Notorious Crime Gang Targets Internet Routers Using Tomato Firmware (arstechnica.com) 51
An anonymous reader quotes a report from Ars Technica: Internet routers running the Tomato alternative firmware are under active attack by a self-propagating exploit that searches for devices using default credentials. When credentials are found, the exploit then makes the routers part of a botnet that's used in a host of online attacks, researchers said on Tuesday. The Muhstik botnet came to light about two years ago when it started unleashed a string of exploits that attacked Linux servers and Internet-of-things devices. It opportunistically exploited a host of vulnerabilities, including the so-called critical Drupalgeddon2 vulnerability disclosed in early 2018 in the Drupal content management system. Muhstik has also been caught using vulnerabilities in routers that use Gigabit Passive Optical Network (GPON) or DD-WRT software. The botnet has also exploited previously patched vulnerabilities in other server applications, including the Webdav, WebLogic, Webuzo, and WordPress.
On Tuesday, researchers from Palo Alto Networks said they recently detected Muhstik targeting Internet routers running Tomato, an open-source package that serves as an alternative to firmware that ships by default with routers running Broadcom chips. The ability to work with virtual private networks and provide advanced quality of service control make Tomato popular with end users and in some cases router sellers. The exploits use already infected devices to scan the Internet for Tomato routers and, when found, to check if they use the default username and password of "admin:admin" or "root:admin" for remote administration. The exploit causes Tomato routers that haven't been locked down with a strong password to join an IRC server that's used to control the botnet. The infection also causes the routers to scan the Internet for servers or devices running WordPress, Webuzo, or WebLogic packages that are vulnerable.
On Tuesday, researchers from Palo Alto Networks said they recently detected Muhstik targeting Internet routers running Tomato, an open-source package that serves as an alternative to firmware that ships by default with routers running Broadcom chips. The ability to work with virtual private networks and provide advanced quality of service control make Tomato popular with end users and in some cases router sellers. The exploits use already infected devices to scan the Internet for Tomato routers and, when found, to check if they use the default username and password of "admin:admin" or "root:admin" for remote administration. The exploit causes Tomato routers that haven't been locked down with a strong password to join an IRC server that's used to control the botnet. The infection also causes the routers to scan the Internet for servers or devices running WordPress, Webuzo, or WebLogic packages that are vulnerable.
admin:admin (Score:4, Funny)
I dunno, "admin:admin" seems pretty hard to guess. It took me two tries (I forgot the colon the first time).
Router Remote Access (Score:2, Insightful)
Along with executables as email attachments, 2 of the dumbest ideas ever to appear on the Internet.
Re: (Score:2)
Re: (Score:3, Insightful)
Along with executables as email attachments, 2 of the dumbest ideas ever to appear on the Internet.
The actual idiocy isn't necessarily having that feature. It's having that feature turned on by default.
I also lay blame with the Tomato developers who should be forcing a password change upon first login. Every software developer should remember the #1 Rule that has never changed: Consumers are idiots. Code accordingly.
Re: (Score:2)
Re: (Score:2)
I'm guessing that, as in TFS, "router sellers" have pre-installed it so the end user who bought it is not part of the class and is, as you say, an average consumer who wouldn't know any better.
Re: (Score:2)
Re: (Score:2)
I can't fathom the idea of someone who will installl Tomato, turn on external access, and still use a default password. It's bizarre to me.
Consider yourself educated! Meet the newer, better moron. Nature always has a new model on deck.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I also lay blame with the Tomato developers who should be forcing a password change upon first login. Every software developer should remember the #1 Rule that has never changed: Consumers are idiots. Code accordingly.
Someone else said it - you can buy Tomato-installed routers. Some years ago I got one with DD-WRT installed that was sold "as new". Of course it wasn't as-new if they'd flashed the factory firmware off it. They'd also done the initial setup. The credentials were set back to admin:admin and the first-run wizard would no longer start. I ended up re-flashing the factory ROM on it and it worked just fine as a WiFi bridge for some years.
Forcing a password change doesn't help when shifty sellers and/or ISPs are g
Re: (Score:2)
"Notorious" (Score:1)
I remember the good ol' days when we only had non-notorious crime gangs.
Re: (Score:2)
Tech Savvy (Score:5, Insightful)
you're savvy enough to re-flash your router with custom firmware, but stupid enough to leave WAN enabled and with default credentials. You kinda deserve it.
Re: (Score:2)
This is the root cause here. I have a old router running tomato. Guess what? It doesn't have default credentials.
Re: (Score:1)
My first reaction was also, how could somebody able to reflash a router NOT change the default password? My second thought was, what percentage of routers running tomato are using the default? One percent? Five percent? Ten? That is the question I find really intriguing. Maybe the hackers know, but I doubt that they're gonna tell. Ah, but the summary did say that tomato is also popular with some router sellers. There ya go.
Re: (Score:2)
>"you're savvy enough to re-flash your router with custom firmware, but stupid enough to leave WAN enabled and with default credentials. You kinda deserve it."
You took the words out of my mouth. I specifically bought an exact model of an Asus router to run alternative firmware and selected Tomato Shibby, because it runs well and does what I want. What percent of the population would ever do this? And those that do, absolutely know to set a real/strong password on such a device that is acting as your f
1995 (Score:2)
Are we just going to gloss over the ability to connect via telnet?
Re:That must be a very small target (Score:5, Insightful)
That's basically what I came to say. The venn diagram of those two populations overlapping must look like a cat's eye in a bright room.
Was that really the default? (Score:4)
It's been several years now and even longer since I first set it up, but did it really default to remote access to settings? I thought that was an option you had to enable, in which case, why the hell would anyone enable remote settings access and not change the password? That's just asking for trouble. I guess maybe the default could vary depending on which Tomato variant you're using, now that I think about it.
Re: (Score:2)
Re:Was that really the default? (Score:5, Informative)
Certainly not. RTFA.
Remote Management (Score:3)
This requires you to turn on Remote Management, and still use a default password. You'd have to be brain-dead to do that.
Re: (Score:2)
Default credentials need to go (Score:2)
Re: (Score:2)
Some say Tomato ... (Score:1)
... some say Tomat0wned.
Not surprised. No focus on security. (Score:4, Insightful)
Tomato and DD-WRT have development models based on never releasing any stable release. Instead, they do nightly builds, with different code base for every router, which can often break things, so when you get a working one you stick to it, even if it has security flaws.
People who care about security should switch to OpenWRT. Hopefully their router will support it.
Re:Not surprised. No focus on security. (Score:5, Insightful)
Re: (Score:1)
Yet enough people do this for a group of people to spend time exploiting it. Why?
Re: (Score:2)
Re: Not surprised. No focus on security. (Score:2)
Maybe. But instead openwt doesn't have a password when you first install and you explicitly need to choose one. Also wifi is off.
Now, you can choose a weak password but it's still more secure by default than tomato and ddwrt.
Caution... Tangent Detected! (Score:2)
I got some of these for $10 from Amazon Refurb a while back, and they run OpenWRT just fine.
https://openwrt.org/toh/hwdata... [openwrt.org]
They only have 32MB of RAM (they do have 8MB flash though), so you will see a warning about the possibility of having problems using anything newer than the latest stable build, but I have had no problems with it, and it has been very helpful to learn OpenWRT.
There are also enthusiast builds for the device that are streamlined for RAM usage while still providing a web interface for co
The good old days (Score:2)
Re: (Score:2)
uh huh, evil people punching "lace cards" (all holes punched) that would jam the machines, there was danger lurking around every corner!
Good to know (Score:1)
If I ever pull my WRT54G w/ Tomato from the bottom of whatever storage bin it ended up in, I'll updated it before I plug it in.
Tomato Firmware? (Score:4, Funny)
I hope they catch up.
Where's the technology angle? (Score:2)
Microsoft is Testing Ads in WordPad in Windows 10 [slashdot.org]
Re: (Score:1)
Why FUD Tomato? (Score:2)
A set of people that have knowledge to flash router, would have a reason to turn on WAN management, and leave credentials default is astonishingly small.
enthusiast firmware (Score:1)
who tf is using Tomato with default credentials? (nobody)