Home & Small Office Wireless Routers Exploited to Attack Gaming Servers
Summary: Unit 42 discovered an updated Gafgyt variant, derived from the JenX botnet, that exploits remote code execution flaws in Zyxel P660HN-T1A, Huawei HG532, and Realtek RTL81XX wireless routers to recruit them into a botnet. The variant combines CVE-2017-18368, CVE-2017-17215, and CVE-2014-8361 into a single sample, and Shodan scans show more than 32,000 WiFi routers potentially vulnerable to these exploits worldwide.
What's compelling: The malware uses exploits rather than dictionary attacks, so disabling telnet and setting strong passwords does not stop it, and once a router is enrolled it receives commands including VSE attacks against Valve Source engine game servers and KILLER/KILLATTK routines that remove competing botnets from the same device.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2014-8361CVE-2017-17215CVE-2017-18368
- Related
- IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vulnerability Cyber Risks ·Mirai Compiled for New Processors Surfaces in the Wild Cyber Risks ·