KineticSloth
Occasional Visitor
So I just got a new GT-AX6000 to replace my RT-AC66_BU a couple months ago. A couple weeks ago, I got a hang up call on our fiber digital phone land line, and my wifi disconnected. About 4-5mins later, same number called & hung up again. About that time, since I couldnt reconnect to the wifi, I did a power-off reboot of the router. When it rebooted, I was able to get into the Admin pages. I looked thru the syslog, and saw stuff I've never seen before for just a reboot. Namely, that apparently, two seperate firmware files were uploaded & installed to the ROM chip. Both filenames were in a format I've not seen Asus/Asus Merlin use. The first started with "Blackfin", the 2nd was "Longfin". Also for a simple reboot, & even a standard firmware update, the syslog seemed *really* long, and again, had a ton of stuff I've never seen before.
So, over the next hour or so, I first tried to turn off the wifi, thinking maybe wifi was compromised, and I wanted to shut it off, then use ethernet to continue digging into my settings & config. However, when I turned off the 2.4G wifi, & hit apply, the router rebooted, and after, I couldnt connect to wifi again, and apparaently my 5G SSID had been changed, to "ASUS_XX", and was completely open, with no security/password assigned. So I powered it down, connected by ethernet, rebooted, and the 5G SSID had changed yet again to "Moving Castle". Checking the log again, it again re-flashed both firmware files. I immediately went to turn off the 5G, but hitting "Apply" and after a reboot again, the 5G SSID then changed to "Sam15". And again, the firmware was flashed again. At that point, i just disconnected it, left it off, and took it to a friend's house a week later.
I was then able to ethernet in, and reflash the latest AsusMerlin, and everything "seems" to be working normally. I havent tried hooking it up at home, to *my* fiber modem yet, tho.
Just wondering if it may have been hacked & now has backdoors installed.. ?? Gonna probably call Asus directly & see what they say.
I do have a copy of the first three syslogs, from when this first happened. I've scrubbed the first one for my IPs & MAC addresses, so i can share it if someone really knowledgeable with Merlin wants to poke it.
EDIT: Oh!, also, right before the weird phone call, then this all happening, my syslog shows my SmartTV was being authorized/deautherized, every hour, right up to just a few minutes before the phone call and the weird stuff happening..?? I just read another thread, where people are discussing the possibility of a recent IoT botnet attack/hack? Also, involving GT-AX600's?
Thanx for any thoughts or help.
So, over the next hour or so, I first tried to turn off the wifi, thinking maybe wifi was compromised, and I wanted to shut it off, then use ethernet to continue digging into my settings & config. However, when I turned off the 2.4G wifi, & hit apply, the router rebooted, and after, I couldnt connect to wifi again, and apparaently my 5G SSID had been changed, to "ASUS_XX", and was completely open, with no security/password assigned. So I powered it down, connected by ethernet, rebooted, and the 5G SSID had changed yet again to "Moving Castle". Checking the log again, it again re-flashed both firmware files. I immediately went to turn off the 5G, but hitting "Apply" and after a reboot again, the 5G SSID then changed to "Sam15". And again, the firmware was flashed again. At that point, i just disconnected it, left it off, and took it to a friend's house a week later.
I was then able to ethernet in, and reflash the latest AsusMerlin, and everything "seems" to be working normally. I havent tried hooking it up at home, to *my* fiber modem yet, tho.
Just wondering if it may have been hacked & now has backdoors installed.. ?? Gonna probably call Asus directly & see what they say.
I do have a copy of the first three syslogs, from when this first happened. I've scrubbed the first one for my IPs & MAC addresses, so i can share it if someone really knowledgeable with Merlin wants to poke it.
EDIT: Oh!, also, right before the weird phone call, then this all happening, my syslog shows my SmartTV was being authorized/deautherized, every hour, right up to just a few minutes before the phone call and the weird stuff happening..?? I just read another thread, where people are discussing the possibility of a recent IoT botnet attack/hack? Also, involving GT-AX600's?
Thanx for any thoughts or help.
Last edited:
