Hundreds of Thousands of Realtek-based Devices Under Attack from IoT Botnet

A dangerous vulnerability in Realtek chipsets used in hundreds of thousands of smart devices from at least 65 vendors is currently under attack from a notorious DDoS botnet gang. From a report: The attacks started last week, according to a report from IoT security firm SAM, and began just three days after fellow security firm IoT Inspector published details about the vulnerability on its blog. Tracked as CVE-2021-35395, the vulnerability is part of four issues IoT Inspector researchers found in the software development kit (SDK) that ships with multiple Realtek chipsets (SoCs). These chips are manufactured by Realtek but are shipped to other companies, which then use them as the basic System-on-Chip (SoC) board for their own devices, with the Realtek SDK serving as a configurator and starting point for their own firmware. IoT Inspector said they found more than 200 different device models from at least 65 different vendors that had been built around these chips and were using the vulnerable SDK.

Global coverage.

[Ostracus]

Practically every motherboard ever made.

Re:

[Tabitha 696]

Blame that Taiwanese.

Re:

[Tabitha 696]

Blame on Taiwan . . ;

Re:

[Robin Willians]

Good point. May the island sink beneath the seas by tsunami and have its greatness restored in future generators.

Re:Global coverage.

[ericspinder]

The exploit uses problems with the Realtek Jungle SDK (version v2.x up to v3.4.14B), which starts a webserver with vulnerabilities to provide an API for firmware. I think the regular drivers used by most are fine. My half checked guess is that blocking the port from anything but localhost is the best solution if you can't stop it.

Re:

[arglebargle_xiv]

One thing it doesn't mention is which "stripped-down Linux" it was using, but I'd be willing to bet it's the near-universal-standard 2.6.2 kernel that all commercial IoT devices are required to run in order to give the bad guys a fair go (200+ documented vulns).

devices are used mainly to enhance Wi-Fi reception

[tekram]

Netis E1+ extender Edimax N150 and N300 Wi-Fi router Repotec RP-WR5444 router These devices are used mainly to enhance Wi-Fi reception.

Much of this can be avoid by...

[Goatbot]

Compiling your own source code. Binary fingerprints are by far the easiest way to flush out places to attack. If you modify the code to suit your exact purpose it will be less likely to share the same attack surface. It will likely still be vulnerable but at least the automated scanners will not find you. An attacker will likely need to modify some variables to match your circumstances. This should buy you enough time to patch, test and deploy new binaries to production. When I used to be a Sendmail admin in the 90's I usually had a few different binaries ready to roll to keep ahead of the spammers. I see little differences to any other code.

Re:

[OrangAsm]

So your recommendation is to use Faketek?

Re: Much of this can be avoid by...

[Goatbot]

No my solution is to not use pre compiled binaries, nothing fake or bad about it. Get a development box and compile the code yourself if problems like this are an issue. It's only a stop gap measure.