FYI...

- http://blog.washingtonpost.com/securityfix...s_wirele_1.html
June 11, 2008 - "...recent versions of the ubiquitous "Zlob" Trojan (also known as DNSChanger) will check to see if the victim uses a wireless or wired hardware router. If so, it tries to guess the password needed to administer the router by consulting a built-in list* of default router username/password combinations. If successful, the malware alters the victim's domain name system (DNS) records so that all future traffic passes through the attacker's network first. DNS can be thought of as the Internet's phone book, translating human-friendly names like example.com into numeric addresses that are easier for networking equipment to handle. While researchers have long warned that threats against hardware routers could one day be incorporated into malicious software, this appears to be the first time this behavior has been spotted in malware released into the wild. The type of functionality incorporated into this version of the Zlob Trojan is extremely concerning for a number of reasons. First, Zlob is among the most common type of Trojan downloaded onto Windows machines. According to Microsoft, the company's malicious software removal tool [MSRT] zapped some 14.3 million instances of Zlob-related malware from customer machines in the second half of 2007. The other, more important reason this shift is scary is that a Windows user with a machine infected with a Zlob/DNSChanger variant may succeed in cleaning the malware off an infected computer completely, but still leave the network compromised. Few regular PC users (or even PC technicians) think to look to the router settings, provided the customer's Internet connection is functioning fine... Specific, manufacturer-based video tutorials on how to secure your wireless router are available at this link**..."
* http://blog.washingtonpost.com/securityfix/zlobpass.txt

** http://onguardonline.gov/tutorials/index.h...orials-wireless

- http://www.trustedsource.org/blog/42/New-D...ks-into-routers
June 13, 2008 - "...behavior is entirely controlled by the attackers’ DNS servers. These could even redirect existing domain names to servers hosting crafted content (Phishing) or servers dynamically modifying real content. Once your DNS settings are under control, the bad possibilities are nearly unlimited. And, even clean machines are affected once a previous infection on just one client behind the shared router successfully cracked the router login..."

!

This post has been edited by AplusWebMaster: Jun 18 2008, 05:19 AM

FYI...

- http://blog.trendmicro.com/zlob-enters-the...-engine-market/
August 7, 2008 - "More than a year ago, Trend Micro threat researchers uncovered a network of over 900 rogue DNS (Domain Name System) servers related to the ZLOB Trojan family. We gave examples showing that these rogue DNS servers are part of click fraud and leakage of personal information. Just recently, however, we discovered that this network is now targeting four of the most popular search engines. In a large scale click fraud scheme, the ZLOB gang appears to hijack search results and to replace sponsored links with DNS “tricks”... These ZLOB Trojans we found, silently change the local DNS settings of affected systems to use two out of the abovementioned 900+ rogue DNS servers. These Trojans spread by advanced social engineering tricks; an example would be professional-looking Web sites that promise Internet users access to pornographic movies after installing malware that pose as video codecs. The number of ZLOB-related infections is huge — for the last six months of 2007, Microsoft reported more than 14,000,000 infections. It now appears that the ZLOB gang has entered the multibillion-dollar search engine market. ZLOB’s rogue DNS servers resolve several domain names of the main engines to fraudulent IP addresses. Among others, this criminal operation has even set up rogue sites of the UK and Canadian versions of one of the largest search engines. Even searches performed via the installed browser toolbar (provided by the same company) are now being hijacked by ZLOB. Another popular search engine company has been hit even harder — most, if not all, domain names of the search engine that give back search results get resolved to fraudulent Web sites by the rogue DNS servers. The primary objective of ZLOB here appears to be stealing traffic and clicks from search engines, making money along the way. Affected users are immediately redirected to sites that are not at all related to their original search queries. All sponsored search hits of the two main search engines we analyzed were hijacked by ZLOB. Clicks on sponsored links then are not credited to big search engine companies, but to the ZLOB gang instead..."

FYI...

- http://www.viruslist.com/en/analysis?pubid=204792017
Sep 01 2008 - "... most widespread malicious programs... This table shows the malicious programs detected on users’ computers...
1. Trojan.Win32.DNSChanger.ech ..."


'Still around (i.e.):
- http://www.grisoft.com/ww.download-update
IAVI: / 1655 - Added detection of new variant of Win32/Virut, Worm/Brontok,
new variants of trojans DNSChanger, Dropper.Bravix, Downloader.Tiny.
September 5, 2008



This post has been edited by AplusWebMaster: Sep 6 2008, 07:51 AM

FYI...

- http://preview.tinyurl.com/5cg8nh
September 15, 2008 - "...Instead of scouring for anonymous proxies to stay faceless on the internet, cyber criminals are increasingly targeting unsecured Wi-FI networks to get the job done. A combination of war driving tools such as NetStumbler along with a listing of default router usernames and passwords* is all it takes to freely connect to unsecured Wi-FI networks. Especially since most Wi-Fi routers use default security settings that come pre-installed by the vendor rather than it having being configured by the end user. SOHO routers log every connection and DHCP lease but these logs are flushed once the router is rebooted. If an attacker has access to the administrative console of the router (thanks to the default password), once their nefarious actives have been carried out, a simple restart of the router will erase all tracks. The extent to which an unsecured Wi-Fi connection can be abused is purely left to imagination of the attacker..."
* http://www.routerpasswords.com/

FYI...

- http://voices.washingtonpost.com/securityf...wireless_a.html
September 26, 2008 - "...Why is changing the default settings on wireless access point a big deal? Because there are plenty of Web sites that list the default user names and passwords built into every brand of router out there... For instance, if I were looking for an exposed wireless network, I'd probably start by searching the local zip code for the default SSID assigned to many popular routers. After all, these would most likely be the networks powered by users who yanked their shiny new routers straight out of the box and plugged them right into the user's modem without modifying a thing..."
* http://wigle.net/gps/gps/main/ssidstats

FYI...

How to Protect Your Wi-Fi Network from the WPA Hack
- http://lifehacker.com/5079721/how-to-prote...om-the-wpa-hack
Nov 7 2008 - "... a PhD candidate studying encryption has found an exploit in the WPA standard that would allow a hacker to "send bogus data to an unsuspecting WiFi client," completely compromising your Wi-Fi security and opening your network to all sorts of hacking. Lucky for you, it's not terribly difficult to protect yourself against the new exploit.
The key: Just log into your router, switch off Temporal Key Integrity Protocol (TKIP) as an encryption mode, and use Advanced Encryption System (AES) only. TKIP is the only protocol that the hack applies to, so switching to AES-only will ensure that your Wi-Fi network is safe again. It's quick and easy, so do yourself a favor and make the adjustment now so you don't run into any problems in the future."

- http://web.nvd.nist.gov/view/vuln/detail?v...d=CVE-2008-5230
Last revised: 12/03/2008

FYI...

Router-based botnet...

- http://isc.sans.org/diary.html?storyid=6061
Last Updated: 2009-03-24 13:13:59 UTC - "...document (pdf - dated January 11th, 2009) by Terry Baume* goes into detail about how a specific brand of DSL Modem (Netcomm NB5) can be compromised with malicious code that turns the device into a IRC based Bot - named PSYB0T 2.5L. While discovered several months ago, some recent entries on the DroneBL blog that (among further detail into "PSYB0T") state "We came across this botnet as part of an investigation into the DDoS attacks against DroneBL's infrastructure...". It certainly appears that PSYB0T may be alive and kicking! Some further insight into the possibility that this Bot is still evolving (Now Version 2.9L, 3 months later) has been presented on the TeamFurry blog**..."
* http://www.adam.com.au/bogaurd/
** http://www.teamfurry.com/wordpress/2009/03...ps-cpu-devices/

- http://www.dronebl.org/blog/8
"You are only vulnerable if:
• Your device is a mipsel device.
• Your device has telnet, SSH or web-based interfaces available to the WAN
• Your username and password combinations are weak, OR the daemons that your firmware uses are exploitable.
As such, 90% of the routers and modems participating in this botnet are participating due to user-error (the user themselves or otherwise)... Any device that meets the above criteria is vulnerable, including those built on custom firmware such as OpenWRT and DD-WRT. If the above criteria is not met, then the device is NOT vulnerable.

How can I tell if I have been infected?
Ports 22, 23 and 80 are blocked as part of the infection process (but NOT as part of the rootkit itself, running the rootkit itself will not alter your iptables configuration). If these ports are blocked, you should perform a hard reset on your device, change the administrative passwords, and update to the latest firmware. These steps will remove the rootkit and ensure that your device is not reinfected...
Mar-24-2009 ...botnet itself is still active..."

- http://www.theregister.co.uk/2009/03/24/ps...etworking_worm/
24 March 2009

- http://www.eset.com/threat-center/blog/?p=810
March 23, 2009 - "...targets routers and DSL modems..."



This post has been edited by AplusWebMaster: Mar 24 2009, 08:24 AM

FYI...

DD-WRT vuln...
- http://isc.sans.org/diary.html?storyid=6853
Last Updated: 2009-07-22 20:43:54 UTC - "... new vulnerability in DD-WRT that was being reported in the Register at:
http://www.theregister.co.uk/2009/07/21/cr...rt_router_vuln/ .
DD-WRT runs on routers by Linksys, D-Link Buffalo, ASUS and well as other routers. The complete list can be found at:
http://www.dd-wrt.com/wiki/index.php/Supported_Devices
This vulnerability will allow an attacker to run programs with root priviledges on a vulnerable router. More information can be found on the DD-WRT Forum at:
http://www.dd-wrt.com/phpBB2/viewtopic.php...asc&start=0 "

FYI...

SMC router vuln - unpatched
- http://www.wired.com/threatlevel/2009/10/time-warner-cable/
October 20, 2009 - "A vulnerability in a Time Warner cable modem and Wi-Fi router deployed to 65,000 customers would allow a hacker to remotely access the device’s administrative menu over the internet, and potentially change the settings to intercept traffic, according to a blogger who discovered the issue. Time Warner acknowledged the problem to Threat Level on Tuesday, and says it’s in the process of testing replacement firmware code from the router manufacturer, which it plans to push out to customers soon... The vulnerability lies with Time Warner’s SMC8014 series cable modem/Wi-Fi router combo, made by SMC. The device is one of several options Time Warner offers to customers who don’t want to install their own modem and router to use with the company’s broadband service..."

- http://www.f-secure.com/weblog/archives/00001799.html
October 23, 2009



This post has been edited by AplusWebMaster: Oct 23 2009, 06:40 PM