asus 68u port 18017 hack

[snb82828]

I've had someone breaking into my 68u router for some time now. The latest break-in from yesterday was on the 380.64 firmware build in which they have prerouted (port forwarding, even though I have port forwarding switched off) all traffic through ports 18017 (tcp) & 18018 (udp.) Googling asus routers and port 18017 hacks turns up results about an exploit that "...starts by default and binds a pseudo HTTP server on port 18017..."

Any thoughts?

 

[thelonelycoder]

Is the WebUI enabled from WAN?
Don't enable it after you have completely reset, flashed and setup your router from scratch.
See other hacked posts here.

 

[snb82828]

WebUI is and was disabled. Whoever is hacking has spoofed the mac addresses and appears to be attempting to attack the router network "internally." Before the most recent breakin, the logs showed constant denied intrusion attempts from devices on my network using spoofed mac addresses and spoofed ip address(?)

Also, any posts about hacking that I should check out in particular? Thanks.

 

[thelonelycoder]

http://www.snbforums.com/threads/was-my-routers-username-and-password-hacked.36602/

http://www.snbforums.com/threads/malicious-access-only-1-attempt.36577/

http://www.snbforums.com/threads/what-does-this-log-mean-someone-can-login-my-router-easily.36564/

 

[john9527]

Port 18017 and 18018 are used internally by the router when you select 'Redirect to error page' for when the WAN or Link goes down. They are only opened when the WAN is inaccessible.

 

[sfx2000]

Houston - I think we might have a problem here...

This topic has popped up quite a bit in the last couple of days...

 

[snb82828]

I updated firmware to the 380.64 build again just in case, reset to factory settings, and formatted jffs upon reboot. When I logged in 1st time, the port forward settings were still there. So they have made permanent changes to my router so far as I can tell.

AFAIK, there is no convenient way to block ports on the 68U other than telnet which presents its own problems because these port changes will revert to default any time the router is rebooted. I don't want to keep telnet on permanently but toggling this option will reboot the rooter.

 

[RMerlin]

What John said - port 18017 and 18018 aren't exploits, it's when the WAN goes down, and the router puts up an internal redirection page that shows the error message.

 

[sfx2000]

What John said - port 18017 and 18018 aren't exploits, it's when the WAN goes down, and the router puts up an internal redirection page that shows the error message.

@RMerlin, @john9527 - looks like there is an active exploit targeting devices here... the reports here are looking to be a red-flag...

Enough noise to look at things - could be factory... could be something else...

 

[RMerlin]

@RMerlin, @john9527 - looks like there is an active exploit targeting devices here... the reports here are looking to be a red-flag...

Just because some users were compromised doesn't mean that THIS case is also the same thing. The description he gave is completely different, and has nothing to do with a router compromise. It's perfectly normal behaviour when the WAN interface goes down.

 

[thelonelycoder]

With the insight's posted by @RMerlin and @john9527, I'm sorry I caused you do a reset @snb82828.

 

[snb82828]

First of all, thanks for your help to everyone who replied here.
It should be noted that I am extra paranoid because my router was hacked a couple weeks ago using at the time the latest ASUS--but not Merlin--firmware; every sign of intrusion: settings changed, UPnP enabled, strange logins, and worst of all, blatant website redirects.

After I flashed to ASUS-merlin a fortnight ago, things seemed to be okay. The seemingly odd port forwarding messages I noticed yesterday were something I had not seen before and also coincided with some strange activity on my system logs as well as high latency in my internet connection which is normally quite stable. I haven't ruled out an intrusion, but the posts here alleviate some of my concerns. In any case, I appreciate everyone's input and if I see something out of the ordinary I will update this thread.

Happy belated New Year.

 

[snb82828]

Whenever I shutdown my internet connection with the router still on (usually to test some things) and i click on a web browser, instead of opening to the last opened website, the browser defaults to my router address. What is even more odd is that it happens on all my devices (chrome on pc, safari on ipad.) Can someone explain what's going on?

 

[RMerlin]

Can someone explain what's going on?

Already explained in John's post, also my own post.