A wide range of routers are under attack by new, unusually sophisticated malware

[Moogle Stiltzkin]

An unusually advanced hacking group has spent almost two years infecting a wide range of routers in North America and Europe with malware that takes full control of connected devices running Windows, macOS, and Linux, researchers reported on Tuesday.

So far, researchers from Lumen Technologies' Black Lotus Labs say they've identified at least 80 targets infected by the stealthy malware, infecting routers made by Cisco, Netgear, Asus, and DayTek. Dubbed ZuoRAT, the remote access Trojan is part of a broader hacking campaign that has existed since at least the fourth quarter of 2020 and continues to operate.

A high level of sophistication

The discovery of custom-built malware written for the MIPS architecture and compiled for small office and home office routers is significant, particularly given its range of capabilities. Its ability to enumerate all devices connected to an infected router and collect the DNS lookups and network traffic they send and receive and remain undetected is the hallmark of a highly sophisticated threat actor.

"While compromising SOHO routers as an access vector to gain access to an adjacent LAN is not a novel technique, it has seldom been reported," Black Lotus Labs researchers wrote. "Similarly, reports of person-in-the-middle style attacks, such as DNS and HTTP hijacking, are even rarer and a mark of a complex and targeted operation. The use of these two techniques congruently demonstrated a high level of sophistication by a threat actor, indicating that this campaign was possibly performed by a state-sponsored organization."

The campaign comprises at least four pieces of malware, three of them written from scratch by the threat actor. The first piece is the MIPS-based ZuoRAT, which closely resembles the Mirai Internet of Things malware that achieved record-breaking distributed denial-of-service attacks that crippled some Internet services for days. ZuoRAT often gets installed by exploiting unpatched vulnerabilities in SOHO devices.

Once installed, ZuoRAT enumerates the devices connected to the infected router. The threat actor can then use DNS hijacking and HTTP hijacking to cause the connected devices to install other malware. Two of those malware pieces—dubbed CBeacon and GoBeacon—are custom-made, with the first written for Windows in C++ and the latter written in Go for cross-compiling on Linux and macOS devices. For flexibility, ZuoRAT can also infect connected devices with the widely used Cobalt Strike hacking tool.

The discovery of this ongoing campaign is the most important one affecting SOHO routers since VPNFilter, the router malware created and deployed by the Russian government that was discovered in 2018. Routers are often overlooked, particularly in the work-from-home era. While organizations often have strict requirements for what devices are allowed to connect, few mandate patching or other safeguards for the devices' routers.

Like most router malware, ZuoRAT can't survive a reboot. Simply restarting an infected device will remove the initial ZuoRAT exploit, consisting of files stored in a temporary directory. To fully recover, however, infected devices should be factory reset. Unfortunately, in the event connected devices have been infected with the other malware, they can't be disinfected so easily.

https://arstechnica.com/information-tec ... d-malware/

[dosborne]

Pretty safe to assume that every public facing device is continually facing attack. The article actually has little value (IMO) as there are no specific devices or resolutions. It seems more like clickbait than useful. The list of potential threats to a home network is pretty long.

Users should have a regular routine to look for patches, updates or alerts on *ALL* their devices. I do this every Sunday, or more often if I have spare time or can't sleep at 2:00am.

[Moogle Stiltzkin]

Siosphere Ars Centurion et Subscriptor
REPLY
2 HOURS AGO
Just another reminder to never trust in-secure sites, always make sure you are browsing the https version of a site, and never accept an invalid certificate.

DNS Hijacking/HTTP Hijacking rely on the end-user either visiting normal http sites, or accepting invalid certificates (unless the attacker has access to the private key information for the valid ssl cert, in which case there isn't anything you can really do to prevent that)

mikeh3 Smack-Fu Master, in training
REPLY
AN HOUR AGO
If you use a browser configured for encrypted/secure DNS, the router should not be able to obstruct DNS calls from the browser. If you use a VPN, the router sees nothing, its a great defense against a hacked router.

If you enter www.something.com and the browser defaults to an HTTP request, then a hacked router can get its infected hands into the request and change it. However, if you either type an HTTPS request or use a bookmark that is HTTPS, the router should not be able to change the request in-flite.

see also RouterSecurity.org

in chrome, u can set to auto use https. so u no longer needs an addon like httpseverywhere, because chrome can do this now, but u have to check ur settings that it is enabled.

and best stay ontop of router updates. some people don't even check, but i do :X also some brands are terrible at patch releases, this is why i suggest sticking to a brand with a good security release practise. personally i stick to pfsense, cauz i rarely hear bad things about them on the security front. if ur on asus router, maybe check out rtmerlin becauz he usually releases frequent patches for his third party firmwares, and he tends to keep his firmware as close to stock as possible so it doesn't break features like nat acceleration among other things.

[dosborne]

If I may make an observation, I know I'm old school, but if find that your posts are often hard to read, therefore hard to interpret for a variety of reasons. My pet peeve would be the spelling. I think it would help *me*, and perhaps others, if you turned on spell check to "correct" 'u' vs 'you', 'ur' to 'your', 'cauz' or 'becauz' to 'because' and a whole myriad of others that are consistent and inconsistently used.

I feel it would help you to be taken more seriously and help my aging mind to understand your posts better and more easily, with little effort (once spell check is on). With all the "noise" I find it hard to find and interpret the "nugget" of information in !any of your posts.

Have you considered changing your alias from "Moogle Stiltzkin" to "Google Stiltzkin"?

Cheers