…and this article doesn’t tell you which models or link to any resources that do? How is this helping?
From article: "Recommendations
- Check ASUS routers for SSH access on TCP/53282.
- Review the authorized_keys file for unauthorized entries.
- Block the four IPs listed above.
- If compromise is suspected, perform a full factory reset and reconfigure manually."
This affects multiple FW versions and models.
The article does tell you how to check if you are infected, and how to remove the access.
researchers from security firm GreyNoise reported Wednesday
Why sure, I would be happy to help you find literally the very first link in the article, which is in the third paragraph. Since you asked politely and all.
I read all that, I just didnt believe that the end result was that we were supposed to manually check every ASUS router in order to find the vulnerable ones. Seems like it should be limited to certain models/firmwares, or am I missing something still?
Just read dohpaz42’s comment. They literally copy and pasted for you the relevant text: How to check if you’re infected already, and how to protect yourself in the future (which means apply updates).
It referenced this btw, which does have the details you’re looking for. Not sure if it updated.
https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers
Probably because it’s not limited to one or two specific models. Read the article:
The only way for router users to determine whether their devices are infected is by checking the SSH settings in the configuration panel. Infected routers will show that the device can be logged into by SSH over port 53282 using a digital certificate with a truncated key of
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ… To remove the backdoor, infected users should remove the key and the port setting.
People can also determine if they’ve been targeted if system logs indicate that they have been accessed through the IP addresses 101.99.91[.]151, 101.99.94[.]173, 79.141.163[.]179, or 111.90.146[.]237. Users of any router brand should always ensure their devices receive security updates in a timely manner.
There’s your answer.
Users of any router brand should always ensure their devices receive security updates in a timely manner.
I like how you’re supposed to get updates from the same company that left the security holes open, or are actively monitoring them.
I wish the article can discuss in more detail how to do the things it’s suggesting. I’ve looked for a few mins but there’s no easy button to press to block an IP or check for ssh connections Anyone point me to where to look in Asus settings?
On my Asus router, the relevent SSH screen is under Administration -> System and looks like this:
My router wasn’t compromised. If it was, ssh would be set to yes, and the sus key/port would be visible here. Please forgive the ultra paranoid purple boxes.
As far as IP blocking, I’m not sure it’s necessary, but I followed this link. It’s pretty easy to get new IPs, so if the attacker wanted to, they would do that. It’s more important to update your router.
On my router. Adminstration (left menu) -> System (tab) -> Service (section in the page).
If ssh is on and there is a key specified, then you were hacked. Disable ssh (toggle) and remove the key (no idea because mine was off)
And they don’t mention this, upgrade your firmware if its out of date.
Thank you.
Maybe see if you router is supported by Openwrt and if so install it and then run an iptable to block those ip’s? But I’ll also wait for an answer/recommendation from an expert
deleted by creator
Not that stealthy. It adds its ssh key where the user can see it (and remove it) in the control panel. Sounds like they’re hoping router owners won’t look there, which, yeah, they usually won’t, but they will if they’re alerted to the situation.
