| Router Security | Router attacks in the news |
Website by Michael Horowitz |
Routers in the news, pretty much means routers getting exploited by bad guys to do bad things. I am still waiting for a good news story about routers. The bugs/flaws that bad guys exploit are documented on the Bugs page. In August 2026 Router News stories from 2020 back through 2012 were moved to a new page as this page was getting too big.
YEARS: 2026 2025 2024 2023 2022 2021 2020 thru 2012
SEPTEMBER 2026
Reviews of VPN routers
The 5 Best VPN Routers of 2026
by Bec Schroer of Rtings.com September 28, 2026
Without an account at Rtings, the full specs/opinions are not available. All the recommended models can be both a VPN client
and a VPN server. Some models support multiple simultaneous VPN connections. Some are Wi-Fi 7 which is expensive
compared to Wi-Fi 6 and overkill for many people.
Their overall best is the ASUS ROG Strix GS-BE18000 (Wi-Fi 7) but it does not have a kill switch.
Their best upper middle class is the UniFi Dream Router 7. I am not a fan of Unifi.
Their best mid-range is the GL.iNet Flint 3 (GL-BE9300) which is Wi-Fi 7. It supports multiple concurrent VPN connections and
comes pre-loaded with profiles for more than 30 VPN providers.
Their best lower middle range is the GL.iNet Flint 2 (GL-MT6000) which is Wi-Fi 6.
Their cheapest recommended router is the TP-Link Archer BE230 but it does not have a kill switch.
As for a travel router with VPN functionality, they like the GL.iNet Slate 7 (GL-BE3600).
The worst routers to be currently using
Exploited, Abandoned, Still Online: The End-of-Life Routers CISA Keeps Ordering Unplugged
by Scott Bissett of EOL Watch September 2, 2026
A lists of D-Link and Zyxel routers that are buggy, being exploited and should be thrown away. Quoting: "If you run any device on this page, the vendors and CISA agree on the remediation: replace it. There is no configuration that makes an unpatchable, actively-exploited device safe to keep on the internet. Beyond the specific models: treat vendor end-of-support dates as removal deadlines for anything that faces the network ..."
AUGUST 2026
Nothing to see here
DEF CON dingus suspected of trying to take over Delta in-flight Wi-Fi
by Brandon Vigliarolo of The Register August 11, 2026
All the facts here are not known and likely never will be. Maybe the on-board Wi-Fi was jammed, maybe not. That would be a really dumb thing for a passenger to do. And, its not needed. Maybe the malicious passenger ran a de-auth attack; maybe not. In this attack, a bad guy forces devices to disconnect from the Wi-Fi.
The interesting thing about de-auth is that the ability to do this was removed in WPA3. Maybe the malicious passenger ran an evil twin (same network name but a different network nonetheless), maybe not. Maybe they just created a network with a name very similar to real SSID used by Delta Airlines. Note that network names are case sensitive, so "DeltaWiFi" is different than "DeltaWifi". For more, see the SSID page here. Maybe they created a captive portal network to scam people out of personal information. This can only work if the airline fails to explain what the captive portal is and what it asks for. For example, it will ask for your seat number, but not for a credit card number or a Google login. So, much ado about nothing, other than to always use a VPN on public Wi-Fi and be very wary of captive portals. Not said in articles about this is that any number of Android apps can detect the signal strength of nearby Wi-Fi networks. An airline employee can walk up/down the aisle and get a good idea of the rows where the signal is strong. Then, search the passengers in those rows when they leave the plane. So, this story serves mostly as an example of miserable media coverage.
Russians Hacking Public Wi-Fi targeting easily fooled Windows users
Russian spies turn public Wi-Fi into malware delivery systems
by Connor Jones of The Register August 3, 2026
Russian foreign intelligence operatives (SVR) are compromising captive portal networks in hotels and conference centers to deliver malicious software such as infostealers and keyloggers. The malware in the router manipulates DNS and HTTP traffic to reroute victims through attacker-controlled infrastructure.
It also abuses the connectivity checks in operating systems to trigger malicious prompts and redirects. A report by Microsoft calls the campaign 'CaptiveCrunch' but Microsoft does not know how the initial router hack is accomplished. Nor do they cite the router manufacturer(s) of the compromised networks.
The report comes from Microsoft because the Russians primarily target Windows PCs. Victims are tricked into installing malware on their computer with Russian lies about OS updates, driver repairs and web verification failures. Microsoft says the Russians are after victims' browser session cookies, saved passwords, SSO tokens and Wi-Fi credentials.
Backdoor found in all Zbtlink routers
ENDLESSDOORS Is Phoning Home. Pick Up.
by Jacob Baines of Vulncheck August 5, 2026
Routers from Zbtlink have shipped with a back door for years. The company claims it was for tech support. Should we believe them? Quoting Jacob Baines: "We did not notify Zbtlink. Coordinated disclosure exists to give a vendor time to fix a defect. It assumes the vendor did not intend the behavior. That assumption doesn't hold here. This isn't a memory corruption bug in a parser. It's a component in the vendor’s product, started at boot by the vendor's own init script, shipped across twenty models and years of images. There is no patch to coordinate." The backdoor software is based on rctl (remote control linux) and it has been codenamed ENDLESSDOORS. It phones home on its own, there are no open TCP/IP ports to scan for. Steve Gibson's ShieldsUP! is no help detecting this. It phones home to one of these: rbdg4nzqadui.wikaba.com, zbtctl.epplink.net, online-string.com and a hard coded IP addresses. Does that feel more like spyware or tech support to you? Vulncheck assigned this CVE-2026-66747. The back door was found in at least 20 router models from Zbtlink. But, they also sell their routers to third-party vendors, which can rebrand them. For example, Wiflyer, ZBT and ZBTWiFi are all Zbtlink. Zbtlink routers were sold on Amazon and Newegg, they are now sold on Alibaba. As for detection, watch for outbound requests to ports 7000 and 7001.
Update: August 27, 2026. This was worse than originally thought. Follow-up report: Chinese Implants in the Supply Chain by
Jacob Baines of VulnCheck. Quoting: "After publishing ENDLESSDOORS, we wanted to know how far ZBT’s supply chain reached. The answer: everywhere. FCC filings, patent records, and archived web pages tied ZBT hardware to brands across the United States, Canada, Australia, the Philippines, Germany,
and Russia." They looked at a router from Deep Orange and "We found two new implants on the device. SPEAKINGSTONE ... is a phone-home implant that connects back to ZBT’s cloud infrastructure and accepts remote commands. DARKLANTERN is a backdoor that listens on the WAN and executes arbitrary commands. No authentication required ... Shenzhen Zhibotong Electronics is not known as a consumer brand. Mostly, it manufactures devices that other companies sell under different names ... In the United States, the platform found its way into products aimed at people on the move, including Lippert Components WiFi On-The-Go and Wave WiFi’s MBR 500/550 series."
JULY 2026
The Russians are coming, the Russians are coming
The US government warns that Russia state hackers are coming after your router
by Dan Goodin of Ars Technica July 13, 2026
Quoting: "The federal government is warning users of home and small office routers to secure their devices as Russia state hackers continue to mass-compromise them for use in obscuring nefarious actions against sensitive organizations in the public and private sectors . . . The primary means of compromise the agency warned about was hackers scanning IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default authentication credentials . . . By sending malicious traffic from spoofed addresses, the hackers can use the SNMP agent on poorly configured routers to run malware. SNMP allows users to collect and organize information about managed networking devices or to modify that information to change device
behavior." The article offered some detailed defensive steps for routers with configurable inbound and outbound firewalls (in other words, the advice is not for consumer routers). Specifically, block these ports in both directions: UDP port 69 (TFTP), TCP port 4786 (SMI), UDP ports 161 and 162 (SNMP),
TCP and UDP ports 10161 and 10162 (SNMP v3)
JUNE 2026
A look at Netgear and TP-Link
There's a Secret Backdoor in Netgear Routers, ft. Wendell of Level1
Techs
YouTube video by GamersNexus June 19, 2026
quoting: "Wendell from Level1 Techs has unearthed several concerning vulnerabilities in both Netgear and TP-Link routers, in particular, exposing potential vulnerabilities that could be used as backdoors. This comes at a time of peak ID verification online, which we think isn't a mistake in its link to the recent router changes. We previously covered the router ban in the US and how it has expanded to cover more devices. Netgear was granted exemptions, but not its competitors. Wendell explores both." A Netgear router responds to a magic packet that opens up exploitable software. Wendell's website is
Level1Techs.com.
EoL D-Link Routers Hacked
Thousands of D-Link routers under control of AryStinger botnet
by Pieter Arntz of MalwareBytes June 22, 2026
You could make a case that this is not news. Old consumer routers that no longer get bug fixes were hacked. Quoting: "The AryStinger botnet is mainly built on compromised D‑Link DIR‑850L and DIR‑818LW routers. Although these devices are long past end‑of‑life, they are still widely used in homes and small offices, making them attractive targets for botnet operators . . . The attackers exploited vulnerabilities disclosed 13 years ago . . . The botnet’s primary purpose is reconnaissance at scale . . . This is not the first time attackers have built a botnet from abandoned networking equipment. Unfortunately, the most effective solution is also the least popular one: Replace end-of-life routers and NAS devices." The malware can also modify the DNS settings in the router and monitor all inbound and outbound network traffic.
MAY 2026
A Router Security Scorecard website
Router Vulnerability: FBI Reboot Warning and Security Steps
by Michael Ginsberg of 5GStore May 12, 2026
5G Store sells professional grade routers. I have purchased my share of Peplink routers from them. This article pushes a point of view that I agree with, that the security of consumer routers is miserable. In this case, so bad that the FBI had to take action on some infected routers. The article promotes a new Router Security website, from 5G Store, called RouterCVE.com. A CVE is number assigned to a bug. The website tracks the number of known reported bugs, and their severity, for assorted routers. This information is already public, the site just presents it in a digestible format. Yes, this is self-promotion, as professional routers have far fewer bugs than Asus, TP-Link and other consumer models. That doesn't make it wrong. Look up the security score for your router. Quoting the article: "Enterprise-grade equipment from manufacturers like Peplink, Cradlepoint, and Teltonika consistently score higher thanks to regular security updates and robust security features . . . Consumer router manufacturers prioritize cost reduction over security, resulting in devices with known vulnerabilities and limited update lifecycles . . . Organizations serious about security should invest in professional-grade routers from established manufacturers like Peplink, Cradlepoint, Teltonika, Semtech, Inseego, Digi, and Katalyst."
APRIL 2026
Buying TP-Link turns out to have been a bad idea. Suck it Wirecutter.
Got an ISP Warning About Your TP-Link Router? Consider Replacing It
by Michael Kan of PC Magazine April 30, 2026
Quoting: "If you own an old TP-Link router, you might receive an email from your internet service provider, urging you to secure it. Spectrum is notifying US customers about Russian spies exploiting vulnerable TP-Link routers to conduct hacking activities . . . the Spectrum emails are legit and are part of the FBI’s effort to crack down on Russian hackers abusing 23 TP-Link router models. Federal investigators indicated they were working with ISPs to notify owners of the affected routers, so it’s possible that more broadband providers will issue their own warnings.". Some of the vulnerable router models have patches, some do not. The article recommends buying a new router.
Maybe avoid Cisco
Firestarter malware survives Cisco firewall updates, security patches
by Bill Toulas of Bleeping Computer April 24, 2026
Just confirmation of my already held opinion: avoid Cisco. Quoting: "Cybersecurity agencies in the U.S. and U.K. are warning about a custom malware called Firestarter persisting on Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software . . . Once Firestarter nests on the devices, it maintains persistence across reboots, firmware updates, and security patches. Furthermore, the backdoor relaunches automatically if terminated. Persistence is achieved by hooking into LINA, the core Cisco ASA process, and using signal handlers that trigger reinstallation routines." Which bug did the bad guys use to get access to the vulnerable systems in the first place? There are two suspects. Only two?
US Government carries on as usual
FCC exempts Netgear from ban on foreign routers, doesn’t explain why
by Jon Brodkin of Ars Technica April 15, 2026
It seems the first set of bribes has been paid. Both Netgear and Adtran were allowed by Trump government sycophants to import new routers. Why? None of your business. The exemptions expire October 1, 2027, and will have to be renewed. Then too, there is this:
"THE TRUMP ADMINISTRATION IS RESERVING THE RIGHT TO BLOCK SECURITY PATCHES AND OTHER SOFTWARE UPDATES." If this is not on Putin's orders, then you explain it.
Russians hacking DNS in old, not dead but should be, routers
Russia Hacked Routers to Steal Microsoft Office Tokens
by Brian Krebs of Krebs on Security April 7, 2026
Hackers linked to Russia’s military intelligence units are using known bugs in old Internet routers to steal authentication tokens from Microsoft Office users. These state-backed Russian hackers have compromised more than 18,000 networks. The bad guys are using known bugs to modify the DNS settings of the routers to include DNS servers controlled by the bad guys. Microsoft identified more than 200 organizations and 5,000 consumer devices that were part of this spying network. Hackers primarily targeted government agencies. More than 18,000 routers were hacked, mainly older Mikrotik and TP-Link devices. You are in luck by being at this website. The Test Your DNS page lets you test the DNS servers used by your operating system and web browsers. There are lots of comments to both this article on the one below by Dan Goodin that the explanations are poor. They do make the problem seem worse than it is. Krebs omits the fact that users have to click through browser warnings to get their passwords stolen. Neither article mentions HSTS which anyone who understands things would have included. Neither article mentions whether the hack affects only old DNS or also the newer more secure flavors of DNS. Neither article mentioned the specific browser warnings that victims would see and have to ignore to have their passwords stolen.
MARCH 2026
Asus routers being hacked
14,000 routers are infected by malware that’s highly resistant to takedowns
by Dan Goodin of Ars Technica March 11, 2026
Quoting: "Researchers say they have uncovered a takedown-resistant botnet of 14,000 routers and other network devices - primarily made by Asus - that have been conscripted into a proxy network that anonymously carries traffic used for cybercrime. The malware - dubbed KadNap - takes hold by exploiting vulnerabilities that have gone unpatched..." What is implied here, but not said, is that available bug fixes have not been installed. No doubt, this is because Asus routers do not self-update. Non techies should use routers that do self-update. Lots of fault to go around. The botnet was discovered by Black Lotus. When I wrote this up (May 26, 2026) the Black Lotus Labs report that assorted articles linked to, was gone. Strange. To remove the malware, a simple router re-boot won't do. The router needs to be factory reset. Which models are infected? It does not say. Is your Asus router infected? Its very hard to tell.
In the US, the FCC meddles with routers
FCC bans import of new consumer routers made overseas, citing security risks
by
Zack Whittaker of TechCrunch March 24, 2026
Almost all routers are made outside the US. That said, the FCC declared that no more routers made outside the US can be imported to the country. At least, not without bribing someone in the US government first (they did not say that, I did). The routers that are here can stay and people can keep using them. Unsold routers on the shelves at Best Buy can continue to be sold. Just no new imports. The FCC claims security is the reason, not bribery. But, if security were the real reason the actions taken would be different. Quoting from the article: "The FCC did not provide evidence to show that U.S.-made consumer routers are more secure than routers developed overseas." The FCC would not speak with the reporter who wrote this article which does not surprise me as he actually knows the subject matter. There have been proposals to ban TP-Link routers but the US Government decided not to. Then, this reversal. The FCC also said that routers: ".... may continue to receive software and firmware updates that mitigate harm to U.S. consumers at least
until March 1, 2027.". So they are considering cutting off firmware updates? If this was really about security, they would be doing the opposite. And, FYI, it would be pretty much impossible to block all routers from making firmware updates, but politicians are not concerned with reality, just with perceptions.
A miserable Dutch ISP
Odido routers forwarded customers' personal data to American AI company for years
from NL Times in The Netherlands March 11, 2026
Dutch Internet service provider Odido was found spying on their customers. For years, their routers forwarded data to an American AI company, Lifemote. This was uncovered by the Telegraaf newspaper which also found that the practice ceased after the bad publicity. The routers sent both the names and MAC addresses of all the devices on a home network. Names are something like "Jans iPhone" or "Apple TV in living room." The routers also shared the names and MAC addresses of surrounding Wi-Fi networks and hotspots. Note that iPhones and Android phones also phone home with information about nearby Wi-Fi networks. This was Odido's second black eye:
hackers broke into their systems and stole the personal data of 6.2 million customers.
Hacked routers used by bad guys for bad things
Operation Lightning takes
down SocksEscort proxy network blamed for tens of millions in fraud
by Jessica Lyons of The Register March 12, 2026
Quoting: "Cops from eight countries this week disrupted SocksEscort, a residential proxy service used by criminals to compromise hundreds of thousands of routers worldwide and carry out digital fraud . . . These types of proxy services hack residential routers and small business devices, and then sell access to the compromised machines for large-scale fraud and digital crimes. Using compromised routers allows miscreants to mask their true online location - and their criminal activities - by making it appear to originate from a legitimate home or small-business user. SocksEscort infected home and small business internet routers with a botnet called AVRecon. The malware allows criminals to remotely control the infected device, and direct internet traffic through the compromised routers . . . As of last month, the criminal network listed access to about 8,000 infected routers to its customers . . . " Bad guys were using the hacked devices for ransomware, ad fraud, account takeovers, identity theft, business email compromises, romance scams, password spraying and more. Which routers? The article does not say.
JANUARY 2026
The Kimwolf Botnet
The Kimwolf Botnet is Stalking Your Local Network
by Brian Krebs January 2, 2026
Strictly speaking, this is not a router issue. The botnet spreads via pre-infected Android TV boxes, Android based picture frames and malicious mobile apps. The scary part is that you install the malware on your LAN, so the firewall in your router offers no protection. The malware, in effect, punches a hole in your router firewall.
NOVEMBER 2025
Still more on whether TP-Link is bad or not
Banning TP-Link won't save America from its own terrible cybersecurity
by Zack Whittaker November 26, 2025
One point of this article is that TP-Link does not stand out for bad security, they are instead, part of a crowd of router manufacturers that all have miserable security. I agree. His summary of the TP-Link situation: "The short version is that the U.S. government wants to ban TP-Link routers because several U.S. federal agencies believe ... that there are sufficient links tying TP-Link to China, and that could theoretically allow the Chinese government to force TP-Link to act in some nefarious capacity ... The subtext is that this ostensible Chinese government control could force TP-Link to roll out malicious updates, or suddenly block its products from working en masse ... " He says that banning TP-Link routers will not make the US safer. I agree, however, it may get other vendors to pay more attention to security, or get consumers to consider security when buying a router. Not likely though. The article has no mention of this site, so it falls into the things are bad mold while providing no useful advice. Some other quotes:
A bad stretch for Fortinet
Fortinet devices are a bit too high end for me to focus on. Still, we can't ignore these stories. Exploiting at least one of the bugs is described as low-complexity. Also, exploitation does not require user interaction, so bad. Quoting the November 19th article below: "In August, Fortinet addressed another command injection vulnerability (CVE-2025-25256) in its FortiSIEM solution, following a GreyNoise report warning of a surge in brute-force attacks against Fortinet SSL VPNs. Fortinet vulnerabilities are commonly exploited in cyber espionage and ransomware attacks. For instance, in February, Fortinet revealed that a Chinese hacking group tracked as Volt Typhoon exploited two FortiOS SSL VPN flaws to breach a Dutch Ministry of Defence military network using a custom remote access trojan (RAT) called Coathanger."
Asus routers being hacked
New WrtHug campaign hijacks thousands of end-of-life ASUS routers
by Bill Toulas of Bleeping Computer November 19, 2025
Quoting: "Thousands of ASUS WRT routers, mostly end-of-life or outdated devices, have been hijacked in a global campaign called Operation WrtHug that exploits six vulnerabilities. Over the past six months, scanners looking for ASUS devices compromised in Operation WrtHug identified 'roughly 50,000 unique IPs' around the globe." This means, in English, that 50,000 routers are know to have been hacked. None of the hacked Asus routers are in China. Buggy models of ASUS Wireless Routers: 4G-AC55U, 4G-AC860U, DSL-AC68U, GT-AC5300, GT-AX11000, RT-AC1200HP, RT-AC1300GPLUS and RT-AC1300UHP.
End of Life models need to be retired. Asus has bug fixes available for current models.
OCTOBER 2025
TP-Link bad
US Effort to Ban TP-Link Routers Picks Up
Steam
by Michael Kan of PC Magazine October 30, 2025
Late in 2024, the Wall Street Journal revealed an effort in the US government to ban TP-Link hardware. Now, according to the Washington Post, the proposal to ban TP-Link device sales in the US has been supported by several additional US government agencies, clearing the way for the Commerce Department to act. The Commerce department has concluded that nothing short of a ban against TP-Link will suffice. The key concern mentioned in the article is that the Chinese government could secretly compel TP-Link to assist in spying on or infiltrating American communications or companies. Another huge concern, not mentioned, is how insecure routers enable the creation of botnets. Nothing about turning in existing TP-Link devices to be melted down.
Proof that Router Security is Important
DDoS Botnet Aisuru Blankets US ISPs in Record DDoS
by Brian Krebs October 10, 2025
Quoting:"The world’s largest and most disruptive botnet is now drawing a majority of its firepower from compromised Internet-of-Things (IoT) devices hosted on U.S. Internet providers . . . with recent attacks siphoning Internet bandwidth from an estimated 300,000 compromised hosts worldwide. The hacked systems that get subsumed into the botnet are mostly consumer-grade routers, security cameras, digital video recorders and other devices operating with insecure and outdated firmware, and/or factory-default settings."
A security company found that the firmware distribution website for cheap Totolink routers was hacked. Also, as one botnet was disabled, other botnets re-infected the vulnerable devices that had been hacked by the disabled botnet.
AUGUST 2025
A bug from 2018 is still being exploited
Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure
Alert Number: I-082025-PSA
From the FBI August 20, 2025
Quoting: "The FBI detected Russian FSB cyber actors exploiting Simple Network Management Protocol (SNMP) and end-of-life networking devices running an unpatched vulnerability (CVE-2018-0171) in Cisco Smart Install (SMI) to broadly target entities in the United States and globally." Failure upon failure.
Yet Another Example of Bugs in a High End Device
SonicWall urges admins to disable SSLVPN amid rising attacks
by Sergiu Gatlan of Bleeping Computer August 5, 2025
Quoting: "SonicWall has warned customers to disable SSLVPN services due to ransomware gangs potentially exploiting an unknown security vulnerability in SonicWall Gen 7 firewalls to breach networks over the past few weeks . . . Two weeks ago, SonicWall also warned admins to patch their SMA 100 appliances against a critical security vulnerability (CVE-2025-40599) that may be exploited to gain remote code execution on unpatched devices." As is always the case with a remotely exploitable bug, one defense is to limit the source IP addresses that are allowed to connect to a the WAN side of a router/firewall. But this takes almost constant work to maintain the list of good IP addresses and will surely cause some techie to be woken in the middle of the night. So, unlikely to be implemented.
Netgear Web Interface Tricks
NETGEAR Devices Hidden Page List
by scramblr Last Updated August 2, 2025
Quoting: "Did you know that Netgear routers, WiFi Access Points, Switches, etc all have hidden pages that the developers left in the production images? Was it intentional? Who knows these days. Why hidden? Ask Netgear. Is it awesome and filled with cool functionality you never knew existed on your Netgear: Almost certainly, yes."
This describes, in detail, two hidden pages in the web interface of Netgear devices. One is debug.htm from which we learn that the devices has a debug log capture. Another page is WiFi_HiddenPage.htm with the sort of information you might expect. The writeup also lists other hidden web pages that are not the Netgear devices the author has access to, so no details on those.
An Attack on Huawei Routers
Luxembourg probes reported attack on Huawei tech that caused nationwide telecoms outage
by Alexander Martin of TheRecord August 1, 2025
Quoting: "Luxembourg’s government announced on Thursday it was formally investigating a nationwide telecommunications outage caused last week by a cyberattack reportedly targeting Huawei equipment inside its national telecoms infrastructure . . . The outage on July 23 left the country’s 4G and 5G mobile networks unavailable for more than three hours . . . Internet access and electronic banking services were also inaccessible . . . the attack was intentionally disruptive . . . the attackers exploited a vulnerability in a 'standardised software component' used by POST Luxembourg, the state-owned enterprise that operates most of the country's telecommunications infrastructure . . .
the attack targeted software used in Huawei routers."
JULY 2025
The TP-Link Archer C50 is EoL, But . . .
TP-Link Archer C50 (EOL) Exposed: Hardcoded DES Key Allows Sensitive Config Decryption (CVE-2025-6982)
by Ddos of SecurityOnline.info July 30, 2025
TLDR: A TP-Link router is buggy, old and TP-Link won't fix it. If you have one, you should throw it out. But that's not the most interesting thing here.
The router is the TP-Link Archer C50 and it is End-of-Life (EoL). Consumer router companies, as a rule, do not make exceptions, when a router no longer gets
bug fixes, it is time to replace it. The particular bug is a hardcoded static encryption key for the firmware. The encryption key protects the router's configuration (admin credentials, Wi-Fi passwords, etc) and this can be trivially decrypted. The good news: this does not appear to be a remotely exploitable flaw. That the C50 is buggy is no surprise. A December 2024 in Forbes (see below) said "CyberNews, a cybersecurity publication, reported in 2021 the firmware in TP-Link’s Archer C50 router contained at least 24 vulnerabilities, including some that would allow hackers to gain access to the user’s network." That the C50 is EoL is also not news. According to TP-Link (link below) the first versions of the C50 went EoL in 2018 and 2019. The last versions went EoL in 2022.
Interesting part: On August 6, 2025, I found the Archer C50 sold, by third parties, at both Amazon and Walmart (in the US). I also found it recommended by Which? in an article dated July 31, 2025. In the section on the Archer C50 it said "Security concerns None" Which? is based in the UK and they claim to be "... the UK’s consumer champion. We’re not here to make a profit - we're a powerful force for good, here to protect people ..." Oh really? I tried to tell them about this, but there is no easy way to offer feedback on the article.
Which Vendors To Trust
Spikes in malicious activity precede new security flaws in 80 percent of cases
by Bill Toulas of Bleeping Computer July 31, 2025
No article about this new research considers the issue of who to trust. But I do. The focus is on the fact that bad guys abuse bugs well before the existence of the bugs is made public. Quoting: "Researchers have found that in roughly 80 percent of cases, spikes in malicious activity like network reconnaissance, targeted scanning, and brute-forcing attempts targeting edge networking devices are a precursor to the disclosure of new security vulnerabilities (CVEs) within six weeks. This has been discovered by threat monitoring firm GreyNoise, which reports these occurrences are not random, but are rather characterized by repeatable and statistically significant patterns." Yawn. The hardware vendors that GreyNoise researched were: Ivanti, SonicWall, Palo Alto Networks, Fortinet, Juniper, MikroTik, Citrix, and Cisco. The article says "State-sponsored actors have repeatedly targeted such systems for initial access and persistence. " So, yes, bad guys abuse bugs in these edge networking devices. So . . . don't use them. Note that Peplink is not in this list. Neither is pfSense.
MAY 2025
Asus routers hacked yet again
Thousands of Asus routers are being hit with stealthy, persistent backdoors
by Dan Goodin of Ars Technica May 28, 2025
Good news: all the known bugs have been patched, if your Asus router is up to date. Bad news: "The attackers are backdooring the devices by exploiting multiple vulnerabilities." In other words, the routers have so many bugs the bad guys can combine them to make a sandwich. After the routers are hacked, rebooting does not clear things out, neither does installing new firmware remove the hack. Some of the bugs never got a CVE number, probably because Asus wants to hide their bugs. The bad guys re-configure the router to let them get into it via SSH, as an Admin, at any time. Is your Asus router hacked? Check the SSH settings. A hacked router will show that SSH is enabled on port 53282.
FBI warning on router hacks
Cyber Criminal Proxy Services Exploiting End of Life Routers
by FBI May 7, 2025
TLDR: Buggy routers being exploited by bad guys. Quoting: "Recently, some routers at end of life, with remote administration turned on, were identified as compromised by a new variant of TheMoon malware. This malware allows cyber actors to install proxies on unsuspecting victim routers and conduct cyber crimes anonymously.
A proxy server is ... an intermediary between end-users and the web pages they visit online. A proxy is a service that relays users' Internet traffic while hiding the link between users and their activity. Cyber actors use proxy services to hide their identities and location. When actors use a proxy service to visit a website to conduct criminal activity, like stealing cryptocurrency or contracting illegal services, the website does not register their real IP address and instead registers the proxy IP."
It is interesting that the FBI fails to mention the old buggy routers that are being attacked. Alert Number: I-050725-PSA
APRIL 2025
Another TP-Link investigation
TP-Link’s low router prices probed in criminal antitrust investigation
by Jon Brodkin of Ars Technica April 25, 2025
A few months ago, TP-Link was being investigated for security issues. Now, TP-Link is facing a criminal antitrust investigation. The issue is whether the company engaged in predatory pricing, that is, selling goods below cost to gain market share. The original reporting is from Bloomberg, but it is behind a paywall.
MARCH 2025
DrayTek Again
DrayTek routers worldwide go into reboot loops over weekend
by Sergiu Gatlan of Bleeping Computer March 24, 2025
When I saw the headline, I checked the DrayTek website and there was nothing about this. Turns out, after reading the article that they did issue a note about the problem but its in the FAQ section. Not the Tech Support section. Not on the home page. Not on the page with security bug fixes. Nope, the FAQ page. Not good. It is not known what bug is being attacked, I guess there are too many to choose from. The company claims the latest firmware fixes things. Of course, you may have to go somewhere else to download the firmware if your router is acting up.
Zyxel routers hacked
Chinese Weaver Ant hackers spied on telco network for 4 years
by Bill Toulas of Bleeping Computer March 24, 2025
Chinese bad guys spent more than four years in the network of a a major Asian telecommunications provider, hiding traffic and infrastructure with the help of compromised Zyxel routers. A report from Sygnia said the bad guys resisted multiple attempts to remove them.
FEBRUARY 2025
About TP-Link Routers
The US Is Considering a TP-Link Router Ban - Should You Worry?
by Simon Hill of Wired February 21, 2025
According to an expert from Malware Bytes: "TP-Link does not have a great reputation for patching vulnerabilities or working with security researchers..."
Sadly, both the author and this expert on focused solely on home routers. The article ignores ISP provided routers and the step up to a more professional product. The expert said: "...regardless of the home router vendor, there will always be vulnerabilities found" Again, "home router vendor". The reporter, Mr. Hill adds "There’s no easy fix because all the major router manufacturers have issues with vulnerabilities". Peplink routers are not focused on home use and the company is not a major vendor. But, their record in security is excellent. I would tell Mr. Hill this, but there is no way to contact him. Perhaps the best thing in the article is that it mentions the inherent insecurity of being forced to have a vendor account to use a router. Of course, then Hill recommends Firewalla which ... requires you to have an account with them. Sigh. Finally, Wired profits by recommending TP-Link routers (among others). I do not.
A Trio of Shit
Risky Bulletin:
Sandworm deploys Tor nodes on hacked networks
by Catalin Cimpanu for Risky Business February 17, 2025
How else to put it? Concurrent critical bugs from Fortinet, Palo Alto Networks, SonicWall and Juniper. Below is an exact quote from this edition of the Risky Business Newsletter:
"Fortinet zero-day: Fortinet says hackers are exploiting a second zero-day in the websocket module of FortiOS to hijack its firewalls and networking gear. This is the second zero-day in this module after CVE-2024-55591, patched last month. This one has a CVE of CVE-2025-24472.
PAN auth bypass under attack: Threat actors are actively exploiting a new vulnerability in Palo Alto Networks firewalls. The attacks began a day after security firm Assetnote published a write-up on the bug and a day after Palo Alto released patches. Tracked as CVE-2025-0108, the bug is an Nginx/Apache path confusion vulnerability that can lead to an authentication bypass in the affected firewalls.
SonicWall devices under attack: The same thing also happened with a SonicWall vulnerability (CVE-2024-53704) from January that came under attack a day after security firm BishopFox published a write-up and PoC this week."
See the original newsletter web page for links in each story. And ... earlier in the very same issue, was this tidbit:
Brute-force campaign: The Shadowserver Foundation has spotted a massive brute-forcing campaign targeting Palo Alto Networks, Ivanti, and SonicWall network devices.
Then, the very next day, I ran across this: Juniper Session Smart Routers Vulnerability Could Let Attackers Bypass Authentication by Ravie Lakshmanan for Hacker News (Feb 18, 2025). There is a critical security flaw impacting Session Smart Router, Session Smart Conductor, and WAN Assurance Router products that could be exploited to hijack control of buggy devices. Patches are available. Interestingly, the bug was found by Juniper itself which is quite rare.
Hacked routers used to find other hackable routers
Massive brute force attack uses 2.8 million IPs to target VPN devices
by Bill Toulas of Bleemping Computer February 8, 2025
Quoting: "A large-scale brute force password attack using almost 2.8 million IP addresses is underway, attempting to guess the credentials for a wide range of networking devices, including those from Palo Alto Networks, Ivanti, and SonicWall ... According to the threat monitoring platform The Shadowserver Foundation, a brute force attack has been ongoing since last month ... The devices conducting these attacks are mostly MikroTik, Huawei, Cisco, Boa, and ZTE routers and IoTs, which are commonly compromised by large malware botnets." Putting a device online with a default password is like drunk driving.
JANUARY 2025
If you don't have someone to do the necessary care and feeding of a device, don't buy it
Hackers Actively Exploiting Fortinet Firewalls: Real-Time Insights from GreyNoise
by Noah Stone of GreyNoise January 28, 2025
CVE-2022-40684 is an authentication bypass vulnerability disclosed in late 2022. Patches have been available since October 2022. Yet, thousands of Fortinet firewalls remain exposed and vulnerable. GreyNoise reveals how attackers are leveraging the buggy devices in real time. This activity is not new. GreyNoise has observed compromised Fortinet devices exhibiting harmful behaviors over several years.
Hack Everything
The
Internet is (once again) awash with IoT botnets delivering record DDoSes
by Dan Goodin of Ars Technica January 22, 2025
Quoting: "We’re only three weeks into 2025, and it's already shaping up to be the year of Internet of Things-driven DDoSes. Reports are rolling in of threat actors infecting thousands of home and office routers, web cameras, and other Internet-connected devices." Examples:
DECEMBER 2024
TP-Link may get banned in the US
U.S. Weighs Ban on Chinese-Made Router in Millions of American Homes
by Heather Somerville, Dustin Volz and Aruna Viswanatha for the Wall Street Journal December 18, 2024
This is the original article with original reporting. But, it is behind a paywall so see the other articles below. In brief, TP-Link is Chinese and bugs/flaws (backdoors?) in their routers have been abused by many bad guys. As a result, three branches of the US government are investigating TP-Link: Commerce, Defense and the Justice department.
As to security the article says: "TP-Link routers are routinely shipped to customers with security flaws, which the company often fails to address, according to people familiar with the matter. While routers often have bugs, regardless of their manufacturer, TP-Link doesn't engage with security researchers concerned about them, the people said.&uqot; It also says that over 300 ISPs in the US give their customers TP-Link devices. On the government side, TP-Link is used by NASA, the Defense Department and the DEA.
Taiwan and India are also skeptical about TP-Link router security. The article says TP-Link has roughly 65 percent of the U.S. market for routers for homes and small businesses, but there is no source for this information. I live in a very crowded Wi-Fi area and there are mostly ISP routers around me; very few consumer routers. You can get a feel for the security of TP-Link routers by reviewing the News and Bugs pages on this very website :-)
What will come of this? Whether TP-Link is banned, as was Kaspersky, or not, will make little difference. A meaningful increase in router security requires routers to self-update with bug fixes and for there to be a software expiration date on routers; just like milk. Politicians will look good and make speeches for sure but nothing important is likely to result.
Juniper ships with a default password
2024-12 Reference Advisory: Session Smart Router: Mirai malware found on systems when the default password remains unchanged
by Juniper December 17, 2024
Article IDJSA92451. I don't know exactly what the Juniper Session Smart Router (SSR) or Session Smart Network (SSN) platforms are. But, they clearly ship with default passwords and users are NOT forced to change the default password. This is a miserably lazy, insecure way of doing things. Even some consumer routers force the user to change the out-of-the-box password. Quoting: "These systems have been infected with the Mirai malware and were subsequently used as a DDOS attack source to other devices accessible by their network. The impacted systems were all using default passwords." The infections were so bad, the recommended action is to wipe the whole system and start from scratch.
NOVEMBER 2024
New Router Attack - Nearest Neighbor
Russian spies may have moved in next door to target your
network
by Brandon Vigliarolo of The Register November 25, 2024
No router bugs were used or abused in this attack. A Wi-Fi network across the street from the ultimate victim was used to login to the Wi-Fi network of the victim company. This was directed by Russian bad guys who were thousands of miles away. The Russians were so persistent, the hacked two different companies near the ultimate victim. After being blocked initially, they got in through the Guest network of the victim, then from there into their internal what-should-have-been secure network. The Russians found a device that could access both the Guest Wi-Fi and the internal-only Wi-Fi networks. The ultimate victim used Windows everywhere, which has to have played a part in all this. The internal Wi-Fi network was logged into using Windows domain credentials. The whole thing started with bad passwords, the Russians used brute force password guessing on a public service provided by the ultimate victim. That's how they got the passwords for the ultimate victim company. Never re-use passwords. Never.
Old routers continue to be hacked by the Chinese
Volt
Typhoon rebuilds malware botnet following FBI disruption
by Bill Toulas of Bleeping Computer November 12, 2024
Quoting: "
The Chinese state-sponsored hacking group Volt Typhoon has begun to rebuild its "KV-Botnet" malware botnet after it was disrupted by law
enforcement in January ... Volt Typhoon ... is believed to have infiltrated critical U.S. infrastructure, among other networks worldwide ...
Their primary strategy involves hacking SOHO routers and networking devices, such as Netgear ProSAFE firewalls, Cisco RV320s, DrayTek Vigor
routers, and Axis IP cameras, to install custom malware that establishes covert communication and proxy channels and maintain persistent access
to targeted networks ... According to a report by SecurityScorecard, Volt Typhoon has started to rebuild its botnet by targeting outdated Cisco and Netgear routers and has
compromised a significant number of devices in just over a month ... The KV-Botnet ... attempts to mainly compromise Cisco RV320/325 and Netgear ProSafe series devices. ....
The main operation of the KV-Botnet appears to be obfuscating malicious activities by routing traffic through the compromised legitimate infrastructure."
The hacked devices no longer get bug fixes (EoL or End of Life is the official nerd term for this) leaving them permanently vulnerable. It is not know which bug or bugs is being exploited to hack the routers.
OCTOBER 2024
Bugs in Network Security Hardware
Inside a Firewall Vendor's 5-Year War With the Chinese Hackers Hijacking Its Devices
by Andy Greenberg of Wired October 31, 2024
TLDR: things are bad. Quoting:
"For years, it's been an inconvenient truth within the cybersecurity industry that the network security devices sold to protect customers from spies and cybercriminals are, themselves, often the machines those intruders hack to gain access to their targets. Again and again, vulnerabilities in 'perimeter' devices like firewalls and VPN appliances have become footholds for sophisticated hackers trying to break into the very systems those appliances were designed to safeguard."
Sophos just issued a report on their battle with Chinese bad guys. Why?
"Sophos says it's telling that story now ... to break the cybersecurity industry's awkward silence around the larger issue of vulnerabilities in security appliances serving as entry points for hackers. In just the past year, for instance, flaws in security products from other vendors including Ivanti, Fortinet, Cisco, and Palo Alto have all been exploited in mass hacking or targeted intrusion campaigns. 'This is becoming a bit of an open secret. People understand this is happening, but unfortunately everyone is zip,' says Sophos chief information security officer Ross McKerchar ... Sophos' report also warns ... that in the most recent phase of its long-running conflict with the Chinese hackers, they appear more than ever before to have shifted from finding new vulnerabilities in firewalls to exploiting outdated, years-old installations of its products that are no longer receiving updates."
Hacked Consumer Routers abused by Chinese Bad Guys
Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network
by Microsoft Threat Intelligence October 31, 2024
Microsoft is their normal self here. To summarize: things are bad, use more of our software to make things good. As to details, since August 2023 they have observed a network of compromised small office and home office (SOHO) routers being used in password spraying attacks. The bad guys are Chinese and they are trying to gain initial access to enterprise networks. Routers made by TP-Link make up most of the network but Microsoft has no idea what bug(s) the bad guys are using to infect the routers. Microsoft calls the botnet network Quad7. The bad guys are know to target think tanks, government organizations, non-governmental organizations, law firms, defense industrial base, and others.
To stay under the radar, the bad guys don't use the whole botnet at any one time. Also, the bad guys only hit any one target with a fake login attempt once a day.
Multiple groups of bad guys are believed to be using the botnet. Microsoft offers no guidance at all for anyone with a TP-Link router.
AUGUST 2024
Never saw this coming: US Congress worried about Chinese routers
Moolenaar, Krishnamoorthi Call for Investigation into Chinese Wi-Fi Routers in U.S. Vulnerable to CCP Hacking & Data Harvesting
Press Release
from the US House of Representatives August 15, 2024
Simply put, which the US government does not do, some members of Congress think its a bad thing for us to be using Chinese routers.
This is from the US House Committee on CCP. They won't do anything, but they ask the Commerce Department to investigate TP-Link.
Why? Too many of their routers in the US creates a potential national security risk. Wow. Can't say that I disagree. Almost the same day we learned of a hardware back door in
key cards made by a Chinese company. The Committee is worried about bugs that might allow Chinese hackers to breach US infrastructure. US infrastructure being protected by
TP-Link routers seems a stretch, but again, they make a valid point. They are also worried about TP-Link being forced to hand over data on US citizens to the Chinese state.
Just recently CISA and assorted cybersecurity firms have noted that Chinese state-sponsored hackers are using botnets made of home routers to hide their operations against US and Western targets. They should write to Consumer Reports, The Wirecutter and every other outfit that reviews routers and tell them to stop recommending TP-Link routers.
Better yet, they should go after ISPs for the miserable security in the routers they provide. Will anything come of this? Probably not.
The Cisco corporate personality
Cisco warns of critical RCE zero-days in end of life IP phones
by Bill Toulas of Bleeping Security August 8, 2024
Yes, this article about IP telephones, but it is here because of the insight it offers into Cisco's corporate personality. Not good.
Cisco has disclosed five flaws, three critical and two high-severity in their SPA 300 and SPA 500 telephones. The bugs allow a remote bad guy without any passwords to execute arbitrary commands on the devices with root privileges, just by sending a specially crafted HTTP request to the buggy phone. Each of the 5 bugs impact all software releases for the SPA 300 and SPA 500 IP phones regardless of their configuration. Also, each bug is a free agent, so that each one can be exploited individually, there is no need to chain them. The two high-severity flaws are caused by inadequate checks on HTTP packets. In other words, lazy programmers.
Support ended for the SPA 300 phones in February 2022. Support for the SPA 500 phones ended in June 2020. But, it gets worse. Cisco is still covering the SPA 500 until May 31, 2025 for holders of service contracts or special warranty terms. Still, no bug fix for you. Bottom line: these phones need to thrown in the trash. And maybe don't replace them with another Cisco phone.
On another note, Cisco recently announced that they are laying off thousands of employees which make it likely that the security of their devices will not improve in the future.
JULY 2024
Linksys is sloppy with router passwords
These Linksys routers are likely transmitting cleartext passwords
by Daniel Sims of TechSpot July 12, 2024
Linksys Velop Pro 6E and 7 mesh routers transmit critical information to outside servers in an insecure manner upon initial installation. Worse than this has been the total silence from Linksys on the issue. The 9 millionth example of why you should not buy a consumer router.
Belgian consumer organization Testaankoop found that during initial setup, these routers transmit the SSID and password in cleartext to a server in the US. They also send user session access tokens and database identification tokens. The article suggests that owners of these routers should change their SSID and password without using the Linksys app. Quoting:
"More concerning is that Linksys hasn't publicly acknowledged the issue. Testaankoop reported the vulnerability to the company in Belgium and the UK last November with no response. The firmware released after the initial discovery hadn't fixed the problem, and Linksys hasn't contacted Testaankoop since its latest report."
Also typical of consumer routers is that the issue of other Linksys routers possibly doing the same thing never comes up. We see this over and over - one model gets tested, gets publicity, gets fixed and the other 99 similar models are ignored.
MAY 2024
Someone hates Windstream
Mystery malware destroys 600,000 routers from a single ISP during 72-hour span
by Dan Goodin of Ars Technica May 30, 2024
Windstream is an ISP with about 1.6 million subscribers in 18 states. Someone does not like them. In October 2023, over 600,000 routers that Windstream provided to its customers were bricked (made into paperweights). More specifically, about 179,000 ActionTec T3200 routers and more than 480,000 Sagemcom routers were permanently rendered useless and had to be replaced. As for their part, Windstream has said nothing. When contact by Ars Technica, they declined to answer any questions. It is not known how the bad guys got into the routers, but it is likely they abused weak credentials or an administrative system of the ISP.
As stated elsewhere on this site, a router from your ISP is the worst option. This is just further proof.
Wi-Fi gives away your location
Why Your Wi-Fi Router Doubles as an Apple AirTag
by Brian Krebs of Krebs on Security May 21, 2024
Interesting article about how both iOS and Android use nearby Wi-Fi networks to compute the location of the mobile device. Basically, Apple and Google know where ever router is located. Apple very recently introduced a fix. If the Wi-Fi network name ends with "_nomap" they will no longer report its location to Big Brother. Too little, too late. Krebs does not seem to know that Google has done this for years. This research brings to mind the claims of VPN providers to hide your location. These claims only apply to Ethernet connected devices.
Still another reason to avoid Cisco hardware
Counterfeit Cisco gear ended up in US military bases, used in combat operations
by Scharon Harding of Ars Technica May 3, 2024
A bad guy has been selling fake Cisco hardware for many years. The interesting question for me, is how much of this is Cisco's fault.
The bad guy lives in Florida and he has finally been sentenced to prison for his very long-lived scam operation. The scam imported the fake hardware from China and Hong Kong and used fake Cisco packaging, labels, and documents. The bad guy used at least 19 companies, multiple Amazon storefronts, multiple eBay storefronts and direct sales - known collectively as Pro Network Entities. Exactly what a Pro Network thingy is, I don't know. Not said by the DOJ, which touted the arrest and sentencing, was how the US Government purchased the fake hardware. Could they have been stupid enough to buy it off Amazon and eBay? Since the DOJ said nothing, the Department of Defense probably was that stupid.
But another option was that the fake hardware was purchased through an authentic Cisco channel partner. How can that be? The article says that legit Cisco partners would often get their alloted stuff " outside of Cisco-authorized means because it was faster." So yes, Cisco is at fault too. You might think that Cisco would stop dealing with partners that purchased gray market stuff. But, no. Don't underestimate the rot at Cisco. A partner had to be caught doing this twice before they would get booted. Another bad look for Cisco is that the fake hardware had fake serial numbers. This should not have been allowed to happen. The fake serial numbers should have been detected. Cisco bears much of the fault.
APRIL 2024
Cisco is being hacked, yet again
ArcaneDoor Cyberspies Hacked Cisco Firewalls to Access Government Networks
by Andy Greenberg of Wired April 24, 2024
Quoting: "Network security appliances like firewalls are meant to keep hackers out. Instead, digital intruders are increasingly targeting them as the weak link that lets them pillage the very systems those devices are meant to protect ... Cisco is now revealing that its firewalls served as beachheads for sophisticated hackers penetrating multiple government networks around the world." The buggy devices are Adaptive Security Appliances, which include a firewall, a VPN and other security(?) features. Cisco claims the bad guys are state sponsored. They exploited two new bugs (zero-day vulnerabilities in the lingo of the day). Really, you could not pay me to use any Cisco hardware.
TP-Link Routers being hacked
Multiple botnets exploiting one-year-old TP-Link flaw to hack routers
by By Bill Toulas of Bleeping Computer April 17, 2024
At least six malware botnets are hunting for buggy TP-Link Archer AX21 (AX1800) routers. The bug that is being exploited was reported to TP-Link in January 2023
and fixed in March 2023. Yet, a year later, many of the vulnerable routers have not been updated. Clearly updating firmware on TP-Link routers is too hard for many
people that own them. To me, THE BIG ISSUE HERE is not the AX1800 model but the 38 other routers that TP-Link sells. Are any of them also buggy? The article says
nothing about this. TP-Link also says nothing about this. This is reason enough to avoid TP-Link devices.
MARCH 2024
Old Asus routers hacked
TheMoon malware infects 6,000 ASUS routers in 72 hours for proxy service
by Bill Toulas of Bleeping Computer March 26, 2024
Quoting: "A new variant of TheMoon malware botnet has been spotted infecting thousands of outdated ... routers and IoT devices ... TheMoon is linked
to the Faceless proxy service, which uses some of the infected devices as proxies to route traffic for cybercriminals who wish to anonymize their malicious
activities ... Black Lotus Labs researchers ... have observed 6,000 ASUS routers being targeted in under 72 hours ... The researchers do not specify the exact method
used to breach the ASUS routers, but given that the targeted device models are end-of-life, it is likely that the attackers leveraged known vulnerabilities in the firmware."
We have seen this many times before, bad guys do bad things online, but make it appear as if their bad things came from your router.
Thinktank says Router Security is important
Hudson Institute Chinese Wireless Routers: The Next Entry Point for State-Sponsored Hackers?
by Michael O'Rielly of The Hudson Institute March 6, 2024
Quoting: "Routers are vital to the overall chain of internet security ... Bad actors can misuse wireless routers to infect millions of home networks to obtain consumer information and documents, proliferate misinformation, disrupt functionality, or cause other harm ... Policymakers need to examine whether wireless routers could be China-sponsored hackers' next entry point into US networks ... in February the US Department of Justice revealed the results of an investigation uncovering more threats from China. It found that China-sponsored hackers used trojan horse malware to infect older-model home routers and attack numerous critical layers of American infrastructure, including electrical grids and water supplies .... although TP-Link is a private firm, unlike Huawei and ZTE, murky Chinese investment structures mean that the firm warrants further inquiry ... US cybersecurity authorities and analysts have documented vulnerabilities from home equipment vendors across the board. But TP-Link products have had more than their fair share of citations ..." In December 2024 we learned that three different departments of the US Government were investigating the security of TP-Link routers.
FEBRUARY 2024
Quite a month for hacking routers
Hackers
backed by Russia and China are infecting SOHO routers like yours, FBI warns
by Dan Goodin of Ars Technica February 27,
2024
The article provides some context: "Nation-state-backed groups have used routers to obfuscate attacks since at least 2018, when researchers from Cisco’s Talos security group detected more than 500,000 SOHO routers that had also been compromised ... [to] install sophisticated malware Talos dubbed VPNFilter to carry out a range of activities. Hundreds of router models from nearly a dozen manufacturers were affected..." Russians have been using infected routers since at least 2022 to facilitate covert operations against governments, militaries, and organizations around the world, including in the Czech Republic, Italy, Lithuania, Jordan, Montenegro, Poland, Slovakia, Turkey, Ukraine, the United Arab Emirates, and the US. Besides government bodies, industries targeted include aerospace and defense, education, energy and utilities, hospitality, manufacturing, oil and gas, retail, technology, and transportation. Ubiquiti EdgeRouters make an ideal hideout for hackers. They are cheap and run Linux that can run hidden behind-the-scemes malware. Bad guys use hacked routers to do bad stuff because their activity seems to come from benign-appearing devices hosted by addresses with trustworthy reputations. Earlier this month, the FBI revealed that it had removed Russian malware from routers but they only temporarily blocked the Russians. The FBI did not patch any bugs in the routers or remove default passwords.
The Russians will try again to hack Ubiquiti Edge Routers
That home router botnet the Feds took down? Moscow's probably going to try again
by Simon Sharwood of The Register February 28, 2024
The FBI issued a somewhat useless advisory on behalf of the US, Belgium, Brazil, France, Germany, Latvia, Lithuania, Norway, Poland, South Korea, and the UK. It was a warning that Russia may try again to hack Ubiquiti EdgeRouters and owners of these things better patch and re-configure. The cheapie boxes can not self update and they all ship with the same default password, which is disgraceful. A reader comment noted that when Ubiquiti did try to force people to invent their own passwords they made two mistakes in their implementation. Disgraceful again. All the advice from the FBI is for nerds and some of it is vague. Non techies should buy new routers. The original Ubiquiti router hacks were by Russia's GRU military intelligence unit. They build a 1,000-strong botnet and used it for power phishing, spying, credential harvesting, and data theft.
FBI boots Russian hackers out of Ubiquiti routers
Feds dismantle Russian GRU botnet built on 1,000-plus home, small biz routers
by Jessica Lyons of The Register February 15, 2024
The US government today said it disrupted a botnet that Russia's GRU military intelligence unit used for phishing expeditions, spying, credential harvesting, and data theft against American and foreign governments and other strategic targets. The botnet was "well over a thousand" baby routers that had been infected with malware. The hacked routers were all from Ubiquiti running their Edge OS. Any child could have hacked these routers as they were using publicly known default passwords. Drunk driving. The Russians targeted US and foreign governments and military, security, and corporate organizations. The FBI removed the malware and modified the routers' firewall rules to block remote management of the routers.
JANUARY 2024
This was big
FBI disrupts Chinese botnet by wiping malware from infected routers
by Sergiu Gatlan of Bleeping Computer January 31, 2024
This was covered everywhere. In brief:
--Chinese bad guys hack shitty home routers, typically those where the software is no longer updated. Newly found bugs in the abandoned router software makes these routers sitting ducks. They use these as the launching point for attacking critical US infrastructure. Since the attacks and/or scans seem to come from innocent locations, they don't raise as many red flags. The FBI was allowed to hack the hacked routers to remove the malware.
--What is not said is that US ISPs must be forced to provide security updates to any and all routers they provide to their customers. As things stand in the US, most ISPs are monopolies (in practice) so they can get away with providing the cheapest routers. In addition, private companies (Cisco, Netgear for example) must be forced to do something when they stop providing updates to their installed routers. And some minimum levels of security need to be enforced. But, due to the failed nature of the US Congress, no relevant law will ever happen, so the US will forever be vulnerable. That is the real news. One instance of malware on some routers is a grain of sand on the beach.
--Details about this grain:
The FBI has disrupted the KV Botnet used by Chinese Volt Typhoon state hackers. Hacked routers included Netgear ProSAFE, Cisco RV320s, and DrayTek Vigor routers, as well as Axis IP cameras. The Chinese hacked roughly 30% of all Cisco RV320/325 devices in a month. The FBI director said the Chinese used the hacked routers to hit communications, energy, transport and water sectors. He also said that U.S. cyberdefense is badly outnumbered. Others reported this was part of a larger effort to compromise critical infrastructure, including naval ports, ISPs and utilities. In a useless statement, CISA and the FBI asked router vendors to please have their devices self-update and to only allow access to the web interface from the LAN by default. Oh, and make better software. Ha ha. Yes, they really said this. On a technical level, the FBI action was temporary, when the infected routers reboot, they will again be infected. No article discussed how a router owner can tell if their router is infected. And, not one of the articles listed below mentioned this website.
OCTOBER 2023
If you don't patch your router firmware, bad guys are coming for you
IZ1H9 Campaign Enhances Its Arsenal with Scores of Exploits
by Cara Lin of Fortinet October 9, 2023
Discovered by FortiGuard Labs, a Mirai variant they call IZ1H9, infects Linux-based networked devices turning them into remote-controlled bots for large-scale network attacks. Included in the targets of the malware are D-Link and Zyxel gear which remain vulnerable despite the availability of patches for the bugs being exploited. The malware has added new targets; Netis wireless routers, TP-Link Artcher, Totolink routers and others. The D-Link bugs being targeted for exploitation are CVE-2015-1187, CVE-2016-20017, CVE-2020-25506, and CVE-2021-45382. The TP-Link Archer AX21 bug being exploited is
CVE-2023-1389. There is also a large range of related vulnerabilities that focus on TOTOLINK routers.
D-Link employee falls for scam
D-Link clears up 'exaggerations' around data breach
by
Connor Jones of The Register October 18, 2023
On October 1, a post on a hacking forum claimed to be selling 3 million lines of customer information. D-Link's public disclosure confirmed it became aware of the incident on October 2 and with the help of external investigators the company determined the actual number of stolen records to be around 700. D-Link says the data was not stolen from the cloud but instead originated from a test lab environment via a phishing attack on an employee. The stolen data was used for registration purposes. Assuming the best, assuming everything D-Link says is true, it still means that a D-Link employee fell for a scam. Makes me wonder about their employees competence.
SEPTEMBER 2023
Chinese hackers target Cisco
People's Republic of China-Linked Cyber Actors Hide in Router Firmware
by the CISA department of the US government September 27, 2023
A hacking group that CISA calls BlackTech has been modifying router firmware without detection and then exploiting the domain-trust relationships in the victim router to pivot from international subsidiaries to the headquarters of companies in Japan and the U.S. Targeted organizations include government, industrial, technology, media, electronics, telecommunication, and defense. The article makes it sound like the hacking comes from the LAN side and on the Security Checklist page on this site are a number of ways to lock down access to the router from the LAN side. The bad guys know so much about Cisco routers that they can conceal configuration changes, hide commands, and disable logging while doing their dirty work.
JULY 2023
Zyxel devices are not being patched, so they are being hacked left and right
Zyxel users still getting hacked by DDoS botnet emerge as public nuisance No. 1
by Dan Gooding of Ars Technica July 21, 2023
Zyxel patched a bug on April 25th. But ... devices are still being hacked because network nerds are not installing the patch. The bug was rated 9.8 which translates to really bad. So many Zyxel devices are being hacked and used by bad guys that this bug is now considered public nuisance No. 1.
Botnet discovered consisting of thousands of infected routers
Routers from the Underground: Exposing AVrecon
by Danny Adamitis and Steve Rudd of Black Lotus Labs July 12, 2023
Black Lotus Labs (a division of Lumen) discovered a large botnet targeting small-office/home-office routers. Which routers are being infected? They do not say. They claim this is a multi-year campaign involving compromised routers across the globe. The botnet deploys a Linux-based Remote Access Trojan (RAT) they call "AVrecon."
The malware has been operating undetected for more than two years in part because owners of infected devices are not likely to notice a service disruption or a loss of bandwidth.
They suspect that the botnet network exists to enable a range of criminal activities from password spraying to digital advertising fraud. By one measure, there are 70,000 infected machines. Looking at persistent infections, they found the malware at more than 40,000 IP addresses in more than 20 countries. While they don't say anything about which routers are infected, they have taken network level defenses: null-routing the command and control nodes and impeding traffic through the proxy servers. This renders the botnet inert across the Lumen backbone. What it does for the rest of the world, they do not say. They say the malware uses port 48102, but they not say if its TCP or UDP. And, they do not say if finding the port open is a reliable way to detect an infected device. So, this blog is perhaps more press release than useful information.
JUNE 2023
Now everyone sees the need for better router security
CISA Order Highlights Persistent Risk at Network Edge
by Brian Krebs of Krebs on Security June 15, 2023
Quoting: "The U.S. government agency in charge of improving the nation’s cybersecurity posture is ordering all federal agencies to take new measures to restrict access to Internet-exposed networking equipment ... The order requires federal departments to limit access so that only authorized users on an agency's local or internal network can reach the management interfaces of these devices." Translation: better router security. This mandate follows a slew of high profile security bugs from Barracuda Networks, Fortinet (which makes Fortiguard products) and file transfer appliances from Forta (GoAnywhere) and Progress Software (MOVEit Transfer).
A black eye for Barracuda
CVE-2023-2868: Total Compromise of Physical Barracuda ESG Appliances
by Caitlin Condon of Rapid7 June 8, 2023
This is stunning. Background: The Email Security Gateway (ESG) from Barracuda Networks is software for filtering inbound and outbound email and (hopefully) protecting customer data.
The Email Security Gateway can exist as a physical or virtual appliance, or in a public cloud on AWS or Azure. The hack described below (May 2023) turns out to be hard or impossible to mitigate with a patch. Thus, Barracuda is urging their ESG customers to immediately decommission and replace all ESG physical appliances irrespective of their patch level. Shocking. Quoting: "The pivot from patch to total replacement of affected devices is fairly stunning and implies the malware the threat actors deployed somehow achieves persistence at a low enough level that even wiping the device wouldn’t eradicate attacker access." As bad as this looks, Barracuda handled it better than HP handled the printers they broke with a firmware update. HP just put its head in the sand. Barracuda did not. Still, customers paid for security with ESG and got hacked instead.
MAY 2023
What does 'security' really mean?
Critical Barracuda 0-day was used to backdoor networks for 8 months
by Dan Goodin of Ars Technica May 30, 2023
This story does not involve a router, but it did let bad guys steal data via the network. Barracuda Networks is an IT security company. The bug was in their Barracuda Email Security Gateway and was due to incomplete input validation of user-supplied .tar files. In other words, lazy programming. The bug let bad guys install multiple pieces of malware for stealing sensitive data. A patch has been issued. In this case, having the Email Security Gateway installed, made you less secure.
Note: See above for an update on this.
Hack the routers, Hack the world
Chinese hackers breach US critical infrastructure in stealthy attacks
by Sergiu Gatlan of Bleeping Computer May 24, 2023
Lots of router hacks in this story. Quoting: "Microsoft says a Chinese cyberespionage group it tracks as Volt Typhoon has been targeting critical
infrastructure organizations across the United States ... since at least mid-2021. Their targets and breached entities span a wide range of critical sectors,
including government, maritime, communications, manufacturing, information technology, utilities, transportation, construction, and education."
The attacks start by hacking Fortinet FortiGuard devices, exploiting an unknown zero-day vulnerability.
The hacked Fortinet devices give the bad guys Windows credentials through LSASS. This, in turn, lets the bad guys deploy web shells for stealing
data and keeping a persistent presence on the hacked systems. And then, "To ensure that their malicious activity blends with legitimate network traffic to evade detection, Volt Typhoon employs compromised small office and home office (SOHO) network equipment from ASUS, Cisco, D-Link, Netgear, FatPipe, and Zyxel, such as routers, firewalls, and VPN appliances." So, there we have it. Shitty consumer routers are helping the Chinese hack critical US infrastructure. Ouch.
F--k Asus
Asus router outage is solved
by Dan Goodin of Ars Technica May 19, 2023
Quoting: "Asus router users around the world took to the Internet to report that their devices suddenly froze up for no apparent reason and then, upon rebooting repeatedly, stopped working every few minutes as device memory became exhausted. Two days later, the Taiwan-based hardware maker has finally answered the calls for help. The mass outage, the company said, was the result of 'an error in the configuration of our server settings file.'"
Let me translate: Exactly how they screwed up is none of your business. Quoting again: "After fixing the glitch, most users needed to only reboot their devices. In the event that didn't fix the problem, the company’s support team advised users to save their current configuration settings and perform a factory reset ... Asus still hasn’t provided details about the configuration error." So much went wrong here. (1) Why are Asus routers dependent on the configuration of an Asus server? (2) How did the problem happen? (3) Why did they not find the problem sooner? (4) What will they do so this does not happen again? (5) What exactly is the problem? (6) Which models are affected? Which feature(s) are causing the problems? Which firmware versions are susceptible to the bug? etc. etc. (7) the two day delay in saying anything and the corporate double-speak is insulting.
On the upside, anyone shopping for a router in the future now has a good feeling for just who and what Asus is, as a company.
More hacked routers
Check Point Research reveals a malicious firmware implant for TP-Link routers, linked to Chinese APT group
by Check Point Research May 16, 2023
Check Point Research found a malicious firmware implant in TP-Link routers which allowed the bad guys to get full control of infected devices and access compromised networks while evading detection. They attribute the hack to a Chinese state-sponsored APT group. How the routers got hacked is uncertain. They say it is likely that the bad guys either scanned looking for known vulnerabilities or targeted devices that used default or weak or easily guessable passwords. The malware is not specific to TP-Link routers, so that a wide range of devices and vendors may be at risk. As to the issue of why, they say: "Learning from history, router implants are often installed on arbitrary devices with no particular interest, with the aim to create a chain of nodes between the main infections and real command and control. In other words, infecting a home router does not mean that the homeowner was specifically targeted, but rather that they are only a means to a goal."
Yet again, a high end router (Fortinet) is vulnerable to attack
New Cactus ransomware encrypts itself to evade antivirus
by Ionut Ilascu of Bleeping Computer May 7, 2023
Most of the article is focused on the Windows-based malware. But, it does include this: A new ransomware operation called Cactus has been exploiting vulnerabilities in VPN appliances for initial access to networks of 'large commercial entities.' Kroll believes that Cactus obtains initial access into the victim network by exploiting known vulnerabilities in Fortinet VPN appliances. It is not known which Fortinet bug the bad guys are exploiting. Perhaps new, perhaps old.
APRIL 2023
Yet another LAN-only protocol being abused on the Internet
SLP: a new DDoS amplification vector in the wild
by Alex Forster
and Omer Yoachimik of Cloudflare April 25, 2023
Quoting: "Service Location Protocol (SLP) is a "service discovery" protocol invented by Sun Microsystems in 1997. Like other service discovery protocols, it was designed to allow devices in a local area network to interact without prior knowledge of each other. SLP is a relatively obsolete protocol and has mostly been supplanted by more modern alternatives like UPnP, mDNS/Zeroconf, and WS-Discovery. Nevertheless, many commercial products still offer support for SLP."
Just-published research by Pedro Umbelino at Bitsight and Marco Lux at Curesec documents a new DDoS reflection/amplification attack vector leveraging SLP. The bug is tracked as
CVE-2023-29552. Since SLP has no method for authentication, it should never be exposed on the Internet. However, they discovered that upwards of 35,000 on-line devices have their SLP service exposed and accessible to anyone. Devices that speak SLP have two open ports: UPD port 427 and TCP port 427.
Cisco routers are being hacked by Russians abusing a bug fixed in 2017
US, UK warn of govt hackers using custom malware on Cisco routers
by Lawrence Abrams of Bleeping Computer April 18, 2023
Russian hackers are targeting malware against Cisco IOS routers that are still being used despite their owner having walked away from them. The Russians are exploiting an SNMP flaw (CVE-2017-6742) that was patched in June 2017. This from a joint report from the UK National Cyber Security Centre (NCSC), US Cybersecurity and Infrastructure Security Agency (CISA), the NSA, and the FBI. SNMP is a protocol that lets network administrators monitor and configure network devices remotely. Not only are the hacked routers not being patched, but the flaw also requires poor configuration of SNMP itself. Makes me ashamed to be a computer nerd.
Used Enterprise Routers give away the keys to the Kingdom
Used Routers Often Come Loaded With Corporate Secrets
by Lily Hay Newman for Wired April 18, 2023
Researchers from the security firm ESET bought 18 used routers made by Cisco, Fortinet, and Juniper Networks. They found nine were just as their previous owners had left them and fully accessible. Only five had been properly wiped. All nine of the unprotected routers contained credentials for the organization's VPN, credentials for another secure network communication service, or hashed root administrator passwords. All nine included enough identifying data to determine the previous owner. Eight of the nine included router-to-router authentication keys and information about how the router connected to specific applications used by the previous owner. Four devices exposed credentials for connecting to the networks of other organizations.
Other security companies have repeatedly seen the same thing. Red Balloon Security was specifically mentioned in the article. A shit show. ESET tried to contact all the vulnerable organizations and some would not give them the time of day. There is said to be a resale market with millions of enterprise level networking devices. ESET will present a report on this at the RSA security conference in San Francisco next week.
How does this happen? Do networking techies not know how to reset the devices and they can't be bothered to look it up? Are they over-worked and too busy to spend the time resetting devices? Are they angry at their bosses and this is retribution? Or, has the job been farmed out to a third party that is supposed to reset the routers?
Wi-Fi Design Flaw
Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues
by
Domien Schepers, Aanjhan Ranganathan and Mathy Vanhoef from assorted universities April 2023
The link is to PDF of a research report. The flaws described here are not in any one router or firmware, rather they are the result of omissions from the design specs for Wi-Fi itself.
How serious this is is beyond my ability to judge. Quoting:
"Wi-Fi devices routinely queue frames at various layers of the network stack before transmitting, for instance, when the receiver is in sleep mode. In this work, we investigate how Wi-Fi access points manage the security context of queued frames. By exploiting power-save features, we show how to trick access points into leaking frames in plaintext, or encrypted using the group or an all-zero key. We demonstrate resulting attacks against several open-source network stacks. We attribute our findings to the lack of explicit guidance in managing security contexts of buffered frames in the 802.11 standards." Traffic that is not encrypted is most at risk, that would be HTTP and old DNS. This offers a great chance to judge the company that made your router. The problems have to be fixed on their end. Do they say anything? Do they offer any suggested work-around? Will they update their firmware?
New Router Checklist
13 Things You Should Do After Plugging In Your New Router
by Jason Fitzpatrick of How To Geek April 11, 2023
On the whole not a bad article. But I disagree with a couple points targeted at people who have a combination modem/router from their ISP. It says "...you need to put your ISP’s combo unit into bridge mode." This is not true. Then it says "...you need to turn off the Wi-Fi radio in the ISP’s Wi-Fi router combo unit." Also not true. I would do neither of these things, at first. For one reason, they are not technically required. For another thing, it is best to live with the new router for a while before changing anything in the combination box.
MARCH 2023
Sonicwall devices infected with malware
Suspected Chinese cyber spies target unpatched SonicWall devices
by Jessica Lyons Hardcastle of The Register March 9, 2023
"Suspected Chinese cyber criminals have zeroed in on unpatched SonicWall gateways and are infecting the devices with credential-stealing malware that persists through firmware upgrades, according to Mandiant ... It's unclear whether this malware campaign is related to earlier ransomware infections, which targeted some of these same devices in 2021." The vulnerable devices are the SonicWall Secure Mobile Access (SMA) 100 Series. So, not so secure after all. It is not known how the gateways (aka routers) were infected. A recent firmware release added more defensive features, stuff a "secure" device should have already had.
Old DrayTek routers infected, but how?
DrayTek VPN routers hacked with new malware to steal data, evade detection
by Bill Toulas of Bleeping Computer March 6, 2023
An ongoing hacking campaign called 'Hiatus' targets old DrayTek Vigor routers (models 2960 and 3900) that are end-of-life. The malware steals data from infected rotuers and builds a covert proxy network. This was discovered by Lumen's Black Lotus Labs and they are unable to determine how the DrayTek routers were initially compromised. Ugh.
Black Lotus says that as of mid-February 2023, there were about 4,100 models 2960 and 3900 exposed on the internet. Of these, Hiatus had compromised approximately 100.
DECEMBER 2022
Many routers hacked at the PWN2OWN contest
Multiple consumer routers were hacked by many different groups. One highlight is that Synology seems to have gotten the worst of it, the RT6600ax was hacked by
many different groups. The contest involved hacking multiple types of devices, only the router exploits are shown below. All the routers were running the latest firmware. To me, the take-away from this is to avoid consumer routers.
OCTOBER 2022
TP-Link does it wrong
TP-Link network equipment hijacks some DNS requests
by Daniel Aleksandersen October 15, 2022
Non techies trying to get at the web interface of a router often have to address the router by its IP address, which can be too difficult for them. As a result, many hardware vendors offer names for their LAN-resident routers. For example, Asus uses router.asus.net and Netgear uses www.routerlogin.com. Everyone but TP-Link offers this feature using DNS which is fine. TP-Link implemented this feature using deep packet inspection. They intercept everything on UDP port 53 in a kernel module, which is asking for trouble. When they find one of their easy-to-use names, such as tplinkwifi.net, they return the LAN side IP address of their router or Access Point. But, the kernel module is configurable so a bad guy can permanently use it for domain hijacking. And, this is just wrong.
AUGUST 2022
Eero is such a privacy invasion that expert does not want to even review it
Your Router and Online Privacy Risks: Be Aware of that Hidden Potential Danger
by Dong Ngo of Dong Knows Tech August 9, 2022
Mr. Ngo regularly reviews routers. Quotes from the article: "... I tend to mention the "online privacy risks"
in increasing instances in the past couple of years. And the case of the eero Pro 6E must have been the crescendo on this front ...
I was so concerned about the privacy risks that, for the first time, I didn't even want to test it. ...
Your Wi-Fi router ... can keep tabs on everything you do online, all the websites you’ve visited, and your other activities, such as
shopping, streaming, chatting, texting, and so on.
If you use a router that doesn’t allow direct access to how it works or limited access, you don’t know what it really does with your information.
And if you use a router made by a company that forces you to log in via an account before you can manage your network,
your privacy is generally at the mercy of that company.
In this case, it’s like you actively report your every move to a third party. And this is the scariest part: That happens completely without your direct knowledge. There’s no visual, warning, or ID checking, not a fist bump or a wink. It’s total unawareness.
... popular networking vendors like Asus, Netgear, TP-Link, Ubiquiti, etc., are independent and relatively small companies.
Consequently, their data collection and the collected data are somewhat limited in scope and pervasiveness.
...
On the other hand, eero is owned by Amazon, which already has lots of data on its users ...
So if you’re an Amazon prime user and use an eero router, your exposure (to Amazon) is much higher than if you have a router
from another networking vendor. Come to think about it, the only reason Amazon bought eero in early 2019 might have been because
it wanted the user data the then-boutique networking company had designed its routers to collect. It wanted to hook deeper into the home, so to speak."
Not mentioned in this article, Mr. Ngo has also suggested avoiding Google routers for the same privacy reasons.
JULY 2022
DD-WRT and Asus can not be bothered fixing bugs
Vulnerability Spotlight: How a code re-use issue led to vulnerabilities across multiple products
by Francesco Benvenuto of Cisco Talos July 27, 2022
Talos found three vulnerabilities in open-source router firmware packages. The root cause in each case was a piece of code that had been taken from an open-source library owned by Broadcom.
In each case, a specially crafted HTTP request can lead to memory corruption. All three router firmware vendors were contacted on April 11, 2022. FreshTomato issued a patch on May 6th.
DD-WRT has not yet issued a patch. The bug also exists in Asus routers, both those running ASUSWRT (factory installed firmware) and the open-source firmware alternative known as Asuswrt-Merlin.
JUNE 2022
New malware targeting routers
ZuoRAT Hijacks SOHO Routers To Silently Stalk Networks
by Black Lotus Labs June 28, 2022
The malware seems to be using existing, known bugs to infect the routers. The routers are being hacked from the LAN side by malware running on Windows PCs. Some routers can limit the LAN side devices that are allowed to communicate with the web interface. If yours can, its worth looking into. They found infections in these routers: Cisco RV 320, 325 and 420, Asus RT-AC68U, RT-AC530, RT-AC68P and RT-AC1900U, DrayTek Vigor 3900 and some unspecified NETGEAR devices. The malware does not survive a re-boot of the router, so just as the home page of this site has suggested for a long time, periodic reboots are a good idea. The malware does lots of bad stuff. Black Lotus Labs is the threat intelligence division of Lumen Technologies. They "have a narrow view" of the full extent of what the malware can do. That said, they are sure that it does DNS and HTTPS hijacking. Only routers with a MIPS processor are vulnerable. One defense: The malware tries to learn the public IP address of an infected router by calling out to whatsismyip.akamai.com, ident.me, myipdnsomatic.com and ipecho.net. If these calls fail, the malware deletes itself under the assumption that it is being run in an isolated sandbox. If you can, block these websites in your router.
More Kaspersky on router security
The hidden threats of router malware
by Leonid Grustniy of Kaspersky June 8, 2022
Discusses some things that bad guys do with an infected router, such as: joining it to a botnet for DDoS attacks, steal your data and redirect you to pages with ads or malicious sites instead of the ones you want to visit.
Kaspersky on router security
Router security in 2021
by Maria Namestnikova of SecureList June 8, 2022
Quoting: "According to cve.mitre.org, the number of vulnerabilities discovered in various routers, from mobile to industrial, has grown over the past decade. However, with the mass shift to remote working, it went off the scale. During 2020 and 2021, more than 500 router vulnerabilities were found. The nvd.nist.gov website presents different figures, but they too show a significant increase in the number of router vulnerabilities found in 2020 and 2021 ...
Unfortunately, not all vendors are rushing to fix even critical vulnerabilities. At the time of writing, of the 87 critical vulnerabilities published in 2021, more than a quarter remain unpatched and unreported by the vendor...
APRIL 2022
WatchGuard can not be trusted to do the right thing
WatchGuard waited 11 months to explicitly disclose critical flaw exploited by Sandworm
by Dan Goodin of Ars Technica April 6, 2022
You buy the hardware for increased security, and it ends up lowering your security. A critical bug in WatchGuard firmware was fixed in May 2021 without a warning to customers of just how important it was. Quoting: "...the company made only the most oblique of references to the vulnerability". Months after the fix was released, the FBI told WatchGuard that their devices were being hacked. Still, no critical notice went out to WatchGuard customers. The company did not disclose the flaw until it became known that Russian hackers exploited it en masse to assemble a massive botnet.
FBI fights back against Russian bad guys
Companies were slow to remove Russian spies' malware, so FBI did it for them
by Dan Goodin of Ars Technica April 6, 2022
There is a story below (March 2022) about Russian malware called Cyclops Blink infecting Asus routers. It also infected WatchGuard network firewalls, months before the Russians started hacking Asus routers. In February 2022 this became public, but not many WatchGuard devices were cleaned up or updated with new firmware. So, to disrupt the botnet the FBI killed the Command and Control servers. This article makes it sound like the FBI cleaned up infected WatchGuard devices. They did not.
New bugs in TOTOLINK routers exploited immediately
Beastmode botnet boosts DDoS power with new router
exploits
by Bill Toulas of Bleeping Computer April 1, 2022
Botnet operators make money both by selling DDoS services and by launching attacks against firms and asking for a ransom to stop. The Beastmode botnet added five new exploits within a month, three of them targeting various TOTOLINK routers. TOTOLINK has released updated firmware for the buggy routers. Good thing too as the bugs are rated critical (CVSS v3 score of 9.8), enabling bad guys to take full control of vulnerable devices which are the A800R, A810R, A830R, A860R, A950RG, A3000RU, A3100R, A3600R, A7100RU N600R, T6, and T10. The botnet also takes candy from a baby - targeting EoL D-Link products (DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L and DIR-836L) that are vulnerable and will never be updated. It also tries to abuse the Huawei HG532 router using a bug from 2017. The botnet also picks on TP-Link Tapo C200 IP camera and the Netgear ReadyNAS line.
MARCH 2022
Critical bug in Sophos Firewall
Resolved RCE in Sophos Firewall (CVE-2022-1040)
by Sophos Last Updated April 5, 2022
The Sophos Firewall is for the big boys, as such I have never even seen one. But, it has had its share of security flaws and this one was a doozy. An authentication bypass flaw allows bad guys to get remote code execution. It has been fixed. Interestingly, the firmware has an "Allow automatic installation of hotfixes" feature that is enabled by default. It causes the firewall to check for critical bug fixes every 30 minutes. Cool. To their credit, Sophos updated some firmware that was End of Life. They also informed some of their customers that they had been hacked.
This is why VLANs matter
Wyze patches serious flaws on its security cameras, but not its oldest one - what you need to know
by Paul Wagenseil of Toms Guide March 29, 2022
Wyze cameras are buggy and the company took a very long time to issue fixes. Heck, for months Wyze would not even communicate with BitDefender, which reported the problems. The oldest version of the camera (version 1) was released in 2017 and will not be fixed (EoL). Details aside, this is exactly why VLANs are so important. It is probably best to keep any camera in its own VLAN, isolated from everything else in your home/office. Also, a router with outbound firewall rules can block the camera from phoning home, keeping the video in your home/office. Or, maybe, restrict where the camera is allowed to communicate on the Internet. As for details, BitDefender found three bugs: an Authentication bypass, a Remote control execution flaw and Unauthenticated access to contents of the SD card. If you have a Wyze Cam check the bottom of the camera. Version 2 units say "v2" while the EoL version 1 says nothing.
Russian bad guys targeting Asus routers
ASUS warns of Cyclops Blink malware attacks targeting
routers
by Bill Toulas of Bleeping Computer March 17, 2022
Russia has plenty of bad guys. Even with many of them killing Ukrainians, they still have enough left over to hack Asus routers. 18 different ASUS models are vulnerable to hacking by the Cyclops Blink malware which comes from a well known group of Russian bad guys known as Sandworm. If Cyclops Blink installs itself, it will persist as it gets written into flash memory. Factory reset does nothing. The malware was discovered infecting Asus routers by Trend Micro which warned: "If it is suspected that an organization’s devices have been infected with Cyclops Blink, it is best to get a new router." Asus has not issued bug fixes. Three buggy Asus routers will not get fixes because they are too old (EoL) to bother with: RT-AC87U, RT-AC66U and RT-AC56U. As is often the case, one defense is to disable remote administration. Trend Micro said "...the spread of Cyclops Blink appears indiscriminate and widespread". Just like Russian bombing in Ukraine. They also warn that the bad guys can adapt their malware for other routers. One defense not suggested is to block the Google DNS server at 8.8.8.8 because the malware uses it.
A great reason to avoid TP-Link routers
Newer TP-Link Routers send ALL your web traffic to 3rd party servers
by Reddit user ArmoredCavalry March 11, 2022
The Wire Cutter loves TP-Link routers. They are children playing a game meant for adults. This is a great reason to avoid TP-Link routers. Not only the initial find, but also the delay in dealing with the issue and the responses from the company which deal with a third of the issue. TP-Link embeds security software from Avira in some (many?) of their routers. The system is, ironically, called Safe Things and Home Shield. It was discovered that a TP-Link router sent 80,000 DNS requests in 24 hours to Avira Safe Things subdomains. The router was not configured to use the Avira software. Yet.... TP-Link has known about the bug since at least May 2021 but no fix had been issued. Then, this got some traction on Reddit and now TP-Link has beta software. The new software has not been verified to fix any of the three real issues (why call Avira at all, why call Avira so many times, what privacy issues are there with letting Avira spy on router activity). Asus includes security software from Trend Micro and they too had privacy issues.
MikroTik problems linger
Microsoft creates tool to scan MikroTik routers for TrickBot infections
by Bill Toulas of Bleeping Computer March 17, 2022
Microsoft released a forensics tool named 'routeros-scanner' that network administrators can use to scan MikroTik devices for signs that it was compromised by TrickBot malware.
It has been several years since MikroTik warned about the existence of critical flaws, yet hundreds of thousands of MikroTik routers are still vulnerable to malware botnets.
One thing to look for is open ports 449 and 8291.
The Dutch do Router Security Right
Russian state hackers target Dutch routers: Volkskrant
by DutchNews.nl March 3, 2022
The two most interesting aspects of this story to me: (1) The Dutch told victims about their routers having been hacked and (2) they advised that the hacked routers should be thrown away. Well done. A Russian hacking group known as 74455, Sandworm and BlackEnergy, has been targeting Dutch routers belonging to private individuals and small and medium sized businesses. The bad guys are part of the Russian intelligence service. It is not clear if the hacking is linked to the war in Ukraine. The number of hacked routers is not known. All this came to light due to an investigation by the Dutch military intelligence agency MIVD. The malware on the routers communicates with other Russian controlled computers in a network which is used for sabotage, spying and the spread of fake news. And, of course, routers that allow outside access are particularly vulnerable.
FEBRUARY 2022
Wuddya Know? Routers spy on you
Your Router Is Collecting Your Data. Here's What to Know, and What You Can Do About It
by Ry Crist of CNET February 25, 2022
First of all, my router is not collecting any data about me. CNET lives in the fishbowl of consumer routers. There is a bigger world. Crist reviewed the privacy policies for D-Link, Netgear, Asus, TP-Link, Eero, Google Nest and Arris (really CommScope). Every one confirmed that the company in question collected personal data for the purpose of marketing. All the companies also acknowledged that they share user data with third parties for marketing purposes. Such are consumer routers, one reason to look into secure routers. Crist wasted much of the article looking into whether a router tracks web activity. There is no one answer to that question as parental controls and assorted security features require the inspection of web traffic. Points of note:
--Asus and Google Nest were the only companies that let you opt out of data collection
--D-Link refused to answer questions about privacy
--best for opting out of data collection: The Motosync app for Motorola routers (run by Minim) has a very clear option
--worse: D-Link and TP-Link, which do not offer any direct means of opting out
--worst: Eero. The only way to stop Eero devices from gathering data is to not use them.
The Asus instructions for opting out in the article are wrong. The correct path to the option is Advanced Settings -> Administration -> Privacy tab.
This is what it looks like. The defensive steps in the article are incomplete. The most obvious omission is to use a VPN or Tor. Both hide activity from the router, just as they do from the ISP. Another option is to use a router with a web interface rather than a mobile app.
Watch out for WatchGuard routers
New Sandworm malware Cyclops Blink replaces VPNFilter
by UK National Cyber Security Centre February 23, 2022
Once upon a time there was a bug in WatchGuard routers. The company fixed it in May 2021. Still un-patched routers are being infected by bad guys in Russia, specifically part of Russia's GRU military intelligence agency. Not only have the nerds in charge of administering the boxes not installed bug fixes, they also left the buggy routers open to unrestricted remote administration without any of the available security options that WatchGuard provides for restricting remote access to the boxes. You could make a case that the techies doing defense are just as much, if not more, at fault that the Sandworm malware authors. The malware was first seen about three years ago and has been dubbed Cyclops Blink. It abuses the firmware update mechanism to allow it to remain running even if the box is re-booted. Currently only WatchGuard devices have been infected, but the NCSC warns that it could be adapted to other platforms.
JANUARY 2022
UPnProxy Follow-Up - still bad
UPnProxy: Eternal Silence
by Chad Seaman of Akamai January 27, 2022
Discovered by Akamai, a bug called UPnProxy is still alive and well, six months after they first publicized it. When abused, it attempts to expose TCP ports 139 and 445 on devices connected to the targeted router. Out of 3,500,000 UPnP routers found online, 277,000 are vulnerable to UPnProxy, and 45,113 of them have already been infected by hackers. This is yet another reminder that consumer routers ship with UPnP enabled by default to cut down on tech support requests. Peplink and pcWRT routers ship with UPnP disabled. Many devices were found vulnerable, including some from Asus, D-Link, Belkin, DrayTek, Edimax, HP, Monoprice, Netis, Netgear, Ubiquiti, SMC, ZyXel, ZTE. Also versions of OpenWRT are vulnerable.
Hacking an Optilink fiber router
The Story of How I Hacked my ISP’s Cheapo Standard Issue Router
by secnigma January 2, 2022
Hacking an Optilink 91001w ONU (Optical Network Unit) in India. Optilink is a rebrand of C-DATA which proved helpful. The webserver running in the router was Boa which was mainly used in embedded devices back in the 2000’s. Development stopped on the software back in 2005. You can't make this stuff up. He found a command injection flaw using the back tick character to execute Linux system commands. The vendor does not share the firmware to the public. To upgrade, the customer has to contact the vendor directly, and they arrange a remote session to upgrade the router. Wow. He eventually found a password file and cracked the hash to reveal two hardcoded backdoor credentials.
DECEMBER 2021
Support for Google OnHub routers being discontinued
Google is killing off its OnHub routers, easing the pain with Nest Wifi discounts
by Taylor Kerns of Android Police December 20, 2021
On December 19, 2022 support for Google OnHub routers is ending. The routers will still function, but owners will not be able to make any configuration changes, such as changing the Wi-Fi password. Google is offering owners of an OnHub router a 40 percent discount on their latest routers. The good news is that Google is being up-front and honest about this which is probably better than most consumer routers. And, roughly 7 years of bug fixes is not bad, as routers go. To me, the important issue is that it shows how important it is to be able to configure a router locally without depending on a cloud service. Fewer and fewer routers offer a full LAN side web interface. Mobile apps are the fashion. Another issue some cloud dependent routers have is that they kill LAN side communication when they are off-line.
Netgear is removing the remote administration feature
Quietly, Netgear Kills Web-based Remote Management, Pushing Mobile Apps
by Dong Ngo in his own blog Dec 21, 2021
I once returned a Netgear router because it only supported HTTP (and not HTTPS) for remote administration. So, clearly, they never cared much about it. Judging by the screen shot in this article, it seems this is still the case, although they do let you change the port and limit the source IP address. If remote administration (Netgear calls it remote management) is disabled, then a firmware update may remove the feature altogether. And, the latest routers don't have remote administration at all. Quoting: "The company didn’t make any announcements or provide any guidelines. Instead, it simply excludes the feature from its new routers starting this year". This is not what you want from your router company. Without the feature, Netgear customers have to use a Netgear mobile app which requires a Netgear account. Ngo writes: "... Netgear is the only one who stands to benefit from this development. The more users who use the apps, the more ... valuable data it can collect from its users ..." Perhaps this is the real motivation.
Vulnerable un-patched MikroTik routers
300,000 MikroTik routers are ticking security time bombs, researchers say
by Dan Goodin of Ars Technica December 9, 2021
Security firm Eclypsium has found roughly 300,000 on-line un-patched and vulnerable routers made by Latvia-based MikroTik. The three missing patches were discovered and fixed in the past three years. It is as if these routers were abandoned. Needless to say, MikroTik routers do not auto-update. See also a September 2021 item below.
OCTOBER 2021
Hacked routers used by Russians to attack US Government
Russian Hackers Used Home Networks to Evade Detection
by William Turton of Bloomberg October 26, 2021
The term "Home Networks" in the title of the article refers to hacked routers. So
A "residential IP proxy" is a hacked router.
Bad guys hack routers and then sell access to the routers. The victimized routers are modified in a way that they forward data packets. Thus, a hacking attempt by the Russian Foreign Intelligence Service, that starts in Russian, appears to come from 123 Main Street in Denver, Colorado. This simple concept is hidden behind the terminology used in the article.When it comes to guessing passwords, access to hacked routers is doubly important. Rather than make many guesses from the same public IP address, bad guys can scatter their guesses across a range of locations. To be a broken record, I recommend avoiding any router from an ISP and also avoiding consumer routers.
Proof that Wi-Fi passwords need to be long
70% of Wi-Fi networks are easy to hack - how to protect yourself
by Paul Wagenseil of Toms Guide October 28, 2021
Ido Hoorvitch1 of CyberArk walked around his neighborhood and sniffed information from 5,000 thousand Wi-Fi networks. He took this data back to his office and, using hashcat, was able to calculate the password for 70 percent of the Wi-Fi networks. He used a relatively new Wi-Fi attack on WPA2 Personal. He did not say if it the attack will work on WPA2 Enterprise or WPA3. The attack is based on recording the SSID, the hash of the PMKID, the MAC address of the router and the MAC address of a router client. A PMKID is used for roaming between Access Points. If you have a single router, there is no need for a PMKID, yet it was often present. He offered no advice on determining if your router is broadcasting a PMKID. The cracked passwords were often just numbers or just lower case letters.
The lesson to be learned is that longer passwords and varied (not random) password are more resistant to this type of brute force attack.
Asus AX56U router hacked twice
Windows 10, iOS 15, Ubuntu, Chrome fall at China's Tianfu hacking contest
by Catalin Cimpanu of The Record October 17, 2021
The Tianfu Cup is the largest and most prestigious hacking competition in China. At the event, the ASUS AX56U router was hacked by two different teams. I could not find anything on what the bug was and whether Asus will ever fix it or not.
A TP-Link router was hacked for years
Botnet abuses TP-Link routers for years in SMS messaging-as-a-service scheme
by Catalin Cimpanu of The Record October 7, 2021
Since at least 2016, bad guys have hijacked the 4G-capable TP-Link MR6400 router. The problem came to light when a large number of outgoing SMS messages sent from the SIM card in the router caused high phone charges. The theory is that the bad guys organized the hacked routers into a botnet, and made a business of sending cheap SMS messages. It is thought that the routers were compromised using a vulnerability disclosed in 2015 that provided access to the files on the router. The bug was fixed but many of the routers remain unpatched, even to this day. This research was done by Robert Neumann of Acronis and Gergely Eberhard of Search-Lab. Abuse of the botnet peaked in 2018 and is still ongoing but at a reduced level.
SEPTEMBER 2021
Hacked MikroTik routers used in HUGE botnet
Meet Meris, the new 250,000-strong DDoS botnet terrorizing the internet
by Catalin Cimpanu of The Record September 10, 2021
The Meris botnet broke the record for the largest volumetric DDoS attack twice this summer. It is estimated that the botnet consists of around 250,000 infected devices, most from MikroTik. MikroTik is a small Latvian company that sells routers, IoT gateways, WiFi access points, switches and the like. It seems like the bug being abused is old. The company said: "As far as we have seen, these attacks use the same routers that were compromised in 2018, when MikroTik RouterOS had a vulnerability, that was quickly patched. Unfortunately, closing the vulnerability does not immediately protect these routers. If somebody got your password in 2018, just an upgrade will not help. You must also change password ... We have tried to reach all users of RouterOS about this, but many of them have never been in contact with MikroTik and are not actively monitoring their devices ...There are no new vulnerabilities in these devices."
JULY 2021
Hacked routers used to attack French organizations
Home and office routers come under attack by China state hackers, France warns
by Dan Goodin of Ars Technica July 21, 2021
The French National Agency for Information Systems Security (abbreviated as ANSSI) warned that China state hackers are compromising large numbers of routers for use in a vast and ongoing attack against organizations in France. The compromised routers give the attackers anonymity and are used while carrying out reconnaissance and attacks. One defense of a router is to periodically restart it, since most router malware is unable to survive a reboot.
Asus router fails to get online
by me July 1, 2021
I am setting up and configuring an Asus AC1900P router. I started in early May and was forced to chose between beta firmware and known buggy firmware. I blogged about this here: Asus router firmware: How do you prefer your bugs? New or Old?. By the end of June there was new firmware (version 3.0.0.4.386_43129) which I installed. As I suggest on the New Router page, the router was not directly connected to the Internet, instead it was on my LAN. Specifically, its WAN port was connected to a LAN port of my existing router. The problems began immediately and I will not bother with most of the details. What I thought was a minor thing, turned out to be, I think, the one problem from which all others stemmed: the router incorrectly thought it was off-line. Eventually, it occurred to me to validate this using the tools built into the firmware, specifically at Network tools -> Network analysis. First, I pinged a couple websites and all was well. Then I ran a couple nslookup commands and, again, all was well. As expected, the DNS server was that of my existing router. Then, I tried netstat. Just after a cold boot, with no device connected to the router (other than a computer on my LAN that logged into it via Ethernet Remote Access) this screen shot shows the router was very much involved with a.applovin.com. Applovin does mobile app advertising and because of this, a.applovin.com was blocked on my LAN. The previous firmware (beta version 9.0.0.4.386.41994) ran just fine on the same LAN. The firmware history shows that the current firmware (version 3.0.0.4.386_43129) is twice the size of the previous firmware. A lot must have changed.
I posted a question about this on Reddit and got no response. I also posted a question about it on the SmallNetBuilder forum, and got no useful response. Asus has no forum (that I could find).
Update July 2, 2021: The router is not involved with applovin.com. The domain a.applovin.com was blocked via DNS, specifically, a query for that sub-domain returned an IP address of zero. Many domains on my LAN are blocked this way, a.applovin.com is the first when sorted alphabetically. After testing again today, I ran netstat with the option to resolve names disabled. This showed many connections to IP address zero. When trying to get a name for IP address zero, netstat must have been given a.applovin.com by the main/outer router. Still, the router thinks it is off-line. The main page displays its LAN IP address (192.168.1.something) for a second, then complains about being disconnected. My testing today included a log of all outgoing packets from the router. The log showed that the router made a UDP request to port 19302 at IP address 172.217.215.127 which belongs to Google. A previous log of all router activity as it starts up also showed a UDP request to port 19302, but that time, the IP address was 108.177.122.127. This too is Google. In each case, these were the only requests the router made to the Internet. Researching the UDP port, I learned that it is used by Google STUN servers and can provide the client (the Asus router) with its public IP address. In both instances, the router made these Google STUN requests 8 seconds after it was assigned a LAN side IP address by the other router. The Asus router log file includes this message "WAN Connection: ISP's DHCP did not function properly." Clearly there is a bug in how the router determines if it is online or not. What to do? I changed the WAN type from DHCP to Fixed IP address and assigned it the same LAN-side IP address it was already using. After a reboot, all was well. What a pain.
JUNE 2021
Some vague Zyxel problem
Hackers are using unknown user accounts to target Zyxel firewalls and VPNs
by Dan Goodin of Ars Technica June 24, 2021
Vague, vague vague. My take-away from this article is that no one knows what is going on. What does "access a device" mean? Bypass what authentication? My guess is that this issue, whatever it is, is very bad, and the vague explanation is designed to hide this. Smells like there are backdoor accounts in the vulnerable devices. Maybe. Glad that they sent a SOP to all registered users. What's a SOP?
MAY 2021
Article by Dong Ngo
Router Management: Web Interface vs. App and the Trend Linksys Typifies
by Dong Ngo May 29, 2021
Interesting article. Ngo sees and tests many more routers than I do, so he has a good perspective. Quoting:
=> There’s been a trend in home networking that forces or coerces users into signing up for a login account with the vendor and associate their home network with it. It all started with the eero. Nowadays, you’ll find this type of practice common in many vendors, though not all ... Asus is one of a few vendors that provide a mobile app that works without a login account.
=> ... the [mobile] app itself is not inherently bad. Rather it’s the intention behind the app that can be problematic. That’s especially true when a vendor attempts to turn you into a product via the app. Have you ever wonder how exactly the app on your phone is linked to the router at home? There’s no magic. You likely pay for that with your personal information. In fact, the mining of personal information is so lucrative that many vendors - such as Google or Amazon - have gone as far as taking the web interface entirely out of their home networking devices and make the app the only option. Others try to coerce users into the app artificially ... ever wonder why a vendor would like to collect data from your network, the answer is, among other things, advertising. Your online habits reveal a lot about what you have bought and are going to buy. This type of information, collected over time, is a gold mine for the receiving end. In other words, you become the product.
=> On top of that, there are also security risks. That’s because the vendor itself can be hacked, and when that happens, you have no idea who gets a hold of the data collected from your home network and what they’re going to do with it.
He explains how to use avoid creating a Linksys account while still being able to configure a Linksys router using the web interface.
An Asus router offers nothing but bugs
Asus router firmware: How do you prefer your bugs? New or Old?
by Michael Horowitz (me) May 11, 2021
I am looking to update the firmware on an Asus RT-AC1900P router and I end up with a very bad choice. I am manually reviewing the latest firmware (dated February 1, 2021) because the automatic check for updates in the router failed. No matter. The most recent firmware is in Beta status which no normal router user/administrator would normally want any part of. But, this Beta software has a large number of security bug fixes. So, the choice is either to install firmware with old, known bugs or new untested Beta firmware with new bugs. Router firmware should not remain in Beta status for over three months. Makes you wonder if Asus is even working on testing it.
Update: Firmware version 3.0.0.4.386.43129 was released May 21, 2021 with fixes for seven known bugs (aka CVEs).
Why its hard to trust any Asus router
CVE-2021-32030: ASUS GT-AC2900 Authentication Bypass
by Chris Bellows of Atredis Partners May 6, 2021
There is a bug in the ASUS GT-AC2900 router (aka RT-AC2900). It currently sells for about $170 and was released around January 2018. The bug has to do with validating the cookie that governs the current state of the web interface. Bugs in the validation can let someone get at the router without knowing the password. In techie lingo, its an authentication bypass vulnerability. Asus was informed of the problem March 16, 2021 and issued patched firmware April 28, 2021. That's the dull and boring part. The interesting part is the reaction from Asus. Sure, they fixed the bug in the RT-AC2900 but what about the many other Asus router models? It is very likely they share the same bug. But, Asus never issued a security advisory, so we have no way to know if their other routers are also buggy. It's none of our business.
Update: I mis-understood the flaws because in listing them, Bellows did not use either "and" or "or". I read it as three different flaws, which was wrong. All three conditions have to be true to trigger the flaw, not any one of them.
Here we go again - lots of old and vulnerable routers
Which? warns that more than 2 million Brits are on old and insecure
routers – wagging a finger at Huawei-made kit
by Gareth Corfield for The Register May 6, 2021
That millions of routers run old buggy software is not news. This time, the report is out of England from consumer organization Which? (the question mark is part of their
name). In December 2020 Which? surveyed more than 6,000 UK adults, asking them which routers they were using at home. From this, they identified 13 older routers that are still commonly
used and had them evaluated by security specialists at Red Maple Technologies. Nine of the 13 routers did not meet modern security standards. ISP-branded routers are typically white-label devices from China. Recent vendors to UK ISPs have been Huawei and ZTE. One big issue was the lack of firmware (router software) updates. They estimate that 6 million Britons are using routers that were last updated in 2018, and, of those, 2.4 million routers have not been updated for five years. The worst offenders were the Sky SR101 and SR102, the TalkTalk HG523a, HG635 and HG533 and the Virgin Media Super Hub and Super Hub 2. This came up because England is considering a law that would require phone, tablet, and IoT vendors to publish a drop dead date for security updates on new devices.
Another issue was weak default passwords that can be easily guessed by attackers from anywhere in the world. Routers with weak passwords were from Sky, TalkTalk, Virgin Media and Vodafone.
Perhaps the worst router was the TalkTalk HG533 made by Huawei and released in 2013. Huawei was warned in 2013 of a vulnerability involving UPnP. They claimed it was fixed in 2014, but they never actually fixed it. The same vulnerability was re-discovered in 2017 by a different group of security researchers. The current evaluation found that the HG533 has weak passwords and is not being updated.
The worst ISP seems to be Virgin Media because they "... told Which? to stuff off when its researchers came wagging their fingers disapprovingly". In other words: go away kid, don't bother me. Virgin Media "... did not recognise or accept the findings of the Which? research ..." The only good news is that old routers from both BT and Plusnet had received recent updates and had no security issues.
APRIL 2021
F**k Microsoft - they removed this site from Bing and DuckDuckGo and Yahoo and AOL
April 23, 2021. Microsoft does not want you to see this website.
This site is not promoted in any way. There are, for example, no ads for it. And, for whatever reason, no articles about Router Security ever mention this
site, let alone link to it. So, when it disappears from a search engine, it disappears. Do a search for "router security" on Google and this site is currently, the top hit.
The same is true at Startpage, Yandex and Baidu.
Yet, it is nowhere to be found on either DuckDuckGo or Microsoft's Bing. By this, I do not mean that it is on the second page of search results, it does not exist at all.
DuckDuckGo says: "We also of course have more traditional links in the search results, which we also source from multiple partners, though most commonly from Bing (and none from Google)." Elsewhere they
say: "We get our results from various sources but mostly Bing, Yahoo and Yandex ...".
I forgot Yahoo existed. Sure enough, this site is also missing from a Yahoo search for "router security". I don't think Yahoo really has their own search engine, I think they
partner with Bing. So, my guess is that Bing is the real culprit. If a site is removed from Bing, it will probably not appear in DuckDuckGo or Yahoo. Granted, I am no expert on this.
Could someone have reported this site as bad to Bing? Microsoft makes it pretty easy to ask for a site to be removed. I doubt they notify the site owner. I also doubt they do much Due Diligence.
April 24: Someone emailed me today saying that this site is the top hit for him at DuckDuckGo. Yet, I don't see it at all and I tried DuckDuckGo on multiple computers with multiple browsers and, thanks to a VPN, from multiple IP addresses. Additional testing showed that this site only appears for him with the Lynx text-based browser on Linux. When he uses normal Firefox, the site does not appear. I can not explain this.
April 25: I did some digging through history and found some referrals from cn.bing.com. So, whatever it is about this site that Bing considers bad, illegal or offensive, does not apply to China. I could not determine when the ban took place. But, in looking at the old server logs, I also saw referrals from search.aol.com. The AOL search is also powered by Bing.
April 27: I'm back ... it seems that feedback I submitted to Bing and DuckDuckGo had an effect.
May 6: Demoted again. This site is no longer the top site on Bing when searching for "router security". It remains the top site on Google. The top results, in sequence, are:
Norton, TomsGuide, BestBuy (wow what a screw-up), Microsoft, BestBuy again, Wired, pcworld, foxnews, lifewire, zdnet on recent news, welivesecurity also on recent news, usatoday, and then the Test Your Router page on this site. Foxnews for router security? BestBuy? USA Today? Is Microsoft screwing with me or can they really be that bad at this?
May 15: Adding insult to injury. Not only does Bing rank this site lower than it used to, but the top "router security" web page is just awful. It is one of the worst articles on
router security that I have ever seen. More on my blog: Bing prefers miserable Router Security advice
May 16: It seems that Bing treats the last date on a page as the Last Updated date. On this site, the last date is usually the page creation date, so, perhaps Bing is ranking the pages low
because it thinks they are old. I am doing a test. The last date that physically appears on each page is now May 14, 2021. Time will tell . . .
Still more misery with IoT
100 Million More IoT Devices Are Exposed - and They Won't Be the Last
by Lily Hay Newman of Wired April 13, 2021
I consider this router news because it is yet another reason to segment your home network (LAN). For more on this concept, see the VLAN page. Over the last few years, researchers have found a large number of vulnerabilities in the software that underpins how devices communicate, both within a LAN and on the Internet. The communication software is known as a TCP/IP stack. This article is about the latest group of bugs, a set of nine vulnerabilities that are estimated to affect 100 million devices, including internet-of-things (IoT) devices and IT management servers. The bugs are in four different, and popular, TCP/IP stacks. The most famous of the four is included in FreeBSD, which underlies routers running both pfSense and OPNsense. The other three TCP/IP stacks are Nucleus NET (from the industrial control firm Siemens), IPnet and NetX. Exploiting the bugs, an attacker can either crash the vulnerable device or, perhaps, take control of it. Patches have been issued for all nine bugs but many devices will not and/or can not be updated. Similar flaws in other TCP/IP stacks have exposed hundreds of millions of devices to potential hacking. Why are there so many bugs in such fundamental software? An expert is quoted saying "A lot of it is about lack of economic incentives to really focus on the quality of this code."
Portable Verizon 4G hotspot is a fire hazard
Verizon Recalls 2.5M Ellipsis Jetpack Mobile Hot Spots Over Fire Hazard
by Allen St. John of Consumer Reports April 8, 2021
To the public, its a 4G hotspot, but to me, its a router. Verizon is recalling about 2.5 million Ellipsis Jetpack mobile hot spot devices with lithium-ion batteries that have overheated. The specific models are: MHS900L, MHS900LS and MHS900LPP. Verizon is offering a free exchange, replacing the Jetpacks with an Orbic Speed hot spot.
No Cisco for me
Cisco Will Not Patch Critical RCE Flaw Affecting End-of-Life Business Routers
by Ravie Lakshmanan of Hacker News April 9, 2021
There are many instances, documented in both the News and Bugs pages of this site, of critical flaws in Cisco software. There have been so many huge security flaws in Cisco software that I don't bother including them all here. The concept became clear long ago - they are not trustworthy. Cisco just issued fixes for still more critical bugs (Cisco fixes bug allowing remote code execution with root privileges) but the point here is about a bug they did not fix. Specifically, the bug identified as CVE-2021-1459, which exists in the web-based management interface of the Cisco Small Business routers RV110W, RV130, RV130W, and RV215W. The bug is as severe as severe gets, an unauthenticated bad guy can execute arbitrary code on a vulnerable device. But, these devices are too old to bother with. Quoting the company: "Cisco has not released and will not release software updates to address the vulnerability ... The Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers have entered the end-of-life process ... Customers are encouraged to migrate to the Cisco Small Business RV132W, RV160, or RV160W Routers." I agree that owners of buggy devices need to buy new hardware, but at this point, you could not pay me to use hardware from Cisco (or Ubiquiti for that matter). It is interesting to note that when a bug is really bad, as this one is, Microsoft will make an exception, and issue a patch for no-longer-supported software.
MARCH 2021
Bombshell revelation about Ubiquiti
Whistleblower: Ubiquiti Breach Catastrophic
by Brian Krebs of KrebsOnSecurity.com March 30 ,2021
Quoting: "On Jan. 11, Ubiquiti Inc.... disclosed that a breach involving a third-party cloud provider had exposed customer account credentials. Now a source who participated in the response to that breach alleges Ubiquiti massively downplayed a 'catastrophic' incident to minimize the hit to its stock price, and that the third-party cloud provider claim was a fabrication ... It was catastrophically worse than reported, and legal silenced and overruled efforts to decisively protect customers. The breach was massive, customer data was at risk, access to customers' devices deployed in corporations and homes around the world was at risk." And, more details: "The whistleblower claims that 'attacker(s) had access to privileged credentials ... and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies. Such access could have allowed the intruders to remotely authenticate to countless Ubiquiti cloud-based devices around the world. " At times like this, you might expect a company to force all users to change their password the next time they logon. Instead, Ubiquiti sent out emails, that were flagged as SPAM, so some users never saw them, that suggested changing their password. I spent 10 years as a Database Administrator so this point really hit home: Ubiquiti had no logging configured for the critical databases that the attacker(s) gained access to. Thus, they have no clue what the bad guys did. This is malpractice and is a great reason not to trust them going forward. Ubiquiti took a full day to respond to these charges and their response was half-hearted and did not fully deny all these charges. Oh, and the attackers also provided proof they had stolen Ubiquiti's source code. Some points:
Update: April 4, 2021. Ubiquiti All But Confirms Breach Response Iniquity by Brian Krebs. Four days after the above disclosure, the company issues a public statement that confirms and reinforces the claims in the first article. Nothing was denied.
From other sources
FEBRUARY 2021
NAT traversal issues
NAT Slipstreaming v2.0: New Attack Variant Can Expose All Internal Network Devices to The Internet
by Ben Seri of Armis February 2021
There are two industry issues that affect many routers. Rather than being bugs, they are design flaws in Application Layer Gateway (ALG) software. In late October 2020,
respected security researcher Samy Kamkar figured out a way to poke a hole in the router firewall that opened up access to a computer visiting a
malicious web page. This initial version of the NAT Slipstreaming attack abuses the Session Initiation Protocol (SIP) protocol and ports 5060 and 5061. The second generation attack abuses the H.323 multimedia protocol to open firewall holes to any LAN side device. It depends on sending TCP traffic out to port 1720 (for call forwarding).
In response to these issues, web browsers have blocked some outbound ports. Armis, which developed the second generation attack said "The real fix would be every user and sysadmin disabling all ALGs, as this feature is fundamentally broken." In response to the second generation attach, Chrome not only blocked port 1720, it also blocked 69, 137, 161, 1719, 1723, and 6566.
The other TCP ports "are known to be inspected by NAT devices and may be subject to similar exploitation." As for routers, the obvious solution is to disable the ALGs. On the Stuff to Turn Off page here, I provide screen shots and summaries of the varying ALG support from AmpliFi, Asus, DrayTek, Eero, Google Nest, Linksys, Peplink, TP-Link and UniFi. Routers that provide outbound firewall rules can be configured to block these same ports. This is a more complete solution.
Ports to block for v1: 5060 and 5061
Ports to block for v2: 69, 137, 161, 1719,1720, 1723 and 6566
Port later blocked: 554
JANUARY 2021
Ubiquiti is hacked and lies about it
Ubiquiti tells customers to change passwords after security breach
by Catalin Cimpanu of ZDNet January 11, 2021
"According to Ubiquiti, the intruder accessed servers that stored data on UI.com users, such as names, email addresses, and salted and hashed passwords. Home addresses and phone numbers may have also been exposed ... How many Ubiquiti users are impacted and how the data breach occurred remains a mystery ... A Ubiquiti spokesperson did not immediately return a request for comment send before this article's publication ... Despite the bad news to its customers, Ubiquiti said that it had not seen any unauthorized access to customer accounts as a result of this incident. The company is now asking all users who receive the email to change their account passwords and turn on two-factor authentication. While initially, some users looked at the emails as a phishing attempt, a Ubiquiti tech support staffer confirmed that they were authentic on the company's forums."
My take: I have installed two AmpliFi systems and this left me annoyed as heck because I was not sure if the problem affected me or not, which is pretty trivial to convey. Do I need to change the router password? The Wi-Fi password? I bought one from the Ubiquiti website (store.amplifi.com) and had to create an account there. Is that part of the breach? None of my business. I logged into the site to change my password and there is no change password function. You can't make this stuff up. Do AmpliFi customers have a Ubiquiti account if they purchased the hardware elsewhere? Dunno. No more Ubiquiti for me. We did not know they were lying about much of the problem until March 2021.
A huge number of security problems with FiberHome routers
Multiple backdoors and vulnerabilities discovered in FiberHome routers
by Catalin Cimpanu of ZDNet January 18, 2021
Anyone with an optical fiber connection to the Internet has an Optical Network Terminal that converts optical signals into Ethernet and Wi-Fi data packets.
Chinese company FiberHome makes a HG6245D model ONT/router that is a security disaster. The HG6245D is widely deployed in South America and Southeast Asia. News of these flaws comes from Pierre Kim who has reported many other router bugs in the past. He was supposed to give a presentation on the problems at a conference that was cancelled due to the pandemic. Not only were there many security flaws (too many to count) there were also 28 backdoor accounts. Geeze. What does the company have to say for itself. Nothing. Quoting: "Requests for comment sent by ZDNet to FiberHome via email and its official website last Thursday, January 14, remained unanswered at the time of writing."
