300k+ Home WiFi Routers hijacked (D-Link, Micronet, Tenda, TP-Link)

Path	csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From	"wjwlsn" <ibillwilson@gmail.com>
Newsgroups	comp.misc
Subject	300k+ Home WiFi Routers hijacked (D-Link, Micronet, Tenda, TP-Link)
Date	Mon, 3 Mar 2014 19:14:04 -0600
Organization	A noiseless patient Spider
Lines	29
Message-ID	<4919#0@usenet.squte.com> (permalink)
Content-Type	text/plain; charset=UTF-8; format=flowed
Injection-Info	mx05.eternal-september.org; posting-host="1858be7b02c727ad8c4c4755e1110c21"; logging-data="8895"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+7fVAvTy33O/X4xdgRDNdg"
In-Reply-To	<4919#0@usenet.squte.com>
X-Newsreader	http://squte.com
Cancel-Lock	sha1:4eIqpbTbFLRzwGLWw3yosHUiU5w=
Xref	csiph.com comp.misc:1228

Show key headers only | View raw

"Researchers said they have uncovered yet another mass compromise of home
and small-office wireless routers, this one being used to make malicious
configuration changes to more than 300,000 devices made by D-Link, Micronet,
Tenda, TP-Link, and others.

The hackers appear to be using a variety of techniques to commandeer the
devices and make changes to the domain name system (DNS) servers used to...
Likely hacks include a recently disclosed cross-site request forgery (CSRF)
that allows attackers to inject a blank password into the Web interface of
TP-Link routers. Other attack techniques may include one that allows
wireless WPA/WPA2 passwords and other settings to be remotely changed.

So far, the attacks have hijacked more than 300,000 servers in a wide range
of countries, including Vietnam, India, Italy, Thailand, and Colombia. Each
compromise  has the potential to redirect virtually all connected end users
to malicious websites that attempt to steal banking passwords or push booby-
trapped software, the Team Cymru researchers warned. 

...

The telltale sign a router has been compromised is DNS settings that have
been changed to 5.45.75.11 and 5.45.76.36."

source: "http://arstechnica.com/security/2014/03/hackers-hijack-300000-plus-wireless-routers-make-malicious-changes/"

-- 
I drive a '74 AMC Hornet in my dreams. Also, I really like cheese.
View this thread at http://squte.com/node/4919

Back to comp.misc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

300k+ Home WiFi Routers hijacked (D-Link, Micronet, Tenda, TP-Link) "wjwlsn" <ibillwilson@gmail.com> - 2014-03-03 19:14 -0600
  Re: 300k+ Home WiFi Routers hijacked (D-Link, Micronet, Tenda, TP-Link) RS Wood <rsw@therandymon.com> - 2014-03-05 12:45 +0000

csiph-web