Flax Typhoon malware affecting ASUS RT-*/GT-*/ZenWifi ???

[TeaDragon]

I am seeing articles about this malware that infected routers, cameras, etc., called "Flax Typhoon", which controlled a massive botnet. The articles all say among the infected devices are
"ASUS RT-*/GT-*/ZenWifi". Does this mean ALL Asus RT routers? I cannot find a list of specific models anywhere, and nothing on the Asus website. Does anyone have any info on this?

Massive China-state IoT botnet went undetected for four years—until now

75% of infected devices were located in homes and offices in North America and Europe.

arstechnica.com

https://www.ic3.gov/Media/News/2024/240918.pdf

 

[tiddlywink]

..

 

[TeaDragon]

@tiddlywink Since not a single one of those CVEs are mentioned in the Joint Cybersecurity Advisory, what relevance is this? Does this mean if any of us have updated firmware, decent passwords, and follow basic security suggestions, then we cannot be affected by Flax Typhoon?

 

[Squall Leonhart]

these devices were infected by exposing configuration services to WAN.

 

[TeaDragon]

these devices were infected by exposing configuration services to WAN.

OH, wow! Thank you for this. It didn't seem clear at all from reading the various articles about this. I am somewhat relieved that I don't have anything exposed.

 

[RMerlin]

There is no official information as to which specific attack vectors were used to infect all these devices. Since the targets are so varied, they are probably just using whatever exploits were available for each individual platforms. This botnet is also many years old, so there's a good chance it relied on old exploits that have been long fixed, in addition to brute force attack on exposed web interfaces.

 

[tiddlywink]

..

 

[sfx2000]

There is no official information as to which specific attack vectors were used to infect all these devices. Since the targets are so varied, they are probably just using whatever exploits were available for each individual platforms. This botnet is also many years old, so there's a good chance it relied on old exploits that have been long fixed, in addition to brute force attack on exposed web interfaces.

I agree - limit the threat surface for exposed services...

First thing is disable WAN side services, and then take a serious look at what is truly needed on the LAN side...

 

[jerry6]

biggest problem is no name routers and IOT crap that never get updates . Keep your things updated and locked down you should be fine