2. Do something nasty.
describes 99% of *nix (Linux, BSD, OS X) "exploits" I've seen.
Some of it is intentional FUD, but it's still a good example of why users should be forced to learn exactly what programs are allowed to do with user and root/admin privileges.
Most folks still think of programs the way they think of physical gadgets. Users don't understand privileges, and assume that programs are by nature isolated from each other, the operating system, and the user's personal files.
It doesn't occur to them that a malfunctioning toaster could suddenly delete their car.
Parent
Old news to me (Score:4, Insightful)
Re: (Score:3, Informative)
And you really needed to... (Score:4, Interesting)
... administer your home router over the Internet? Who does that? If you don't have an open port, even on these boxen, how could you be attacked?
But, it seems to me that this is more likely an attack on stock Linksys boxen that re-flashes with a special DD-WRT designed to "phone home." Yes, DD-WRT/OpenWRT are also vulnerable if they have weak passwords, but the bulk is more likely the former.
(Disclaimer: My home router runs HyperWRT & is not listed in DroneBL.)
OpenWRT/DD-WRT devices all appear to be vulnerable (Score:5, Insightful)
I guess it's the same on DD-Wrt.
The devices that were targetted appear to have some serious flaws, here's a cite from an analysis [adam.com.au] of the malware:
"Several revisions of the NB5 modem shipped with a flaw which meant that the web configuration interface was visible from the WAN side, accepting connections and allowing users to administer the modem using the default username and password of 'admin' from outside the LAN. Furthermore, some of these modems suffered from another flaw, meaning that by default, authentication was not enabled for the web interface - meaning no username or password was required."
It really boils down to the usual find-weak-logins style of attacks, only the target platform has changed.
Wait Till They Get Verizon Routers Rooted (Score:4, Informative)
The modem/router that Verizon provided for their DSL service had the firmware remotely upgraded. There is no way to avoid these updates. I hope it is secure. If someone roots that process, it will be the mother of all DDOS attacks.
Re:Run to my openWRT router and look for.. what? (Score:4, Informative)
Considering that TFA says one of the things the bot does is lock you out, I suggest that if you can log in, you are fine :-)
Parent
Re: (Score:3, Informative)
# iptables -A INPUT -p tcp --dport 23 -j DROP
# iptables -A INPUT -p tcp --dport 22 -j DROP
# iptables -A INPUT -p tcp --dport 80 -j DROP
If you telnet/ssh connections are working, and you can get to the web page, then you should be okay.
Re:Run to my openWRT router and look for.. what? (Score:5, Informative)
Apparently I'm one of the "100,000" that got infected by this botnet.
This morning my router would not connect to any websites, yet my modem when directly connected to my PC still did. I reseted the settings to default, disabled the vulnerabilities that got the idiots in and put a stronger 35 character username and password.
How did I get infected in the first place? I left on remote access. And possibly my username and password weren't that complex. Live and learn I guess.
Parent
Re:How Can I Determine If My D-Link Router is Linu (Score:5, Informative)
Just sayin'.
Parent