Sign in / up

back to article Home routers co-opted into self-sustaining DDoS botnet

Hackers have established "self-sustaining" botnets of poorly secured routers, according to DDoS mitigation firm Incapsula. The hijacked routers – located mostly in Thailand and Brazil – were easy pickings for hackers because of the use of factory-default usernames and passwords. Knowledge of these login credentials allowed …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *
  1. Ole Juul

    Class action?

    I don't know about Thailand and Brazil, but it seems to me that in North America it would be possible to sue the manufactures for putting the purchaser, indeed the public, at risk. All we need is someone to lead the charge with a class action suit. The problem is well reported and the manufacturers know about it. I realize that this is not a matter of life and death, but I see a lot of similarity with the recalls to which automobile manufacturers are subject.

    5 3 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Class action?

      Depends on who the target of the botnet is… if it attacks a SCADA system somewhere, or perhaps an emergency services call centre, it very well could be life and death.

      I'm normally not a fan of class action type suits, but so far the home router industry has stuck its collective fingers in its ears and yelled "La la la NOT LISTENING!!!" so having a pound of flesh extracted via the courts might make them take notice.

      10 0 Reply
      1. tom dial Silver badge
        Reply Icon

        Re: Class action?

        Why should the guilt or innocence of a manufacturer ride on the choice of target by criminals who subvert routers made by the manufacturer? Is it not more that the manufacturer may be guilty if there are unpatched vulnerabilities in their equipment, or not, if the vulnerability arose from ISP or user failure to set a proper password?

        0 0 Reply
    2. Richard Jones 1
      Reply Icon
      FAIL

      Re: Class action?

      While I find the loony tunes aspects of some class action cases abhorrent, the idea here would be to prise action out of a derelict equipment builder. As such I feel that such an action would be entirely reasonable.

      It would be far better if the makers of really sordidly, useless junk got active and thought about more than their next bonus cheque. If they have built the things down to a price point too far below reason that is not a defence, it is a reason for them to leave the market place.

      6 0 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Class action?

        But then what happens when it's learned the cost to do it reasonable would price ANY home router out of the affordability range? What if the average home user can ONLY afford an insecure router?

        0 7 Reply
        1. Tom Maddox Silver badge
          Reply Icon
          Linux

          Re: Class action?

          "But then what happens when it's learned the cost to do it reasonable would price ANY home router out of the affordability range? What if the average home user can ONLY afford an insecure router?"

          Your average home router is cheap commodity hardware presumably running a cut-down version of an open operating system such as Linux or *BSD. The effort involved to a) harden the OS and b) give each router a unique, difficult admin password should be minimal. These tasks are solved problems and should not raise the cost of a router by more than pennies. If they do, the vendor deserves to be priced or sued out of the market.

          11 0 Reply
          1. Wim Ton
            Reply Icon

            Re: Class action?

            Adding individual passwords on a mass produced product surely will increase the cost. You need an extra printing station on the assembly line to print it on the case or the logistic process to put the paper with the password in the same box as the matching router.

            0 0 Reply
            1. Anonymous Coward
              Reply Icon
              Anonymous Coward

              Re: Class action?

              @ Wim Ton "You need an extra printing station on the assembly line to print it on the case"

              It is usually printed on the same sticker as the MAC address and serial number.

              0 0 Reply
        2. Anonymous Coward
          Reply Icon
          Mushroom

          Re: Class action?

          But then what happens when it's learned the cost to do it reasonable would price ANY home router out of the affordability range? What if the average home user can ONLY afford an insecure router?

          Yes, it'll probably make the devices more expensive, thing is, WE as in the TECHNICALLY COMPETENT subset of the industry, are FED UP with CHEAP SHITE that winds up costing EVERYONE.

          These routers feature coding and configuration errors that I'd expect schoolboys to make. Some of them aren't actually cheap routers either. I've seen industrial-rated kit priced close to four figures that feature shockingly bad security holes. (I'm looking at you, Netcomm!)

          Botnets like the ones described in this article ultimately hurt everyone. Not just the victim who cops the DDoS, but also the owners of the routers compromised, who no doubt are wondering why they are burning through quota so quick.

          If they want to cut costs, I have a suggestion: outsource your firmware images to the open-source community. Work with us, not against us.

          2 0 Reply
  2. x 7

    so how do you identify a hacked device? Thats the key bit of - missing - info

    3 0 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Probably with a net sniffer. Anything else and the router can lie.

      0 0 Reply
    2. Anonymous Coward
      Reply Icon
      Anonymous Coward

      If your devices comes with generic default user/pasword (such as admin/admin or Admin/password) which is shared with other devices by the same or other manufacturrs. Then it is vulnerable.

      If you left the password that way and had it running for more than an hour, then it is probably already hacked.

      If it ever had external or wifi accessible admin access. Then it definitely is already hacked.

      You can work around infection by downloading the latest firmware for it and perform the "upgrade firmware" process. Even if the latest firmware version is the same as what the device is reporting it already has.

      If the problem remains or returns, go and buy some better hardware. Its hard to find any which is properly safe out of the box (install CeroWRT, OpenWRT, or related firmware for that), but getting even close is worth the effort.

      2 1 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        "You can work around infection by downloading the latest firmware for it and perform the "upgrade firmware" process. Even if the latest firmware version is the same as what the device is reporting it already has."

        Assuming the malware hasn't blocked the upgrade function. Smart malwares do that to make sure they can't be erased short of a hardware reset which reloads the baseline firmware from a ROM chip.

        "If the problem remains or returns, go and buy some better hardware. Its hard to find any which is properly safe out of the box (install CeroWRT, OpenWRT, or related firmware for that), but getting even close is worth the effort."

        And if none are affordable, or the OpenWRT firmwares themselves get pwned, it means bye-bye Internet?

        0 0 Reply
        1. Dan 55 Silver badge
          Reply Icon

          If OpenWRT gets pwned you use the software installer page to download the updated module.

          0 0 Reply
      2. tom dial Silver badge
        Reply Icon

        If you failed to follow the manufacturer's advice about changing the default password, it is not the manufacturer's fault.

        If you turned it on with external or wifi admin access enabled, irrespective of whether you changed the password, it is not the manufacturer's fault unless they shipped it with those options, and then only if they failed to provide reasonable password changing advice.

        If the manufacturer shipped with external/wifi administration enabled, and failed to provide clear (US eighth grade level) instructions for changing the default password and administrative configuration, there probably is a reasonable case.

        The last time I did it, installing alternative firmware is a seriously nontrivial operation for most home consumers.

        2 0 Reply
        1. TonyJ
          Reply Icon

          I agree with all of your comments, except:

          "...If you turned it on with external or wifi admin access enabled"

          Every single home or SoHo router I've ever bought over the last xx years has shipped with WiFi enabled and a default username and password along the lines of admin and password.

          Along with that, they have a DHCP server running.

          I would say though, that if it's not internet connected yet, the window to do anything nefarious at that point is staggeringly narrow (until they start using the hacks to actively scan for other, unprotected, devices in the neighbourhood).

          2 0 Reply
          1. Anonymous Coward
            Reply Icon
            Anonymous Coward

            Re: I agree with all of your comments, except:

            "Every single home or SoHo router I've ever bought over the last xx years has shipped with WiFi enabled and a default username and password along the lines of admin and password.

            Along with that, they have a DHCP server running."

            Because the average consumer wants to get up and running. They don't care about the under-the-hood stuff the way they don't worry about how the car runs. You want security in a home router? You MUST make it turnkey easy; otherwise, people will just ignore it or go the Post-It route.

            Find a way to make a functionally secure (meaning people will be able to do what they do now without having to worry about malware and the like) computing device for the technologically-illiterate (meaning turnkey-easy turn it on and let it go) and you'll probably be the next Bill Gates.

            "If OpenWRT gets pwned you use the software installer page to download the updated module."

            Assuming the malware didn't block the installer so that it can't be uprooted.

            0 0 Reply
  3. Leeroy

    BT with the stickers

    I would like to know how BT, Plusnet and others that supply handy credit sized cards, stickers or in the case of BT a plastic thingy that you can pull out of the wifi router would respond to this ?

    Do I really need to tell my customers, family etc to throw all those handy reminders away and change the passwords? I don't know anyone that has changed then from default because the cards etc are Just there and (the assumption is that they are unique) easy to access.

    What happens if the isp 'looses' the details ? They will have a record of them or maybe the company that prints the stickers will etc.

    0 2 Reply
    1. Doctor Syntax Silver badge
      Reply Icon

      Re: BT with the stickers

      The plastic thingies, at least the PlusNet ones, appear to be individually printed so I assume that the passwords are individually set so it wouldn't be a problem. However I reset mine anyway. But if you do that don't throw the card away; if you reset the router it goes back to the factory settings & you'll need the card again.

      2 0 Reply
      1. John Robson Silver badge
        Reply Icon

        Re: BT with the stickers

        Individual != Random

        0 1 Reply
  4. All names Taken
    Paris Hilton

    Hmmm! Right on doodz!

    Speechless?

    0 0 Reply
  5. Nunyabiznes

    Possibility

    RE: Class Action

    This is probably only specific to the US (because that's the legal system I "know") but the best way to do it would be to remote kill the US based rogue routers remotely and force the manufacturers to replace the equipment *and* refund the original MSRP of the device. The replacement routers should stop setup at "change admin password" screen and not allow internet connectivity until the password was changed to something with a base level of complexity - which is how they should be sent out to start with.

    I know this would dramatically increase the calls to support and returns of product because people are too stupid to RTF setup instructions, but we all have to take responsibility for the parts we played in what the internet has become.

    1 0 Reply
    1. Dan 55 Silver badge
      Reply Icon

      Re: Possibility

      Something a bit simpler surely? I thought the majority of routers supplied by ISPs were set up to receive updates from the ISP, even though in practice they hardly ever push them out.

      0 0 Reply
      1. Nunyabiznes
        Reply Icon

        Re: Possibility

        I was assuming this included all the el cheapo "routers" that can be bought to extend the capabilities of your home internet connection. I just installed DSL at home and the router I bought that was CenturyLink branded came with a random strong password, but you had to connect it to the home office before setup could continue. Mixed bag. The little wifi extender I bought to accompany it had a generic password - not cool, but I could change it before connecting to my ISP router. The question is how many typical home users are going to do that and the answer is not 0 but certainly not a statistically significant number.

        0 0 Reply
  6. Anonymous Coward
    Mushroom

    Re: "because ISPs, vendors and users have all disregarded..."

    I would say that the manufacturers of the routers themselves should too take a large portion of the blame because they are the ones allowing their routers to operate with predictable default passwords. It should be mandatory for routers to be shipped in a state such that either:

    (A) The default password is its serial number or a random string printed on the router, or;

    (B) The router intercepts any HTTP request and forwards the user to a page which demands that the default password be changed before allowing the user to proceed.

    And likewise all inbound connections into the router from the internet should be blocked by default and Wi-Fi too should be locked down as per my points above and there should be absolutely no way to configure Wi-Fi as open/unencrypted because there is almost never a good reason for doing so.

    Are these points really that difficult to implement?

    7 0 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: "because ISPs, vendors and users have all disregarded..."

      "and there should be absolutely no way to configure Wi-Fi as open/unencrypted because I almost never have a good reason for doing so therefore nobody else does either."

      There, fixed it for you.

      2 2 Reply
    2. Richard 12 Silver badge
      Reply Icon

      Re: "because ISPs, vendors and users have all disregarded..."

      Serial numbers are predictable, thus useless as passwords.

      Heck, with a little thought you can probably work out the serial number from the public MAC, as the two will be directly related in most high-volume products.

      The default password simply has to be truly random, with a good source of genuine entropy.

      The majority of home users will never change the password, many won't even realise they can.

      0 1 Reply
      1. Dan 55 Silver badge
        Reply Icon

        Re: "because ISPs, vendors and users have all disregarded..."

        If it's truly random then it's difficult to print something which goes along with the router which tells the user what the default password is, particularly because you won't get genuine entropy until the router has been turned on and had chance to set up wifi and ADSL.

        Not allowing outside administrator access to all and sundry using default/predictable passwords would do the trick.

        1 0 Reply
        1. Anonymous Coward
          Reply Icon
          Anonymous Coward

          Re: "because ISPs, vendors and users have all disregarded..."

          "Not allowing outside administrator access to all and sundry using default/predictable passwords would do the trick."

          But don't forget what Douglas Adams once wrote. Bet you if you tried this approach, help desks and geeks would have their phones ringing off the hook. They just want the Internet to work, and this gets in the way.

          0 0 Reply
  7. Anonymous Coward
    Anonymous Coward

    This all happens because

    they are hardware vendors and this is how they make their money. Writing and maintaining software is a waste of time for them.

    0 0 Reply
  8. TonyJ

    Sky

    Do Sky still ship all of their routers with the default sky username and password?

    To correct my own post above - I'd forgotten, like Leeroy pointed out, that BT do indeed ship what appears to be an individually printed set of details.

    1 0 Reply
    1. Alan Brown Silver badge
      Reply Icon

      Re: Sky

      "BT do indeed ship what appears to be an individually printed set of details."

      Having seen a few of them, they're clearly agorithmically derived. If you know the MAC, you can pwn the box.

      0 0 Reply
      1. x 7
        Reply Icon

        Re: Sky

        that was a known issue with the earlier Home Hubs and - eventually - BT overcame it on newer models by enforcing an admin password change the first time you log on to configure the thing. The default password is only there to give you access if you have to set it back to defaults - in which case next time it will enforce another change

        This only applies to the admin password - not the WPA password

        0 0 Reply
  9. heyrick Silver badge

    it’s going to be damn near impossible for the home user to recover

    Wow. Some things Orange (France) got right!

    Switching on while pressing the reset button (or something like that) starts an emergency bootloader to download and flash the main firmware.

    While WiFi is active out of the box, the non-hotspot side uses either a long security key or WPS but in either case even with the right password you need to press the WiFi button before a device will be accepted (though I wonder if you could trick the box by faking a MAC?).

    It used to be that the default way to the admin console was "admin" and "admin"; this has now changed to be "admin" and some part of your WiFi security key (the default being specific to each box). I should point out that this is user side admin. There is no root access. The original Livebox had an open telnet server with the root password being something dumb like 1234 but that got stamped upon pretty quickly. As far as I'm aware there is no way in now even if you hook up a serial connection internally; it may even be that the root password changes with each box?

    0 0 Reply
  10. Nigel 11

    Countermeasures

    Routers etc. should have an effective "revert to factory" mechanism. At a minimum, this requires a switch that will boot (from uncompromisable ROM) a program that will rewrite the device's flash. Two options. One, to a ROM copy of the firmware with which the device was originally shipped. The other, to download updated and securely signed firmware from the manufacturer's site.

    Then when an issue like this arises, tell home users to reload their firmware by using a physical button on the box.

    Note, "reset to factory" as usually implemented is the exact opposite of what I'm suggesting. It normally resets the configuration data to factory, while leaving the code unchanged. One should be able to reset the code, while leaving the configuration data alone.

    1 0 Reply
    1. Charles 9
      Reply Icon

      Re: Countermeasures

      Well, most aftermarket routers I know have three different reset conditions. One is the standard reset, which just warm boots the router in case it gets stuck or something. The second is as you say, Reset to Defaults, which is used in case a configuration change you made bricks the router or locks you out. The third one is the one you want, Reset to Stock, which should reflash the firmware with a baseline version out of ROM. I know the last two routers I bought had all three options, and since the last one is hardware-based, it's immune to malware.

      0 0 Reply

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like