Windows 10: Hackers opening SMB ports on routers to infect PCs with NSA malware

Brink · Nov 28, 2018

Akamai has detected an ingenious malware campaign that alters configurations on home and small office routers to open connections toward internal networks so crooks can infect previously isolated computers.

The way hackers achieve this, Akamai said, is via a technique known as UPnProxy, which the company first detailed in April this year.

The technique relies on exploiting vulnerabilities in the UPnP services installed on some routers to alter the device's NAT (Network Address Translation) tables.

NAT tables are a set of rules that control how IPs and ports from the router's internal network are mapped onto a superior network segment --usually the Internet.

In April, hackers were using this technique to convert routers into proxies for regular web traffic, but in a report published today, Akamai says it's seen a new variation of UPnProxy where some clever hackers are leveraging UPnP services to insert special rules into routers NAT tables.

These rules still work as a (proxy) redirections, but instead of relaying web traffic at the hacker's behest, they allow an external hacker to connect to the SMB ports (139, 445) of devices and computers located behind the router, on the internal network.

OVER 45,000 ROUTERS ALREADY INFECTED

Akamai experts say that from the 277,000 routers with vulnerable UPnP services exposed online, 45,113 have already been modified in this recent campaign.

Researchers say that one particular hacker, or hacker group, has spent weeks creating a custom NAT entry named 'galleta silenciosa' ('silent cookie/cracker' in Spanish) on these 45,000 routers.
Click to expand...

Read more: Hackers are opening SMB ports on routers so they can infect PCs with NSA malware | ZDNet

See also: https://blogs.akamai.com/sitr/2018/1...alsilence.html

:)

Borg 386 · Nov 28, 2018

US takes aim at Russian hackers who infected over 500,000 routers

More than half a million routers and network devices in 54 countries have been infected with sophisticated malware, researchers from Cisco's Talos Intelligence Group warn.

The malware, which the security researchers are calling VPNFilter, contains a killswitch for routers, can steal logins and passwords and can monitor industrial control systems.
Click to expand...

Talos researchers are still looking into how the malware infects routers but said that routers from Linksys, MikroTik, Netgear and TP-Link are affected.

Netgear said it's aware of VPNFilter and advises its users to update their routers.

"Netgear is investigating and will update this advisory as more information becomes available," a spokesman said in an emailed statement.

The other three network companies didn't respond to a request for comment.
Click to expand...

"It has destructive capability. The malware's flexible command structure gives the adversary the ability to use it to 'brick' these devices. That's not a capability usually built into malware like this," Cyber Threat Alliance President Michael Daniel said.

Talos is recommending that people reset their routers to factory defaults to remove the potentially destructive malware and update their devices as soon as possible.
Click to expand...

US takes aim at Russian hackers who infected over 500,000 routers - CNET

bruinator · Nov 28, 2018

steps taken for infected Pc's.

I was hoping someone could give me a list of step by step instructions you use as a guide to clean virus, malware...etc. so I can keep my PC clean if it gets infected.

thx

IggSter · Nov 28, 2018

How to factory reset Cisco 1700 Router

Hopefully I can help you here....its a very common thing to happen.

First, I take it you dont know the passwords for console access or telnet/ssh?

I will assume that these devices belong to you.

step 1. Plug a cisco console cable into a serial port on your pc
step 2. Plug other end into Cisco console port
step 3. Using hyperterm or putty or similar connect to the serial port
step 4. boot router, and make sure you clearly can see the output (this confirms you have good serial comms)
step 5. if this fails, adjust the comm port settings (9600, 8,1,n are the default)
step 6. now you have to do the only hard part...send the break command:

Break command list: Break Commands

Go down the list and match your OS and SW and try the sequence suggested.

If this fails several times do what I do: Install putty (free) and then to send a break so you can get into rommom just hit "ctrl-a b".

Windows 10: Hackers opening SMB ports on routers to infect PCs with NSA malware

Hackers opening SMB ports on routers to infect PCs with NSA malware

Hackers opening SMB ports on routers to infect PCs with NSA malware

Hackers opening SMB ports on routers to infect PCs with NSA malware

Hackers opening SMB ports on routers to infect PCs with NSA malware - Similar Threads - Hackers opening SMB

Infected by malware

Infected by malware

Infected by malware

hacker / malware

hacker / malware

Malware infection

New Nodersok malware has infected thousands of PCs

CIA Infection of Routers

SMB exploitable by malware?