SANS ISC

• SANS Site Network
  • Current Site
  • Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • IT Audit
  • Computer Forensics
  • Software Security
  • Government OnSite Training

InfoSec Community Forums

Quoting Diary:

Brett, who operates an ISP in Wyoming, notified us that he had a number of customers with compromissed Linksys routers these last couple of days. The routers, once compromissed, scan port 80 and 8080 as fast as they can (saturating bandwidth available). 

It is not clear which vulnerability is being exploited, but Brett eliminated weak passwords. E1200 routers with the latest firmware (2.0.06) appear to be immune agains the exploit used. E1000 routers are end-of-life and don't appear to have an immune firmware available.

As indicators, look for E1000/1200 routers which scan IP addresses sequentially on port 80/8080. Some of the routers may have modified DNS settings to point to Google's DNS server (8.8.8.8 or 8.8.4.4). 

If you have any insight, please let us know.

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Might have something to do with this 0-day exploit
http://www.defensecode.com/public/DefenseCode_Broadcom_Security_Advisory.pdf

It's possible it's related to this issue, which was blogged about by one of my fellow researchers in May...

http://blog.spiderlabs.com/2013/05/under-the-hood-linksys-remote-command-injection-vulnerabilities.html

Yes. This is the kind of vulnerability that would come in play here. I just refined my honeypots a bit better so hopefully we will get an exploit captured soon.

Also, I have the E1000's and an E1200 that I bought when that research was being performed.

So, if you need some testing done, let me know and I will power them up.

I came across the following article: http://www.cert.pl/news/8019/langswitch_lang/en

It mentions recent malicious activity observed on home-based routers. Vulnerabilities are exploited on them to allow attackers to remotely change the DNS configuration and perform malicious redirections.