PDA

View Full Version : Router eating Worms


Badem
03-26-2009, 05:49 PM
here (http://www.samknows.com/broadband/news/dangerous-router-eating-worm-discovered-in-australia-535.html)

oh Noes

IT specialists in Australia have discovered a botnet that is capable of controlling both routers and cable or DSL modems. The “Psyb0t” or “Network Bluepill” is capable of attacking and infecting around 50 models of routers and modems - including popular Netgear and Linksys models. So far, traditional router protection measures have not managed to stay ahead of the latest version of the cyber worm code and the implications are, if you can’t already imagine, pretty dire.

The ability to both infect and control your internet link to the outside world, as well as any equipment you might have connected to your computer, for starters. We already have TVs linked to broadband, Skype telephone services, traditional broadband and an array of other Internet-based services coming online over the next few years. Unless the cyber worm is stopped in its tracks this could cause mayhem and cost the industry billions of dollars in the short to medium term.

Traditional router security measures have proved to be inadequate with the latest version of the cyber worm code containing 6,000 usernames and 13,000 passwords. These are used to bombard the security system on traditional routers and modems with the worm itself only detectable using specialist software. Many internet users will not be aware that their routers will not necessarily lock out multiple incorrect username or password attempts, which is potentially a huge security risk.


mind you I like Conficker countdown to expire April Fools Day

biggunsar
03-26-2009, 08:21 PM
well that sounds worse than it is.

Basically its saying if your router, can be tunneled into from the outside. Your in trouble. Only if it doesn't disconnect X amount of attempts at entry. Then should ban the IP address.

Here is a solution. Shut off telnet and web admin from the outside TADA. Fixed.

Enable IDS on your firewall. Always put your firewall, before your router. Router with firewall addon's like cisco. Should be avoided. Better to have a seperate firewall, which only does firewall. (reason being, better to have one device compromised that does only one thing. Than have a device that does multiple things compromised) Easier to swap out.

SO a modem->pix->router->switch->workstation senario is best.
It's how I run my home network.