• Yer Ma@lemm.ee
    link
    fedilink
    English
    arrow-up
    34
    arrow-down
    9
    ·
    4 days ago

    …and this article doesn’t tell you which models or link to any resources that do? How is this helping?

    • skabbywag02@lemm.ee
      link
      fedilink
      English
      arrow-up
      40
      ·
      4 days ago

      From article: "Recommendations

      • Check ASUS routers for SSH access on TCP/53282.
      • Review the authorized_keys file for unauthorized entries.
      • Block the four IPs listed above.
      • If compromise is suspected, perform a full factory reset and reconfigure manually."
    • PhilipTheBucketOPA
      link
      fedilink
      English
      arrow-up
      15
      ·
      4 days ago

      researchers from security firm GreyNoise reported Wednesday

      Why sure, I would be happy to help you find literally the very first link in the article, which is in the third paragraph. Since you asked politely and all.

      • Yer Ma@lemm.ee
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        3 days ago

        I read all that, I just didnt believe that the end result was that we were supposed to manually check every ASUS router in order to find the vulnerable ones. Seems like it should be limited to certain models/firmwares, or am I missing something still?

        • PhilipTheBucketOPA
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 days ago

          Just read dohpaz42’s comment. They literally copy and pasted for you the relevant text: How to check if you’re infected already, and how to protect yourself in the future (which means apply updates).

    • stoy@lemmy.zip
      link
      fedilink
      English
      arrow-up
      15
      ·
      4 days ago

      This affects multiple FW versions and models.

      The article does tell you how to check if you are infected, and how to remove the access.

    • dohpaz42@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      4 days ago

      Probably because it’s not limited to one or two specific models. Read the article:

      The only way for router users to determine whether their devices are infected is by checking the SSH settings in the configuration panel. Infected routers will show that the device can be logged into by SSH over port 53282 using a digital certificate with a truncated key of

      ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ… To remove the backdoor, infected users should remove the key and the port setting.

      People can also determine if they’ve been targeted if system logs indicate that they have been accessed through the IP addresses 101.99.91[.]151, 101.99.94[.]173, 79.141.163[.]179, or 111.90.146[.]237. Users of any router brand should always ensure their devices receive security updates in a timely manner.

      There’s your answer.

      • thermal_shock@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        4 days ago

        Users of any router brand should always ensure their devices receive security updates in a timely manner.

        I like how you’re supposed to get updates from the same company that left the security holes open, or are actively monitoring them.

  • Hello_there@fedia.io
    link
    fedilink
    arrow-up
    12
    arrow-down
    1
    ·
    4 days ago

    I wish the article can discuss in more detail how to do the things it’s suggesting. I’ve looked for a few mins but there’s no easy button to press to block an IP or check for ssh connections Anyone point me to where to look in Asus settings?

    • Ecco the dolphin@lemmy.ml
      link
      fedilink
      English
      arrow-up
      4
      ·
      4 days ago

      On my Asus router, the relevent SSH screen is under Administration -> System and looks like this:

      My router wasn’t compromised. If it was, ssh would be set to yes, and the sus key/port would be visible here. Please forgive the ultra paranoid purple boxes.

      As far as IP blocking, I’m not sure it’s necessary, but I followed this link. It’s pretty easy to get new IPs, so if the attacker wanted to, they would do that. It’s more important to update your router.

    • bitchkat@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      4 days ago

      On my router. Adminstration (left menu) -> System (tab) -> Service (section in the page).

      If ssh is on and there is a key specified, then you were hacked. Disable ssh (toggle) and remove the key (no idea because mine was off)

      And they don’t mention this, upgrade your firmware if its out of date.

    • ewigkaiwelo@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      4 days ago

      Maybe see if you router is supported by Openwrt and if so install it and then run an iptable to block those ip’s? But I’ll also wait for an answer/recommendation from an expert

  • argv minus one@mastodon.sdf.org
    link
    fedilink
    arrow-up
    1
    ·
    4 days ago

    @PhilipTheBucket

    Not that stealthy. It adds its ssh key where the user can see it (and remove it) in the control panel. Sounds like they’re hoping router owners won’t look there, which, yeah, they usually won’t, but they will if they’re alerted to the situation.