German Government Launches Test Plan For Security Routers

In order to ensure that routers that individuals and small businesses purchase are safe, the Bundesamtes für Sicherheit in der Informationstechnik (BSI), part of the German Ministry of the Interior, today a comprehensive test plan ( pdf ) launched broadband routers.

The test plan, especially for Internet service providers and manufacturers intended, which describes a secure router to meet.In this way, potential buyers can more easily compare models in the field of security with each other. According to the BSI, the security of a router, an important factor when choosing a particular manufacturer or type. The German federal government has recently abolished the so-called router obligation. Thereby German internet users can choose yourself which soon modem and router that they want to use their broadband connection.

"Routers are a central part in the digitalization and networking. They are the heart of the home network, but protect at the same time against Internet threats. The abolition of the router obligation have internet August this this year more choice in choosing their router. users should make use of this by looking at the safety when choosing a router, "said Arne Schönbohm, head of the BSI.

In the test plan different parts are discussed, such as the presence of security measures. Thus, each router must sort the BSI have a firewall and there should be no default port forwarding enabled. In addition, made several recommendations, such as the presence of an automatic update feature. Furthermore, the test plan contains examples of common vulnerabilities and attack scenarios.

Makers Benign Router-Malware Publish Source Code

The creators of the benign malware routers, IP cameras and other Internet devices infects, and then secures the source code of their creation have been released and explained their motives. The malware came last week in the news and was released by security company Symantec Wifatch mentioned.

Last year, another researcher had already discovered the malware, which gave it the name ifwatch. The malware spreads via Telnet and uses weak passwords. Once active Wifatch disable the Telnet daemon, so that other attackers can not access anymore. The malware also leave a message for the owner behind to change the password, disable Telnet and update the firmware. Wifatch also has a module to remove other malware on the device.

After Symantec made ​​a blog posting on the malware creators published on Gitlab the source code, including their motivation. They also decided to Symantec approach. She says she developed the malware to learn from it and the project has no malicious intent. The authors regret that she unsolicited infect the machines of others, but argue that the benefits outweigh the disadvantages.

This relates to the amount saved bandwidth for other malware, the routers can use to scan ports or devices, power conservation because malware installed bitcoin miners are removed, any failures and reboots that are prevented by the routers and devices do not overheat and all passwords and money that criminals do not have to steal.

With regard to the source code is now published which partially complete. The part that creates is in fact removed before the infection, as well as the code for creating the malware. This should prevent others can use it, even though the makers warn that sensitive devices can be accessed via Telnet with a default password can be acquired by anyone. Even if they do not have the Wifatch malware.

Helpful Malware Infected And Secure Routers

Researchers have developed a kind of "helpful" discovered malware that infects Internet routers and IoT devices, and then secure the devices and to remove any existing malware. The malware by security firm Symantec Wifatch called and last year was already discovered by another researcher, who gave the name ifwatch gave.

The malware spreads probably via Telnet and uses weak passwords. Once active, the routers and other devices part of a peer-to-peer network to exchange threat information. Furthermore Wifatch disable the Telnet daemon, so that other attackers can not gain access. The malware also leave a message for the owner behind to change the password, disable Telnet and update the firmware. Wifatch also has a module to remove malware infections on the unit.

Despite the actions that Symantec designates Wifatch executes the program so as malware, partly because it contains a number of general backdoors that the creator can access. The backdoors do require a digital signature, so others can not use.Symantec may be tens of thousands of devices with malware infected, most of them in China and Brazil. Owners of an infected router to remove Wifatch can easily do this by resetting the device.

Asus DSL Modem Router Vulnerable By Fixed Password

In several ADSL modem routers, including those of the Taiwanese manufacturer Asus, is called a "hard-coded" password is used, which allows remote attackers as an administrator can log onto the devices. Before that warns the CERT Coordination Center (CERT / CC) at Carnegie Mellon University.

The problem is present in the Asus DSL-N12E, DIGICOM DG-5524T, Observa RTA01N Telecom, Philippine Long Distance Telephone (PLDT) Speed ​​Surf 504AN and ZTE ZXV10 W300. The Asus model is also sold in the Netherlands. The permanent password allows an attacker to connect through telnet to the device. The password is partly based on the MAC address of the device, but it can be traced via SNMP (Simple Network Management Protocol (SNMP). Since there is no update is available, users are advised to ensure that telnet is not for " unreliable sources "is accessible and that SNMP is disabled on the routers.

Linux Malware Allows Routers On Facebook And Twitter Defraud

Linux / Moose Overview

Researchers have discovered a new form of Linux malware that tries to take over routers subsequently on social networks like Facebook, Twitter, YouTube, Instagram and other sites to commit fraud with. The malware is called Moose ( pdf ) and scans the internet in search of Linux routers with an accessible Telnet service. Once found, will perform a brute force attack to gain Telnet access to the router.

Moose will modify the DNS in the event of a successful attack, steal the unencrypted network traffic to and from the router, perform man-in-the-middle attacks and offer proxy services for the malware creator. In practice, the malware will steal HTTP cookies from the aforementioned social networking sites to perform with fraudulent actions, such as "track", "view" and "like" of users and content on the websites.

In addition, the malware infected routers will also be used to scan for new vulnerable systems. According to researchers from the Slovak anti-virus company ESET malware is remarkable, because most Linux malware going around and it has developed features on routers to perform DDoS attacks. ESET also denounces the security of routers to be desired and allows this type of malware can strike.

"Witness the primitive techniques Moose used to access other devices, it is unfortunate that the security vendors of routers do not take seriously", say the researchers conclude. That also recommend IT experts to check the routers acquaintances on firmware updates and safe settings if they are nearby.

Leaks In Routers Belkin, TP-Link D-Link Active Attacked

Focus cyber criminals in attacking vulnerabilities especially on browsers and browser plug-ins, however, are also an interesting target routers. A well-known researcher has discovered a exploit kit namely that leaks into the routers include Belkin, TP-Link D-Link attacks.

These are vulnerabilities that are disclosed in 2008, 2013 and 2015 and patched. Because routers are not automatically updated and many consumers do not own install available updates, it can indeed prevent further routers in circulation with vulnerabilities of seven years ago. In addition, the exploit kit also performs brute force attacks on all other models, including those from Microsoft and Linksys. In case the attacks are successful adjusts the DNS of the router. This allows attackers to traffic from the attacked router by running their own servers, or users of the attacked router forwarding to phishing sites.

Security Researcher 'JuK' of the blog Malware Do not Need Coffee discovered the exploitkit. That appears to work only from certain IP ranges. Once a router has changed the IP addresses of the DNS servers are changed and then reboot the router.As a secondary DNS server defaults DNS server of Google. This should prevent the investigator users suspect something when there are problems with the IP address of the first DNS server arise.

Increase DDoS Attacks Hacked Routers And Printers

Hacked printers and routers are responsible for an increase in the number and size of DDoS attacks.Other devices connected to the web and part of the "Internet of Things" are play a role, claims the security NSFocus.

In the attacks, the attackers use the Simple Service Discovery Protocol (SSDP), which is part of the UPnP protocol. This protocol is enabled on millions of devices, including routers, media servers, webcams, smart TVs and printers. Via SSDP devices can find each other easily networks and connect with each other. Through the SSDP protocol on these devices strengthen their criminals DDoS attacks.

The criminals in this spoof the IP address of the attack site and send packets to the router or other devices. Which then react with response packets that are sent to the spoofed IP address. According NSFocus attacks can in this way by a factor of 75 to be reinforced. The company further states that there are more than 7 million SSDP devices that can be used for DDoS attacks. As soon the Internet of Things becomes reality, whereby billions of devices coming online, expects IT security exponential growth of SSDP-like attacks.

"Recently more attacks were seen being launched from smart devices", say the researchers from the security company in this report . The reason is that smart devices have a relatively high bandwidth, often not be updated 24 hours a day online."As smart devices have weak passwords or other vulnerabilities, attackers can use them to carry out DDoS attacks."Recently warned also security company Arbor Networks to use SSDP for strengthening DDoS attacks.

Shodan Search Engine Will Find Thousands Of Hacked Websites

Many websites hacked and leave a message of the attacker behind often with "Hacked by" begins. The developer of the search engine Shodan is using this term were found thousands of websites have been hacked recently and were provided with the text "Hacked by."

Shodan is known as search engine that sorts of devices connected to the Internet, such as printers , routers, cameras and even complete industrial SCADA systems can be found. However, the search engine indexes also websites. The research that developer John Matherly conducted revealed that many of the hacked websites were hosted by one provider. A quarter of the "Hacked by" sites was in fact housed in the E commerce Corporation.

Almost all servers of this hosting company running on Apache and PHP, although not all have the same versions. Continue turning the most hacked websites not entirely surprised on port 80 (HTTP). Matherly also wanted to know what attackers had most websites and so could create a Top 10, where "GHoST61" 57 defacement's ends on the first place. The investigation of the Shodan developer late unfortunately not see how the sites were compromised.

Phishing Mail Hijacks Routers Using Default Password

During the final weeks of last year and the first half of January, cybercriminals conducted a small-scale email attack which tried to hijack different models of routers. The less than 100 emails were sent to Brazilian Internet users.

The email seemed the largest Brazilian telecommunications company coming and contained a link to a website. This website was abuse of cross-site request forgery (CSRF) vulnerabilities in the UTStarcom- and TP-Link routers from the telco. The CRSF attack tried to log into different default passwords and administrator names on the router. In case the attack was successful, the DNS servers from the router were changed.

The Domain Name System (DNS) is similar to the directory and translates among other domain names into IP addresses. The DNS hijacking an attacker can manipulate the movement of users and intercept sensitive data. Example, if users want them to be redirected to another page to their banking site. During the attack on Brazilian users to security firm Proofpoint , the campaign found out, not knowing what was done using the custom DNS servers.