More than 300,000 home and small-office (SOHO) routers have been compromised by hackers and are being used to distribute massive quantities of spam and malware.
Florida-based security firm Team Cymru sounded that alarm Monday in a research report into the router takeovers, which it's been tracking since January. Hacked routers have been found everywhere from the United States to Russia, although the largest quantity were traced to Vietnam, India, Turkey, Thailand, and Columbia.
Team Cymru has shared its findings with multiple law enforcement agencies, and tried to contact all affected manufacturers, which it said include D-Link, Micronet, Tenda, and TP-Link, among others.
[Want to learn more about router vulnerabilities? See D-Link Router Vulnerable To Authentication Bypass.]
Who's behind the 300,000-router takeover campaign? The compromised devices are connecting to two servers -- located at 220.127.116.11 and 18.104.22.168 -- which handle all external DNS requests. Team Cymru spokesman Steve Santorelli told PC Pro that both of those IP addresses are registered to a supposedly London-based company called 3NT Solutions.
Last month, security analyst Conrad Longmore published a blog post reporting that those IP addresses assigned to 3NT Solutions were involved in "something evil." In particular, the company's IP addresses appeared to be associated with a spam campaign distributing "FlashUpdate.apk" Android malware, which as of Tuesday was only being detected by about half of all antivirus scanners on the market. If the malware is executed on a vulnerable Android device, it then downloads a second piece of malware named "Security-Update.apk," which is a Trojan proxy.
About 10 days ago, Longmore traced 3NT's mailing address to a London branch of Mail Boxes Etc., and the address listed in its WHOIS entry to a London-based mail-forwarding service. But based on a lookup of the IP ranges associated with the business, he said it connects with Inferno.name, which has had a reputation for hosting "scammy sites" since 2011. "I had a look into some of 3NT's IP ranges and you can tell instantly from these samples that they are pretty low-grade spammy sites," he said. "What you can't tell from that list are the command and control servers that they run, and of course they also host malware."
Longmore said that while 3NT appears to be based in Serbia, it's also operating sites in Russia and the Ukraine. He noted that "Ukrainian hosts often serve as black-hat hosts for Russian criminals" and that "Serbia and Russia also have close ties."
Compromising businesses' routers would allow attackers to channel all external traffic through their own DNS servers and launch man-in-the-middle attacks. Accordingly, one possible motive for the 3NT attack campaign could be to intercept consumers' banking credentials, as happened in a recent router-exploitation campaign that targeted users of five Polish banks, including mBank.
But in this case, the quantity of exploited routers suggests that attackers have a different goal. "The scale of this attack suggests a more traditional criminal intent, such as search result redirection, replacing advertisements, or installing drive-by downloads; all activities that need to be done on a large scale for profitability," according to Team Cymru. "The more manually intensive bank account transfers seen in Poland would be difficult to conduct against such a large and geographically disparate victim group."
The twist with the 300,000-plus compromised routers is that they could have been patched, and related exploits thus blocked. "Our research into this campaign did not uncover new, unknown vulnerabilities. Indeed, some of the techniques and vulnerabilities we observed have been public for well over a year," according to Team Cymru.
As that suggests, the number of routers that run unpatched firmware with known, exploitable vulnerabilities, remains rife. Researchers at security firm Tripwire, for example, recently studied the 50 most popular routers for sale on Amazon.com, and found that 74% of them contained vulnerabilities that
were either publicly documented, or which the researchers found on their own, after a small amount of testing.
"SOHO routers tend to have their flaws from their web management interfaces," said Craig Young, Tripwire's lead security researcher, in a recent phone interview. That's just one reason why one security best practice is to disable -- or leave disabled -- any router features that aren't explicitly required, such as remote management, media streaming, photo sharing, or even the web management interface itself, if possible. "Any feature that you're not using, you don't want to have enabled, because then you're increasing the amount of code you're using, thus increasing your attack surface," he said.
When it comes to procuring more secure routers, some vendors do a better job than others. "I don't usually comment on vendors, but Apple, for example, does not have a web interface in its Airport, so it would be a little more difficult for someone to try and attack it; you're limiting the attack surface by doing that," Young said.
How can IT administrators better protect their routers against takeover attacks? "Command line configuration of devices, where possible, is preferred to web GUI interface methods, as many of the vulnerabilities reported involve CSRF attacks against users logged into the configuration GUI," the Team Cymru report said. "Administrators should also ensure device firmware is kept up to date."
"For larger corporate networks, security professionals could also deploy HTML code to their externally facing servers to attempt to detect remote users' DNS settings, and potentially block users with compromised DNS settings, by using [an] HTML tag with a unique hostname that links visitors' DNS requests to their page visits," it said. "Note that this could add unwanted overhead for large organizations."
The discovery of the DNS-changing campaign follows February's discovery of the Moon worm, which uses HNAP scanning to find vulnerable devices, and then alters their DNS settings to launch a distributed denial-of-service attack against a particular website. Exploit code for that vulnerability has been published on the Internet, meaning that copycat attacks may soon follow.
The large number of routers running publicly known, and exploitable, vulnerabilities was cited as a significant information security concern at last week's RSA conference in San Francisco. The worry is that as more devices -- from refrigerators to toothbrushes -- become Internet-connected, per the so-called Internet of Things, attackers will gain a larger platform of devices that can be exploited and used to launch attacks.
Penetration testing expert and SANS Institute instructor Ed Skoudis predicted at the RSA conference that the large number of vulnerabilities found -- and exploited -- in SOHO routers, as well as webcams, will likely soon be joined by the mass exploitation of Internet-connected thermostats, electronic locks, and home automation equipment. "If you're a vendor who manufactures any of this Internet of Things stuff, make sure you have a proper patching process, because otherwise you're not properly protecting consumers," said Skoudis.
But if router and other security-product vendors can't put easy-to-use -- and effective -- updating processes in place, what hope do consumers have when it comes to securing Internet-connected home appliances and automation tools?
Mobile, cloud, and BYOD blur the lines between work and home, forcing IT to envision a new identity and access management strategy. Also in the The Future Of Identity issue of InformationWeek: Threats to smart grids are far worse than generally believed, but tools and resources are available to protect them. (Free registration required.)Mathew Schwartz served as the InformationWeek information security reporter from 2010 until mid-2014. View Full Bio