A 100,000-router botnet is feeding on a 5-year-old UPnP bug in Broadcom chips

[microchip]

A recently discovered botnet has taken control of an eye-popping 100,000 home and small-office routers made from a range of manufacturers, mainly by exploiting a critical vulnerability that has remained unaddressed on infected devices more than five years after it came to light.

https://arstechnica.com/information...g-on-a-5-year-old-upnp-bug-in-broadcom-chips/

 

[SMS786]

Researchers from Netlab 360, reported the mass infection late last week, have dubbed the botnet BCMUPnP_Hunter. The name is a reference to a buggy implementation of the Universal Plug and Play protocol built into Broadcom chipsets used in vulnerable devices. An advisory released in January 2013 warned that the critical flaw affected routers from a raft of manufacturers, including Broadcom, Asus, Cisco, TP-Link, Zyxel, D-Link, Netgear, and US Robotics. The finding from Netlab 360 suggests that many vulnerable devices were allowed to run without ever being patched or locked down through other means.

https://arstechnica.com/information...g-on-a-5-year-old-upnp-bug-in-broadcom-chips/

Patch status is still currently unknown from ASUS, I was not able to find any more info from their official channels. If anyone else knows, please chime in.

Another reason to disable UPnP and not look back.

 

[System Error Message]

your router is a hidden terminator
People really need to realise that routers can be vulnerable crappy pieces of hardware, they should hold manufacturers to a higher standard. Cars have NCAP, what do routers have :'( ?

 

[jrmwvu04]

https://www.snbforums.com/threads/consider-disabling-upnp-by-default.11440

 

[thiggins]

Original article has the list of affected routers.
https://blog.netlab.360.com/bcmpupnp_hunter-a-100k-botnet-turns-home-routers-to-email-spammers-en/

 

[ColinTaylor]

Patch status is still currently unknown from ASUS, I was not able to find any more info from their official channels. If anyone else knows, please chime in.

Read the original article. This only applies to ancient devices that were running Broadcom's UPnP stack. This is not applicable to Asuswrt (which uses miniupnpd).

 

[RMerlin]

Patch status is still currently unknown from ASUS, I was not able to find any more info from their official channels. If anyone else knows, please chime in.

Asus does not use Broadcom's UPnP, so there is nothing for them to patch.

 

[SMS786]

Thank you @RMerlin and @ColinTaylor for clarifying. [emoji1360]

 

[sfx2000]

Getting a fair amount of UDP traffic on the WAN side from private addresses lately...

(should never see this on the WAN side - traffic from 192.168.0.0/16, 172.16.0.0/12, or 10.0.0.0/8 - might be useful to some to install an iptables rule on the WAN interface to just drop any traffic from those ranges

see below - AA.B.CCC.DDD is my WAN address...

Time            Source    Rule                                              Source                  Dest                  Proto
===============|=========================================================|=======================|=====================|===
Nov 16 14:40:51    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.11:37310      AA.B.CCC.DDD:35994    UDP
Nov 16 14:40:51    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.10:46267      AA.B.CCC.DDD:39488    UDP
Nov 16 14:40:54    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.11:37310      AA.B.CCC.DDD:35994    UDP
Nov 16 14:40:54    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.10:46267      AA.B.CCC.DDD:39488    UDP
Nov 16 14:40:57    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.11:37310      AA.B.CCC.DDD:35994    UDP
Nov 16 14:40:57    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.10:46267      AA.B.CCC.DDD:39488    UDP
Nov 16 14:41:00    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.11:37310      AA.B.CCC.DDD:35994    UDP
Nov 16 14:41:00    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.10:46267      AA.B.CCC.DDD:39488    UDP
Nov 16 14:41:03    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.11:37310      AA.B.CCC.DDD:35994    UDP
Nov 16 14:41:03    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.10:46267      AA.B.CCC.DDD:39488    UDP
Nov 16 14:41:06    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.11:37310      AA.B.CCC.DDD:35994    UDP
Nov 16 14:41:06    WAN    Block ULA networks from WAN block fc00::/7 (12000)      192.168.62.10:46267      AA.B.CCC.DDD:39488    UDP