Forgot your password?
typodupeerror
Security The Internet

Botnet Worm Targets DSL Modems and Routers 272

Posted by kdawson
from the new-vector dept.
CoreDuo writes "The people who bring you the DroneBL DNS Blacklist services, while investigating an ongoing DDoS incident, have discovered a botnet composed of exploited DSL modems and routers. OpenWRT/DD-WRT devices all appear to be vulnerable. What makes this worm impressive is the sophisticated nature of the bot, and the potential damage it can do not only to an unknowing end user, but to small businesses using non-commercial Internet connections, and to the unknowing public taking advantage of free Wi-Fi services. The botnet is believed to have infected 100,000 hosts." A followup to the article notes that the bot's IRC control channel now claims that it has been shut down, though the ongoing DDoS attack on DroneBL suggests otherwise.
This discussion has been archived. No new comments can be posted.

Botnet Worm Targets DSL Modems and Routers

Comments Filter:
  • Tomato (Score:3, Interesting)

    by Merritt.kr (1120467) on Monday March 23, 2009 @08:20PM (#27306071) Homepage
    Glad I recently switched my router to Tomato. Works better than DD-WRT, too.
    • Re: (Score:3, Informative)

      by snowraver1 (1052510)
      I'm pretty sure that Tomato is in the same boat. According to the Tomato FAQ, Tomato is Linux based, and according to TFA Embedded Linux devices seem to be the target.
    • Re:Tomato (Score:5, Informative)

      by zombietangelo (1394031) on Monday March 23, 2009 @08:29PM (#27306183)
      TFA states:

      any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices)

      This does not exclude Tomato, especially if your router is set up as mentioned or you have weak passwords.

    • Re:Tomato (Score:5, Informative)

      by Repton (60818) on Monday March 23, 2009 @08:31PM (#27306213) Homepage

      If you allow ssh access from the wide internet, and you have a weak password for root, you are probably still vulnerable..

      • Re: (Score:3, Insightful)

        by John Hasler (414242)

        > If you allow ssh access from the wide internet...

        Why would you do that?

        > ...and you have a weak password for root...

        Why would you do that?

        • Re: (Score:2, Insightful)

          by Anonymous Coward

          > If you allow ssh access from the wide internet...

          Why would you do that?

          Normally those routers do not have users other than root...

          • Re: (Score:3, Informative)

            You don't have to enable remote ssh access to manage your router, unless you really need to administrate it remotely.
        • by Repton (60818)

          <shrug> Ask one of the 80,000 who got infected :-)

        • by X0563511 (793323)

          > If you allow ssh access from the wide internet...

          Why would you do that?

          My usage case:

          SSH in, tunnel to localhost:80 for web admin.

          Would it be better to leave the HTTP/HTTPS world-exposed? Probably not.

          Note that with a strong root password and usage of a non-standard port will help keep the bots away. Even better if you disable password authentication for SSH and use a key instead.

          • Re: (Score:3, Informative)

            by IvyKing (732111)

            Note that with a strong root password and usage of a non-standard port will help keep the bots away. Even better if you disable password authentication for SSH and use a key instead.

            Even better yet would be setting up a user acount with a non-common name and su'ing or sudo'ing to do the administrative stuff. As an example, both OpenBSD and Solaris default to blocking root access by ssh. Another nifty ssh trick is to set it up sshd to drop most connection attempts after two attempts in a minute.

            • Re:Tomato (Score:4, Interesting)

              by Kadin2048 (468275) <slashdot.kadinNO@SPAMxoxy.net> on Tuesday March 24, 2009 @12:03AM (#27307773) Homepage Journal

              That would be nice, but it is not easy to do. The Linux distros that run on embedded routers are mostly set up to have only a single, root, user. DD-WRT is definitely this way, and I think Tomato is as well. It might be possible to rebuild it with multiple users but that is definitely not how it's designed right now.

              Personally what I'd recommend is not having any of the router's management interfaces exposed to the WAN side of things, for any reason, ever. If you think you might need to administer the router remotely, set up a hardened system inside the LAN somewhere, forward a nonstandard port to sshd on it, and then log into that machine and do SOCKS port-forwarding to connect to the router. This is how I run my home network and it takes literally only a second or two longer to connect to the router this way, versus if I had it directly accessible.

        • Re:Tomato (Score:5, Informative)

          by PReDiToR (687141) on Monday March 23, 2009 @11:23PM (#27307551) Homepage Journal

          > If you allow ssh access from the wide internet...

          Why would you do that?

          `ssh -i ~/.ssh/myrouter.key root@my.router.ip '/usr/sbin/wol -i 192.168.0.255 00:11:22:33:44:55'`

          But there is no reason on earth to use SSH with password authentication. Ever.

          4096bit keys with 30+ character passphrase is my standard at the moment.

        • Re: (Score:3, Insightful)

          by Runaway1956 (1322357)
          I have a very strong password. "Administrator" See? Twelve letters. I'm pretty sure that Microsoft assured me years ago that a twelve letter password made for a real strong hash......
      • Re:Tomato (Score:5, Insightful)

        by Anonymous Coward on Monday March 23, 2009 @08:42PM (#27306331)

        If you allow SSH access from the wide internet and you allow passwords, you are probably still vulnerable.

        Really, just use SSH with private/public keys and you'll be okay.

        • Re:Tomato (Score:4, Informative)

          by tobiasly (524456) on Monday March 23, 2009 @10:11PM (#27307041) Homepage

          If you allow SSH access from the wide internet and you allow passwords, you are probably still vulnerable.

          Really, just use SSH with private/public keys and you'll be okay.

          Another alternative is to close port 22 and use a non-standard, high-numbered port instead. Not as secure but most automated attacks don't scan all 65536 ports looking for an open one. If I disable passwords I'm always afraid that the one time I really need to get into my LAN will be the one time I don't have my private keys with me.

      • Re:Tomato (Score:5, Insightful)

        by Yossarian45793 (617611) on Monday March 23, 2009 @08:52PM (#27306429)

        If you allow ssh access from the wide internet, and you have a weak password for root, you are probably still vulnerable.

        If you allow ssh access from the wide internet, and you have a weak password for root, you always were vulnerable. Now the vulnerability is just being exploited in a more automated way.

        • by doon (23278)

          If you allow root to login via ssh from $internet with a password (Regardless of strength). You've probably got issues... Seriously, Port knocking + moving the default ssh port + Public key to a non priv'ed account with a great password (for sudo access), and you are probably a bit better off. Now I have no idea if these devices can do any/all of that, as I have no interest in deploying them to find out.

          • by X0563511 (793323)

            They can do everything except the limited user and sudo bit. Usually they only have root.

            However, nothing stops you from fiddling around and adding this in yourself. All you need is a gcc/binutils crosscompiler for the right arch, and away you go.

    • Re:Tomato (Score:4, Informative)

      by Krizdo4 (938901) on Monday March 23, 2009 @08:33PM (#27306245) Homepage

      Glad I recently switched my router to Tomato. Works better than DD-WRT, too.

      Why does this article make you glad you switched?
      The same thing that makes OpenWRT/DD-WRT vulnerable seems to be part of Tomato.

      FTFA
      "any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices)."

      From Tomato Features list:
      "CLI (using BusyBox) with access via TELNET or SSH (using Dropbear)"

  • Tomato (Score:3, Funny)

    by Anonymous Coward on Monday March 23, 2009 @08:24PM (#27306131)

    Don't forget, Tomatoes get worms too!

  • by Anonymous Coward

    I actually RTFA, logged into my router, and I'm still not sure what to look for to see if we've been compromised.

    What exactly are we looking for?

    first post!
    -edfardos

  • by GrahamCox (741991) on Monday March 23, 2009 @08:26PM (#27306161) Homepage
    A. How do we know whether our kit is vulnerable?
    B. How to tell whether we are infected?
    C. What to do about it if we are?

    I'd guess most people, even geeks, just think of their router as a black box and don't know much about them as long as they keep on working.
    • If you RTFA you'll see that you're only vulnerable if you have a weak password. I guess the worm uses password guessing as the "exploit" to take over your router.
      • Re: (Score:3, Informative)

        by nenolod (546272)

        Actually, the worm also exploits some vulnerabilities in the HTTP servers in some of these models.

    • by adolf (21054) <flodadolf@gmail.com> on Monday March 23, 2009 @08:43PM (#27306345) Journal

      A. Is your password "admin," "root," "password," or some other such simplistic shit? Can you log into it remotely? If so, you're vulnerable.
      B. Does SSH still connect? Can you get to your router's web page? If so, it's not infected.
      C. It's a router, not something of any great intrinsic value. Nuke the firmware and start over. (Reset, boot_wait, JTAG - lots of ways to nuke a new firmware into these things without having network access to them. Listed previously are some good terms to Google for.)

      I'd guess that most people, even geeks, don't run dd-wrt, tomato, or openwrt on their router unless they've got a pretty good clue about what's going on.

      On the other hand: The average Joe, who just buys a WRT54G (aka: black box) from Wal-Mart, plugs it into his cable modem, and logs into the "linksys" SSID from his laptop isn't affected by this worm, since the default configuration doesn't allow remote access from the Internet at all.

      • by John Hasler (414242) on Monday March 23, 2009 @09:02PM (#27306505) Homepage

        > ...the default configuration doesn't allow remote access from the Internet at all.

        True. The crackers have to use the bot that controls his pc and the default password that he didn't change.

        • Re: (Score:3, Interesting)

          by Repton (60818)

          I recall reading a while ago about a javascript exploit that would attempt to log in to your router using the default admin login/password. It had a list of a few hundred different defaults to try. If it got in, it would mess with your DNS.

          I'm not sure what came of that..

      • by seanadams.com (463190) * on Monday March 23, 2009 @09:16PM (#27306651) Homepage

        The average Joe, who just buys a WRT54G (aka: black box) from Wal-Mart, plugs it into his cable modem, and logs into the "linksys" SSID from his laptop isn't affected by this worm, since the default configuration doesn't allow remote access from the Internet at all.

        But it does allow access from the LAN side, so all that takes is one owned client connecting to that AP. It could even spread via laptops physically roaming to different hotspots (maybe not AT&T etc, but think of an independent coffee shop owner who should not have to be a networking guru).

        Routers seem like a nice prize indeed. Always connected and on a public IP, and there's millions of them!. I'm surprised it's taken this long.

        It's hard enough for most people to just hook one of these up, much less wipe a rootkit from it.

      • by chill (34294) on Monday March 23, 2009 @09:31PM (#27306771) Journal

        I'd guess that most people, even geeks, don't run dd-wrt, tomato, or openwrt on their router unless they've got a pretty good clue about what's going on.

        Really?

        1. The article claims between 80,000 - 100,000 infected routers.
        2. Neither DD-WRT nor OpenWRT allow connections from the outside world by default.
        3. The worm brute-forces passwords.

        From this we can conclude that there are at least 80-100K geeks who opened their connections to the outside world and used weak passwords. This does not sound like people with a "pretty good clue" to me.

        • by Darkk (1296127)

          I run DD-WRT on my WRT54G as a wireless access point. Two things I did first was change the default username and password. And disable web-admin access via the wireless if they ever break my WPA2 encryption.

          Pretty safe to me.

      • A. Is your password "admin," "root," "password," or some other such simplistic shit?

        OpenVMS has a nice feature:

        set password/generate

        It sets the password then tells you what the password is. Personally on linux and BSD I use

        echo $RANDOM$RANDOM

        ...then set the password to the resulting string.

        • Re: (Score:3, Informative)

          I use pwgen for pretty much all my passwords. It has some nice options to restrict/expand the allowed set of characters, and should be a standard installable package on most distros.

          Its main advantage is that it creates passwords with a mix of vowels and consonants so you get an almost word-like password. If creating a password I'll need to remember, I usually set it to create 10 or 20 and skim through for something that seems memorable to me. If creating passwords for services that I just need to enter som

      • Re: (Score:3, Informative)

        by Otto (17870)

        On the other hand: The average Joe, who just buys a WRT54G (aka: black box) from Wal-Mart, plugs it into his cable modem, and logs into the "linksys" SSID from his laptop isn't affected by this worm, since the default configuration doesn't allow remote access from the Internet at all.

        Many Linksys routers, to pick an example, run on top of a Linux even with their default firmware. And many (most?) of these firmwares have had known vulnerabilities that give you enough to get a shell out of it. Google "Linksys ping hack" if you want to see a truly devastating back door.

        On top of that, many of these had remote access bugs. I recall one where, if you knew the right URL to hit, you could make the router execute your commands even though remote access had been disabled. All disabling it really

    • Re: (Score:3, Informative)

      by Randall311 (866824)
      If your username and password are "admin", then you're deservedly fucked.
  • Easy fix (Score:5, Funny)

    by Anonymous Coward on Monday March 23, 2009 @08:31PM (#27306217)
    Not a big deal, you can just:

    ssh to your router
    ifconfig eth0 down

    All fixed, not vulnerable anymore.
  • Scary Targets... (Score:4, Insightful)

    by IonOtter (629215) on Monday March 23, 2009 @08:34PM (#27306253) Homepage

    Okay, now this is scary.

    Folks having OpenWRT/DD-WRT are usually a bit more savvy that the average user, so to see something specifically targeting such users is surprising.

    And the fact it's gone this long without being noticed is even MORE frightening.

    • If you let anyone on the internet ssh into your linux boxes, and your root password is "admin" or somesuch, why is it surprising that someone will eventually exploit you?

      This virus does not target "savvy users". Like most viruses, it targets idiots.

    • by Techman83 (949264) on Monday March 23, 2009 @09:04PM (#27306533)
      TFA:

      any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices).

      Anyone Savvy enough to want to run OpenWRT/DD-WRT should hopefully be savvy enough to have a decent password. I'm guessing by DMZ it means open slather access to the device. Open Slather + Weak Password = Your Own Stupidity

      • Re: (Score:2, Informative)

        by Microlith (54737)

        DMZ = All ports not forwarded to other machines are routed to the IP specified as the "DMZ" IP.

        So what we have is not simply routers getting attacked, but actual machines that are completely unprotected.

    • by Socguy (933973)

      And the fact it's gone this long without being noticed is even MORE frightening.

      It certainly is sobering. Although, when one thinks about it, folks who THINK they know what they're doing are often way more dangerous than than the guy who doesn't have a clue (especially when you got a bunch of them on your hands!) and this is not just true with computers: Imagine all the people who thought they knew what they were doing when they took out that 40y, pay-what-you-want, no-downpayment-necessary mortgage on that 7 bed 7 bath mansion!
      ...Or the broker that thought he knew what he was doi

  • by XanC (644172) on Monday March 23, 2009 @08:35PM (#27306275)

    Configure the device for IPv6, over a tunnel or whatever. The worm blocks your control ports using iptables, but not apparently ip6tables.

    • Re: (Score:3, Informative)

      errr, yeah, if you want to kill an ant with a nuke.

      Or just change your password from the default and set ssh/web/telnet administration to local segment only.

      Did you read the article?

  • by Mondo1287 (622491) on Monday March 23, 2009 @08:36PM (#27306279)
    Who has their router set to allow access to the admin interface from the wan side? This is certainly not done by default. Is there some sort of browser hijack involved with this to gain access to the inside of the network?
    • Re: (Score:2, Informative)

      by itzfritz (822208) *
      It's necessarily being exploited from the WAN; I've seen poc code that, guessing the gateway's internal ip (typically 192.168.1.1 class c), uses javascript or html trickery to attempt a GET request that modifies that router's config. ex:, on some webpage) img src='192.168.1.1/allow-external-connections.cgi' You get the idea. Dont remember where I saw it, maybe ha.ckers/sla.ckers.org..
  • Needs more detail (Score:5, Interesting)

    by lordtoran (1063300) on Monday March 23, 2009 @08:40PM (#27306319) Homepage

    Ok, TFA states

    Get a shell on the vulnerable device (methods vary).

    How will this supposed worm manage to login to the box? Brute force? Properly configured Linux will block login attempts for quite a while after several failures. SSH? Can't be compromised within a reasonable time. Telnet? Not supported on all routers I know.

    The article doesn't go into the essential details, so I call FUD until proven otherwise.

    • Re: (Score:2, Informative)

      by Krizdo4 (938901)

      Ok, TFA states

      Get a shell on the vulnerable device (methods vary).

      How will this supposed worm manage to login to the box? Brute force? Properly configured Linux will block login attempts for quite a while after several failures. SSH? Can't be compromised within a reasonable time. Telnet? Not supported on all routers I know.

      The article doesn't go into the essential details, so I call FUD until proven otherwise.

      From the article:

      any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices).

      Telnet is used at least on OpenWRT after you first flash it but before you set a root password.

      No consumer router I've used blocked repeated failed password attempts be default.

      A bug in the web interface for the default Linksys allowed people to load the OpenWrt by sending shell commands to turn on boot wait. Just do the same but insert malicious shell code instead with the default password.

    • by v1 (525388)

      one would assume it does a slow throttled attempt, starting with the true idiot passwords like "admin", "administrator", "root", "password" etc. Those four alone probably get you into 10% of those routers

      • by Plekto (1018050)

        One would assume it does a slow throttled attempt, starting with the true idiot passwords like "admin", "administrator", "root", "password" etc. Those four alone probably get you into 10% of those routers.

        The number of clients that I used to run into doing consulting that had no password set on their machines at all on any level was about 10-20%. They buy it and plug it in and that's that. Then the insanity starts as they are often connected to a DSL or cable connection 24/7 without any real protection.

    • by AHuxley (892839)
      Like root, admin?
      username is blank?
    • by pushing-robot (1037830) on Monday March 23, 2009 @09:29PM (#27306755)

      1. Be granted root access to the vulnerable device.

      2. Do something nasty.

      describes 99% of *nix (Linux, BSD, OS X) "exploits" I've seen.

      Some of it is intentional FUD, but it's still a good example of why users should be forced to learn exactly what programs are allowed to do with user and root/admin privileges.

      Most folks still think of programs the way they think of physical gadgets. Users don't understand privileges, and assume that programs are by nature isolated from each other, the operating system, and the user's personal files.

      It doesn't occur to them that a malfunctioning toaster could suddenly delete their car.

      • Re: (Score:3, Interesting)

        by againjj (1132651)

        It doesn't occur to them that a malfunctioning toaster could suddenly delete their car.

        That is an incredibly insightful comment. That makes so clear what it is that people do not get about computers. This implies that that sandboxing needs to be taken to the next level. A VM for every app, perhaps?

  • Old news to me (Score:4, Insightful)

    by GaryOlson (737642) <slashdot@ g a r y olson.org> on Monday March 23, 2009 @08:47PM (#27306391) Journal
    I commented on this exact subject about 18 months ago. [slashdot.org] Amused to see the security industry finally catching up.
    • That's pretty awesome. Hats off to you good sir!
  • by m6ack (922653) on Monday March 23, 2009 @09:19PM (#27306683)

    ... administer your home router over the Internet? Who does that? If you don't have an open port, even on these boxen, how could you be attacked?

    But, it seems to me that this is more likely an attack on stock Linksys boxen that re-flashes with a special DD-WRT designed to "phone home." Yes, DD-WRT/OpenWRT are also vulnerable if they have weak passwords, but the bulk is more likely the former.

    (Disclaimer: My home router runs HyperWRT & is not listed in DroneBL.)

  • by xmff (1489321) on Monday March 23, 2009 @09:21PM (#27306705)
    How so? At least on OpenWrt, SSH and Webif aren't even exposed to the wan side without manually changing the iptables rules first.

    I guess it's the same on DD-Wrt.

    The devices that were targetted appear to have some serious flaws, here's a cite from an analysis [adam.com.au] of the malware:

    "Several revisions of the NB5 modem shipped with a flaw which meant that the web configuration interface was visible from the WAN side, accepting connections and allowing users to administer the modem using the default username and password of 'admin' from outside the LAN. Furthermore, some of these modems suffered from another flaw, meaning that by default, authentication was not enabled for the web interface - meaning no username or password was required."

    It really boils down to the usual find-weak-logins style of attacks, only the target platform has changed.
    • by nenolod (546272)

      That analysis is old.

      And, it only targets DD-WRT/OpenWRT/Tomato routers configured in the way described in the article.

    • Re: (Score:3, Insightful)

      by Otto (17870)

      There's lots of ways to exploit cheapo home routers, whether they're running custom firmware or stock stuff.

      - Linksys firmwares have had shell execution vulnerabilities (that's how it was originally discovered that they were running Linux in the first place) as well as remote access vulnerabilities (where turning it off didn't actually work), among others.
      - Many of the custom firmwares (DD-WRT in particular) are vulnerable to rather trivial XSS attacks. Yes, visit the wrong webpage with malicious javascript

  • The modem/router that Verizon provided for their DSL service had the firmware remotely upgraded. There is no way to avoid these updates. I hope it is secure. If someone roots that process, it will be the mother of all DDOS attacks.

    • Re: (Score:3, Interesting)

      by Lumpy (12016)

      Really? you cant avoid that update?

      Why was I able to turn it off along with disabling the crappy "router" function in the westell modems?

      you CAN avoid it, you have to know what you are doing.

  • If this attack is combined with some PC-based worm, it will be much more effective. Routers that are vulnerable from the WAN side can be attacked by zombie PCs. The router can then be reprogrammed to try to attack anything that attaches on the WAN side, bypassing any firewalls in the router. The attack on the PC, of course, includes the code that attacks routers.

    We need more devices that boot from a true read-only medium. Yes, upgrading is a pain, but most devices never get upgraded anyway. At least t

  • OpenWRT is a linux based embedded operating system.

    Surely this is a first. Sure nix boxes and devices get hacked all the time, but I assumed that such automated attacks were natively difficult on linux?
  • by wertarbyte (811674) on Tuesday March 24, 2009 @04:28AM (#27309011) Homepage
    While playing around with the fonera routers [slashdot.org] I already predicted issues like this: http://stefans.datenbruch.de/lafonera/whywedidit.shtml [datenbruch.de] Consumer routers without decent firmware support are a even greater risk than unpatched windows systems; while access to the latter will probably be noticed, the profile of a hijacked routers stays low to its owner.
  • by Antique Geekmeister (740220) on Tuesday March 24, 2009 @07:53AM (#27309949)

    This is not just flamebait, but a serious policy: IRC has been a popular protocol for years, but with the advent of more secure and less abused protocols, there is no modern excuse for permitting IRC through any network or system firewalls. That helps cut the painful-to-monitor control channel.

    In fact, most corporate and institutional firewalls should only allow a few registered and useful protocols through their breaches, such as HTTP, HTTPS, SMTP, and SSH, and even those can often be funneled to a small set of securable servers. Yes, it interferes with the random-service-of-the-moment that some folks demand as their right. If they want such rights, they can pay the cost of running a host isolated by more secure firewalls and software management, outside the more trusted internal environment: folks should not expect both easy sharing of resources, and external access.

    • Re: (Score:3, Insightful)

      by Tony Hoyle (11698) *

      WIRC is not inherently insecure (or secure.. it's just a chat protocol), and is a popular means of talking with other admins for example. I use it for development purposes every day.

      There's absolutely nothing to stop $virus_of_the_week using port 80 instead of port 6667. You're solving nothing by blocking a port like that.

Real programmers don't write in BASIC. Actually, no programmers write in BASIC after reaching puberty.

Working...