10,000 Netgear Routers Hacked Via Zero-Day Flaw

More than 10,000 routers network manufacturer Netgear been hacked via a zero-day vulnerability for which no security update is made ​​available. That says Alexandre Herzog of the Swiss security company Compass Security. Through the vulnerability could allow an attacker without a valid password or user access to the admin panel.

The problem was reported to Netgear in July. In September, the network manufacturer announced that it had developed firmware for routers in which the problem was solved. It was, however, this is a beta version. Netgear did however not know when the final version would appear. On September 29, however, made another investigator same security issue known.Then Herzog decided Tuesday to place the vulnerability of details on the company website and Full Disclosure mailing list. Netgear user then let the mailing list know that he was hacked by the leak.

Herzog then asked for information from the victim, to step up the pressure on the Netgear. From the user's information appeared that his router was adapted so that all DNS requests were forwarded to the server of the attacker. The attacker would the user will have to send them to phishing sites or sites containing malware. Researchers from the Swiss security managed with a server that is to make up for the control of the infected routers compound was used. Then they found data indicating that more than 10,000 routers via the vulnerability were hacked, Herzog as late as compared Threat Post know.

The Swiss government GOVCERT would now be trying to get the server from the air and warned the providers of most victims. Which would are located mainly in the United States. To attack the vulnerability, the attack must be run from the internal network. In case the remote management is enabled, this can also be done directly from the Internet. Remote administration is not enabled by default. The problem is present in Netgear routers with the router firmware: N300_1.1.0.31_1.0.1.img and N300-1.1.0.28_1.0.1.img. This firmware is used among others in the WNR1000v4 Router.

Large DDoS Botnet Of Tens Of Thousands Of Routers Discovered

Researchers have discovered a worldwide botnet consisting of tens of thousands of hijacked routers and is used to carry out DDoS attacks on websites. Reported security Incapsula in a new report . Although the hijacked routers were found in 109 different countries, found that a majority (85%) is located in Brazil and Thailand.

The routers are in turn controlled via servers which are in China and the United States. The researchers thought initially that the routers were acquired via a vulnerability in the firmware. Further investigation showed, however, that all devices were accessible through the standard ports HTTP and SSH. Was not changed in almost all cases the default password.

Thus, the attackers were able to install the "MrBlack" malware on the routers. In addition, a script on the hijacked routers installed it looked for other vulnerable routers. To avoid getting users advised to change the default password such attacks, install the latest firmware and ensure that the operator interface is not accessible via HTTP or SSH. Something that through this tool can be controlled.

Increase DDoS Attacks Hacked Routers And Printers

Hacked printers and routers are responsible for an increase in the number and size of DDoS attacks.Other devices connected to the web and part of the "Internet of Things" are play a role, claims the security NSFocus.

In the attacks, the attackers use the Simple Service Discovery Protocol (SSDP), which is part of the UPnP protocol. This protocol is enabled on millions of devices, including routers, media servers, webcams, smart TVs and printers. Via SSDP devices can find each other easily networks and connect with each other. Through the SSDP protocol on these devices strengthen their criminals DDoS attacks.

The criminals in this spoof the IP address of the attack site and send packets to the router or other devices. Which then react with response packets that are sent to the spoofed IP address. According NSFocus attacks can in this way by a factor of 75 to be reinforced. The company further states that there are more than 7 million SSDP devices that can be used for DDoS attacks. As soon the Internet of Things becomes reality, whereby billions of devices coming online, expects IT security exponential growth of SSDP-like attacks.

"Recently more attacks were seen being launched from smart devices", say the researchers from the security company in this report . The reason is that smart devices have a relatively high bandwidth, often not be updated 24 hours a day online."As smart devices have weak passwords or other vulnerabilities, attackers can use them to carry out DDoS attacks."Recently warned also security company Arbor Networks to use SSDP for strengthening DDoS attacks.