Malware damaging ASUS routers?

[DJones]

Hint - It wasn't directed at you

I know. I’m being sarcastic and playing the part of the user.

 

[Tech9]

Spammers...

 

[RMerlin]

Back on topic folks.

 

[bennor]

FYI the Asus-Merlin prebeta test builds for 386.14_2 and 388.8_3 are now available. Both have a; FIXED: Security issues in AiCloud (backports from Asus) fix.
Pre-beta test builds

[ 386.14_1 Build(s) ] available build(s)

https://www.asuswrt-merlin.net/test-builds 386.14_2 (xx-xxx-2024) - UPDATED: OpenVPN to 2.6.12. - CHANGED: Enabled Netfilter queue support for SDK6/SDK7 devices (patch by HiHat) - FIXED: Security issues in AiCloud (backports from Asus) - FIXED: CVE-2024-2511, CVE-2024-4741...

www.snbforums.com

386.14_2 (xx-xxx-2024)
- UPDATED: OpenVPN to 2.6.12.
- CHANGED: Enabled Netfilter queue support for SDK6/SDK7
devices (patch by HiHat)
- FIXED: Security issues in AiCloud (backports from Asus)
- FIXED: CVE-2024-2511, CVE-2024-4741, CVE-2024-5535 &
Implicit rejection for RSA PKCS#1 in openssl
(backport from Ubuntu by RSDNTWK)

[ 3004_388.8_3 Build(s) ] available build(s)

https://www.asuswrt-merlin.net/test-builds https://www.asuswrt-merlin.net/download 3004.388.8_4 (xx-xxx-2024) - CHANGED: VPN killswitch will now only be active if the VPN client itself is enabled. If you stop/start the client yourself over SSH, you need to also...

www.snbforums.com

3004.388.8_4 (xx-xxx-2024)
- CHANGED: VPN killswitch will now only be active if the
VPN client itself is enabled. If you stop/start
the client yourself over SSH, you need to also
update the enabled/disabled nvram setting.
- FIXED: Security issues in AiCloud (backports from Asus)
- FIXED: CVE-2024-2511, CVE-2024-4741, CVE-2024-5535 &
Implicit rejection for RSA PKCS#1 in openssl
(backport from Ubuntu by RSDNTWK)

(Yes that is a 388.4 typo in the change log for 388.3)

Note: The above firmware are TEST BUILDS and may have issues or bugs in them so keep that in mind if you are going to install them to mission critical production routers!!!

 

[TheLostSwede]

I'm dyslexic. I read AX-68U as AX86U. Deleted incorrect post.

Yet, the RT-AX68U did get the security update.

 

[jrl64z]

Hi,
Found this Github Page where you can run the script if your router is infected. hope it helps..

GitHub - NCSC-NL/asusrouter-malware-scan: This repository contains a script to check your ASUS router for signs of malware by examining running processes, files, and certain settings.

This repository contains a script to check your ASUS router for signs of malware by examining running processes, files, and certain settings. - NCSC-NL/asusrouter-malware-scan

github.com

 

[Ripshod]

Hi,
Found this Github Page where you can run the script if your router is infected. hope it helps..

GitHub - NCSC-NL/asusrouter-malware-scan: This repository contains a script to check your ASUS router for signs of malware by examining running processes, files, and certain settings.

This repository contains a script to check your ASUS router for signs of malware by examining running processes, files, and certain settings. - NCSC-NL/asusrouter-malware-scan

github.com

Shame it can't actually remove this malware. I'm wondering if this is the same script that came up a while ago, and whether it's been updated for this new malware - there's only ever been two versions and this latest version is October 18th.
Besides, once the router is infected it's obvious without the need to test.

 

[XIII]

Hi,
Found this Github Page where you can run the script if your router is infected. hope it helps..

GitHub - NCSC-NL/asusrouter-malware-scan: This repository contains a script to check your ASUS router for signs of malware by examining running processes, files, and certain settings.

This repository contains a script to check your ASUS router for signs of malware by examining running processes, files, and certain settings. - NCSC-NL/asusrouter-malware-scan

github.com

That’s specific for the two botnet malware families mentioned in this article:

Expert Blog: Consumer routers targeted by multiple botnets

The National Cyber Security Centre (NCSC-NL) has, following an incident response investigation, detected two botnet malware families simultaneously on a consumer router: Alogin botnet malware and TheMoon malware. This blog post explains the investigation and takes a closer look at the two...

english.ncsc.nl

Are these the same as we are discussing here?

 

[Tech9]

If this script can't do anything about it it's like "Congratulations - you router is infected". And then what?