Unexplained 'hacks' into Asus routers

[hggomes]

Is the user "honza" legit?

 

[hggomes]

380.65 / 380.4180:

- Fixed a security vulnerability regarding XSS.
- Fixed a security vulnerability regarding CSRF.
- Added protection for Brute-force attack.

 

[blbeczech82]

Is the user "honza" legit?

Yes. It's my login. This is not usual login for bruteforce password lists so I'm wondering how it was matched on first try

Odesláno z mého SM-G935F pomocí Tapatalk

 

[hggomes]

Simple, the exploit retrieved that information from the router.

 

[blbeczech82]

380.65 / 380.4180:

- Fixed a security vulnerability regarding XSS.
- Fixed a security vulnerability regarding CSRF.
- Added protection for Brute-force attack.

Is this really fix?
Should I completely wipe my nvram and storage before install?

Odesláno z mého SM-G935F pomocí Tapatalk

 

[blbeczech82]

Is this really fix?
Should I completely wipe my nvram and storage before install?

Odesláno z mého SM-G935F pomocí Tapatalk

And my login and password was stolen as readable or just used hashed?

Odesláno z mého SM-G935F pomocí Tapatalk

 

[hggomes]

I'm not 100% sure if that will fix this specific vulnerability, but you can give it a try and check the results, but you would probably need to enabled once again WebUI Remote Access.

 

[hggomes]

And my login and password was stolen as readable or just used hashed?

Odesláno z mého SM-G935F pomocí Tapatalk

You should change the password no matter what.

 

[ColinTaylor]

And my login and password was stolen as readable or just used hashed?

At this moment in time you'd have to assume that they're retrieving them from the router's NVRAM. So they're not hashed, they're plain text!

 

[sfx2000]

So they're not hashed, they're plain text!

Wonderful...

about 20 years back - I hid the user password in an APP.ini file for a Windows app I was working on - at the time, base64 seemed reasonable - and I caught holy hell for that one

Oh well - sins of the fathers...

 

[sfx2000]

Just as an FYI...

hulk says smash - I'm going in thru a Chromebook of all things...

Guest Network enabled... we're going thru the web interface...

I'm posting on the same connection - yes, the unauthenticated connection on the router...

I will not disclose publicly how this was done - but I've access to the HTTP server, and since it runs as root, I've got root..

If there are any forum members also in the San Diego, CA area - I'd like to borrow your router for a couple of days...

I can loan you another AC1900 class router in the interim...

PM me if you want to help out...

 

[RMerlin]

380.65 / 380.4180:

- Fixed a security vulnerability regarding XSS.
- Fixed a security vulnerability regarding CSRF.
- Added protection for Brute-force attack.

Asus fixed some security issues in 380.4180, and I fixed an additional security issue on my own. However I have no way of knowing if any of these fixes from either Asus or myself will cover the recent incident.

In any case, I forwarded what info I had to Asus, and will proceed with backporting all of these fixes in a 380.64_1 release. I just need time to compile and test all of those firmwares (the new PC parts can't get here soon enough!).

 

[eddiez]

Asus fixed some security issues in 380.4180, and I fixed an additional security issue on my own. However I have no way of knowing if any of these fixes from either Asus or myself will cover the recent incident.

In any case, I forwarded what info I had to Asus, and will proceed with backporting all of these fixes in a 380.64_1 release. I just need time to compile and test all of those firmwares (the new PC parts can't get here soon enough!).

I hope the Asus guys will take this one serious. Could potentially be a 'Linksys sized' issue.

 

[blbeczech82]

Just as an FYI...

hulk says smash - I'm going in thru a Chromebook of all things...

Guest Network enabled... we're going thru the web interface...

I'm posting on the same connection - yes, the unauthenticated connection on the router...

I will not disclose publicly how this was done - but I've access to the HTTP server, and since it runs as root, I've got root..

View attachment 8178

If there are any forum members also in the San Diego, CA area - I'd like to borrow your router for a couple of days...

I can loan you another AC1900 class router in the interim...

PM me if you want to help out...

Could you try to "smash" Merlin's new .64_1 in the same way?

Odesláno z mého SM-G935F pomocí Tapatalk

 

[VANT]

Is this really fix?
Should I completely wipe my nvram and storage before install?

Odesláno z mého SM-G935F pomocí Tapatalk

try latest AsusWRT 4180, open webui to wan and watch log.
After install this fw do factory default and configure You router.

 

[sanke1]

Yay! Me too hacked

 

[eddiez]

Yay! Me too hacked

Welcome to the club. Just read through the whole thread to prevent duplicate questions etc.
And this one as well: http://www.snbforums.com/posts/300280/

Running stock or Merlin?

 

[sanke1]

Welcome to the club. Just read through the whole thread to prevent duplicate questions etc.
And this one as well: http://www.snbforums.com/posts/300280/

Running stock or Merlin?

Running latest stock with WAN access enabled.

 

[eddiez]

Running latest stock with WAN access enabled.

You might want to close your WAN access ASAP. Other steps are explained in this thread and the Merlin thread.

@RMerlin So issue is generic.

 

[ColinTaylor]

@RMerlin So issue is generic.

We'd have to see more detailed information from @sanke1 to confirm that it's the same hack and not something different. @sanke1 can we see your syslog please?