There have been quite a few news stories released over the past few days regarding a wide scale compromise of 300,000 Internet gateway devices.
Chris Brenton, director of security at Dyn explains what happened, how to check if you are vulnerable and what you can do to fix it.
What’s the big deal?
Security researchers Team Cymru have discovered a set of compromised servers which suggest at least 300,000 home routers, firewalls and Internet connection devices have been compromised by attackers. Note that this problem could actually be much larger, as it appears this was only a single set of malicious actors. There could be other nefarious groups that are using the same techniques, but were not detected during Team Cymru’s study.
What’s effected?
Team Cymru has identified hardware from the following vendors as being compromised:
– D-Link
– Micronet
– Tenda
– TP-Link
– Other unnamed vendors
If you use any of these devices, you should check it to ensure your device has not been compromised.
How did the attackers break in?
It appears the attackers have been using a combination of known exploits and configuration issues. This is helpful as it means that if you install all security patches and properly configure your device, you will most likely be safe from attack.
How Do I check my device?
Once a device is compromised, the attackers change the DNS settings on the device so that all requests for Internet hosts run through servers they control. This permits them to hijack sessions at their whim. So the key here is to identify if your DNS settings have been changed.
The best way is to logon to your device via the administrative interface and check the DNS settings. How to do this, and where the settings are located, will vary from device to device. The malicious actors in this attack were redirecting all DNS to the IP addresses 5.45.75.11 and 5.45.76.36. So if you see these addresses, you have a problem. However what you really want to verify is whether you DNS settings have been changed at all, because a different set of malicious actors may be using different IP addresses. Most people set this value to whatever their Internet Service Provider (ISP) tells them to use. If you are unsure what this should be, contact your ISP’s support group.
But I don’t know how to logon to my router!
The router is the best place to check these settings and if you have a problem, you will ultimately need to gain access. Try doing a Google search on your device’s make and model with a keyword such as “administrative access” or similar. That should produce some useful information.
However when the DNS on your router gets changed, it will usually change the DNS info on your local systems as well. So you may be able to check one or more of your local systems to see if they are properly configured. For example on a Windows system, run the command:
ipconfig /all | more
Look through the output for the “DNS Servers” setting. If you have Linux or Mac based systems, open a command prompt and run the command:
cat /etc/resolv.conf
Again, check to see if the value is set to the proper IP addresses.
[wp_ad_camp_4]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.