Lizard Stresser DDoS-for-Hire Service Built On Hacked Home Routers 65
tsu doh nimh writes: The online attack service launched late last year by the same criminals who knocked Sony and Microsoft's gaming networks offline over the holidays is powered mostly by thousands of hacked home Internet routers, reports Brian Krebs. From the story: "The malicious code that converts vulnerable systems into stresser bots is a variation on a piece of rather crude malware first documented in November by Russian security firm Dr. Web, but the malware itself appears to date back to early 2014. As we can see in that writeup, in addition to turning the infected host into attack zombies, the malicious code uses the infected system to scan the Internet for additional devices that also allow access via factory default credentials, such as 'admin/admin,' or 'root/12345.' In this way, each infected host is constantly trying to spread the infection to new home routers and other devices accepting incoming connections (via telnet) with default credentials.
Factory passwords is not an exploit. (Score:2, Funny)
Factory passwords is what separates humans from the beasts.
Re: Factory passwords is not an exploit. (Score:1)
Re: (Score:2)
Or the lazy. I replace and reset my routers often enough that remembering to change the defaults can get tedious. Things like this remind me to be more careful.
My router is the same way, having to reset it every few days, in fact it's down now and I've firewall protection alone, while not having access to Netflix.
When I get around to resetting it once again (a 7 second process + reboot time), I'll load a .cfg file I saved when it was working just fine, alone with it's different password.
I'd replace it with my ASUS RT-AC66U Router but it's a bear to do using the 30-30-30 second hard reset every time it's not being seen; I gave up the last time, and I read here it's
Re: (Score:2)
I've been power cycling mine for years and it just keeps on going. I've never lost my settings, especially not the password I set.
You both must be doing more with your router then I am to be needing to re-setup the router every week.
Firewall was asking for access from different IP's while playing full screen games; so I reset my old router. My Charter.com DNS server.1 should be "Primary DNS: 24.196.64.53" https://www.whatsmydns.net/dns... [whatsmydns.net] my router shows what has been my dynamic address.1 and my dynamic address.2 as my DNS servers.
The router claims what has been the proper setup as invalid, my dynamic address being DNS as being valid; who am I to argue, it's working. Yet my IP address is of a different nature (it's always started with
Why a default? (Score:1, Interesting)
Why do all routers of the same model need to come with the same initial credentials?
Re:Why a default? (Score:4, Funny)
Because it would be an exceptionally onerous burden to bear to, say, randomly generate a password that gets printed on a piece of paper that ships with the router.
We are not gods, after all.
Re:Why a default? (Score:5, Insightful)
You already have to do that with the MAC, the s/n, etc. so what difference does it make?
Just make the default password be the serial number of the device.
Re: (Score:2, Funny)
I am not an Admiral, and my name is not Aspergers.
Re: (Score:2)
Re: (Score:2)
Just make the default password be the serial number of the device.
So I pull the serial number with an SNMP get request as part of my exploit script using a community string that is either 'public' or something standardized across the ISP?
Your move.
Re: (Score:2)
Not random enough I'm afraid - If you understand how the s/n is formatted, you can brute force the password rather easily.
Re: (Score:2)
Which is how my new router arrived. Very sensible.
Rgds
Damon
Re: (Score:1)
Re: (Score:3)
Right because its completely impossible you could ever visit a site with some malicious site that runs a little JS to build a form on the fly and submit forged request to your internal router if it were completely unauthenticated.
Don't be stupid, while its a good control to only allow these things to be managed from the inside, and you probably don't need to go overboard you DO need at least a username and password and you DO need to change the defaults!
Re:Why a default? (Score:5, Insightful)
I'd like to see the router simply refuse to communicate with the outside world until that username/password combo is changed. You can print the default user/password right on the device, so when you forget the password you can simply reset to factory settings - and trying to access any site will instead redirect you to a "Hey, change this password!" notice.
Re: (Score:1)
Allow traffic from RFC1918 addresses to the router and vice versa, and refuse to pass any other packets.
Re: (Score:2)
anti-CSRF all require some kind of authorized session, or authentication on the request itself, in the case of REST.
The grandparent was suggesting the router have no authentication. CSRF attack take advantage of the fact the client may repeat authorization/authentication headers, and things like session cookies whenever it connects to a resource in a realm its previously connected with. The attacker is able to forge request because he does not have to gain access to the authentication secrets or the sessi
Re:Why a default? (Score:4)
I'll just leave this here : http://www.cbits.co.uk/ourblog... [cbits.co.uk]
Re: (Score:1)
Some credentials are always necessary.
How else do you expect to keep your network secure if anyone on the local network ( read that household ) can modify it ?
Re:Why a default? (Score:5, Insightful)
Why do all routers of the same model need to come with the same initial credentials?
It makes printing the manual and setup instructions easier.
It makes writing any 'plug-in-and-configure' style utilities easier.
It makes providing support easier.
It saves a step of changing the password for each unit after its made and flashed, documenting the new password, and including a printout of that new password in the shipping materials.
Re: (Score:3)
Re: (Score:2)
Routers are configured with an individual MAC address (which is stored in the configuration flash partition and printed on the label on the bottom of the device), so configuring a random default password and printing that on the bottom of the device is hardly extra work. AFAIK all router manufacturers currently do this. In the past, some manufacturers derived the wireless LAN key and the device password from the MAC address, which was a stupid idea and led to exploits. Devices with static default passwords
Re: (Score:2)
Routers are configured with an individual MAC address
They actually usually have several.
(which is stored in the configuration flash partition)
The NICs themselves have the MAC flashed into their own firmware. So the 'problem' there is already solved by the upstream vendor.
The router firmware typically just reads the addresses from the NICs, unless you've overridedden it.
This is why you can flash a router with new firmware, including overriding and resetting all configuration and it doesn't lose its MAC.
and
Re: (Score:2)
That's almost never the case, actually.
Maybe on a PC NIC card it has an EEPROM that has the MAC and default startup information, but never on a rou
Re: (Score:2)
That's almost never the case, actually.
You know after I posted, I actually suspected there was no way modern consumer routers would have still have dedicated eeprom or even just prom for the network interfaces.
I expect the higher end stuff (and the modular stuff of course) still has its own. (as do standalone NICs for PCs PCI, USB, etc).
But I have no doubt you are completely right with modern consumer grade routers etc.
Thanks for the correction.
Dark side (Score:5, Funny)
Dark Helmet: So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!
Re: (Score:3, Funny)
Dark Helmet: So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!
President Skroob: Did it work? Where's the king?
Dark Helmet: It worked, sir. We have the combination.
President Skroob: Great. Now we can take every last breath of fresh air from Planet Druidia. What's the combination?
Colonel Sandurz: 1-2-3-4-5
President Skroob: 1-2-3-4-5?
Colonel Sandurz: Yes!
President Skroob: That's amazing. I've got the same combination on my luggage.
Re: (Score:2)
This is the most relevant topic I've read all day.
pfSense (Score:1)
Get some hardware, install pfSense, configure, never worry about this shit again.
Re: (Score:2)
W W W (Score:1)
"In this way, each infected host is constantly trying to spread the infection to new home routers and other devices" ... there used to be a name for this, oh, it's on the tip of my tongue. W.. W.. Wor..
Re: W W W (Score:2, Funny)
Oh! I know this one!
World Wide Web, right?
Remote Admin Enabled by Default? (Score:3)
Re: (Score:2)
But why is the router's diagnostic/config interface accessible from the WAN port? It seems rather obvious that only the LAN ports should have access to that.
Now, if this is some kind of buffer overflow error induced by malformed packets, that is of course rather different.
Re: Remote Admin Enabled by Default? (Score:2)
Or, they hack a host on the otherwise of the firewall, say via some JavaScript that sends commands to the router. It's very trivial. The assumption that everything on the LAN side is inherently safe is so 90s NFS/rhosts...
Re: (Score:2)
Botnet on other devices involved? (Score:1)
What would be the name of the Operating System that these other devices run on?
Re: (Score:2)
VxWorks.