Symantec suspects bot in attacks on D-Link routers

Top Stories

Related

• Clues point to Jan. 13 release of Windows 7 beta
• Microsoft releases Vista SP2 beta
• Obama's DHS pick may find support for raising H-1B cap at confirmation hearing
• IBM wants info from Apple execs in Papermaster case
• License server glitch exposes SonicWall users to e-mail security threats
• Report: Former AOL chief exec tries to raise funds to buy Yahoo

• Symantec sees spike in dangerous Microsoft attacks
• Symantec launches integrated antivirus and filter
• Scammers use Symantec, DNS holes to push adware
• P2P worm targets Linux Apache Web servers
• Symantec confirms ActiveX bugs in its own consumer software

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

March 25, 2008 (Computerworld) Suspicious port scanning that's been tracked back to D-Link Inc. routers may mean a worm or bot is on the loose and infiltrating the popular brand's devices using a three-year-old vulnerability, security researchers at Symantec Corp. said today.

The security company issued a warning Monday night to customers of its DeepSight threat notification service saying that there were "reliable reports" of an in-the-wild worm or bot that was attacking, then installing itself, on D-Link routers. By today, however, Symantec had taken a step back.

"After looking into it further, we decided that that was a little misleading," said Oliver Friedrichs, a director of Symantec's security response team. "It's unconfirmed at this point. But we have definitely seen an increase in attack activity, and that activity appears to be coming from other D-Link devices."

In other words, although Symantec's researchers haven't gotten their hands on a worm or bot sample, all the evidence points in that direction. "We suspect that it's a bot," he said.

According to Friedrichs, the attacks against the D-Link routers begin with hackers scanning TCP port 23 for an active SNMP (Simple Network Management Protocol) service, a flaw that first showed up in D-Link router firmware in 2005. "It looks like they're exploiting the SNMP vulnerability to reset and reconfigure the administrative password on the routers," said Friedrichs, perhaps to conduct "drive-by pharming" attacks that change a router's settings so its users are unknowingly directed to bogus or malicious Web sites instead of the real URLs.

"Having port 23 open on the Internet-facing side is a bad idea in general," said Petko Petkov, a prolific penetration tester from the U.K who, with a partner, Adrian Pastor, has published research on hacking routers. "But I guess this is due to the fact that the attacked devices have only one Ethernet port and users can unwillingly expose otherwise privileged services on the Internet."

Router vulnerabilities are up and attacks against routers are on the upswing -- especially attacks that target devices used by consumers and small businesses to create wireless networks, said Friedrichs. "Attackers are increasingly looking beyond the desktop," he said, for new places to install -- and hide -- their malware.

Petkov wasn't shocked to hear of Symantec's warning. "We're not surprised at all, as all embedded-device(s) we have tested so far are vulnerable to all kinds of interesting vulnerabilities," Petkov said in an e-mail today. Nor would creating a worm or bot Trojan be tough. "Anybody can code a worm which attacks routers on a massive scale quite easily. Most of the research information is out there, so it is a matter of putting the pieces of the puzzle together."