Linksys Worm?

[jlake]

Now don't shoot the messenger.

http://arstechnica.com/security/201...inksys-routers-with-self-replicating-malware/

 

[stevech]

Now don't shoot the messenger.

http://arstechnica.com/security/201...inksys-routers-with-self-replicating-malware/

HNAP... is this saying that the vulnerability is within the remote management (WAN side management, a.k.a. cloud managed)??

Says the E1200 era products are victims. Did those older products have the remote management option?

 

[jlake]

HNAP... is this saying that the vulnerability is within the remote management (WAN side management, a.k.a. cloud managed)??

Says the E1200 era products are victims. Did those older products have the remote management option?

I'm not sure which models are affected and which firmware versions. I'll have to take a closer look at it later on.

I'm just using a linksys as a switch so am unaffected, but figured it might be of interest to other forum members or their friends/family/clients if they meet the criteria for exposure.

 

[RMerlin]

Will be interesting to see how Belkin will react. This will be their first real test at handling such security issues in past products AFAIK.

 

[RogerSC]

Here's another article about it:

http://www.computerworld.com/s/article/9246344/_The_Moon_worm_infects_Linksys_routers?source=CTWNLE_nlt_pm_2014-02-14

 

[remixedcat]

all E series linksys as well as some WRT are affected

 

[thiggins]

Official statement from Linksys:

“Linksys is aware of the malware called “The Moon” that has affected select older Linksys E-Series routers and select older Wireless-N access points and routers. The exploit to bypass the admin authentication used by the worm only works when the Remote Management Access feature is enabled. Linksys ships these products with the Remote Management Access feature turned off by default. Customers who have not enabled the Remote Management Access feature are not susceptible to this specific malware. Customers who have enabled the Remote Management Access feature can prevent further vulnerability to their network, by disabling the Remote Management Access feature and rebooting their router to remove the installed malware. Linksys will be working on the affected products with a firmware fix that is planned to be posted on our website in the coming weeks. “