Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #1228 > unrolled thread

300k+ Home WiFi Routers hijacked (D-Link, Micronet, Tenda, TP-Link)

Back to article view | Back to comp.misc

Contents

  300k+ Home WiFi Routers hijacked (D-Link, Micronet, Tenda, TP-Link) "wjwlsn" <ibillwilson@gmail.com> - 2014-03-03 19:14 -0600
    Re: 300k+ Home WiFi Routers hijacked (D-Link, Micronet, Tenda, TP-Link) RS Wood <rsw@therandymon.com> - 2014-03-05 12:45 +0000

#1228 — 300k+ Home WiFi Routers hijacked (D-Link, Micronet, Tenda, TP-Link)

"Researchers said they have uncovered yet another mass compromise of home
and small-office wireless routers, this one being used to make malicious
configuration changes to more than 300,000 devices made by D-Link, Micronet,
Tenda, TP-Link, and others.

The hackers appear to be using a variety of techniques to commandeer the
devices and make changes to the domain name system (DNS) servers used to...
Likely hacks include a recently disclosed cross-site request forgery (CSRF)
that allows attackers to inject a blank password into the Web interface of
TP-Link routers. Other attack techniques may include one that allows
wireless WPA/WPA2 passwords and other settings to be remotely changed.

So far, the attacks have hijacked more than 300,000 servers in a wide range
of countries, including Vietnam, India, Italy, Thailand, and Colombia. Each
compromise  has the potential to redirect virtually all connected end users
to malicious websites that attempt to steal banking passwords or push booby-
trapped software, the Team Cymru researchers warned. 

...

The telltale sign a router has been compromised is DNS settings that have
been changed to 5.45.75.11 and 5.45.76.36."

source: "http://arstechnica.com/security/2014/03/hackers-hijack-300000-plus-wireless-routers-make-malicious-changes/"

-- 
I drive a '74 AMC Hornet in my dreams. Also, I really like cheese.
View this thread at http://squte.com/node/4919

[toc] | [next] | [standalone]

#1261

On Mon, 3 Mar 2014 19:14:04 -0600
"wjwlsn" <ibillwilson@gmail.com> wrote:

> 
> The telltale sign a router has been compromised is DNS settings that have
> been changed to 5.45.75.11 and 5.45.76.36."

I'm glad to know of this vulnerability.  I checked my router and I'm in
good shape, but holy crap, that's a huge security hole and if they own
your router they own damn near everything!

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web