Why sure, I would be happy to help you find literally the very first link in the article, which is in the third paragraph. Since you asked politely and all.
I read all that, I just didnt believe that the end result was that we were supposed to manually check every ASUS router in order to find the vulnerable ones. Seems like it should be limited to certain models/firmwares, or am I missing something still?
PhilipTheBucket@ponder.cat
on 29 May 17:06
collapse
Just read dohpaz42’s comment. They literally copy and pasted for you the relevant text: How to check if you’re infected already, and how to protect yourself in the future (which means apply updates).
Probably because it’s not limited to one or two specific models. Read the article:
The only way for router users to determine whether their devices are infected is by checking the SSH settings in the configuration panel. Infected routers will show that the device can be logged into by SSH over port 53282 using a digital certificate with a truncated key of
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ…
To remove the backdoor, infected users should remove the key and the port setting.
People can also determine if they’ve been targeted if system logs indicate that they have been accessed through the IP addresses 101.99.91[.]151, 101.99.94[.]173, 79.141.163[.]179, or 111.90.146[.]237. Users of any router brand should always ensure their devices receive security updates in a timely manner.
There’s your answer.
thermal_shock@lemmy.world
on 29 May 11:19
collapse
Users of any router brand should always ensure their devices receive security updates in a timely manner.
I like how you’re supposed to get updates from the same company that left the security holes open, or are actively monitoring them.
joshcodes@programming.dev
on 29 May 08:30
collapse
It referenced this btw, which does have the details you’re looking for. Not sure if it updated.
I wish the article can discuss in more detail how to do the things it's suggesting. I've looked for a few mins but there's no easy button to press to block an IP or check for ssh connections
Anyone point me to where to look in Asus settings?
ewigkaiwelo@lemmy.world
on 29 May 11:36
nextcollapse
Maybe see if you router is supported by Openwrt and if so install it and then run an iptable to block those ip’s? But I’ll also wait for an answer/recommendation from an expert
My router wasn’t compromised. If it was, ssh would be set to yes, and the sus key/port would be visible here. Please forgive the ultra paranoid purple boxes.
As far as IP blocking, I’m not sure it’s necessary, but I followed this link. It’s pretty easy to get new IPs, so if the attacker wanted to, they would do that. It’s more important to update your router.
threaded - newest
…and this article doesn’t tell you which models or link to any resources that do? How is this helping?
This affects multiple FW versions and models.
The article does tell you how to check if you are infected, and how to remove the access.
Why sure, I would be happy to help you find literally the very first link in the article, which is in the third paragraph. Since you asked politely and all.
I read all that, I just didnt believe that the end result was that we were supposed to manually check every ASUS router in order to find the vulnerable ones. Seems like it should be limited to certain models/firmwares, or am I missing something still?
Just read dohpaz42’s comment. They literally copy and pasted for you the relevant text: How to check if you’re infected already, and how to protect yourself in the future (which means apply updates).
From article: "Recommendations
Probably because it’s not limited to one or two specific models. Read the article:
There’s your answer.
I like how you’re supposed to get updates from the same company that left the security holes open, or are actively monitoring them.
It referenced this btw, which does have the details you’re looking for. Not sure if it updated.
greynoise.io/…/stealthy-backdoor-campaign-affecti…
I wish the article can discuss in more detail how to do the things it's suggesting. I've looked for a few mins but there's no easy button to press to block an IP or check for ssh connections
Anyone point me to where to look in Asus settings?
Maybe see if you router is supported by Openwrt and if so install it and then run an iptable to block those ip’s? But I’ll also wait for an answer/recommendation from an expert
On my Asus router, the relevent SSH screen is under Administration -> System and looks like this:
<img alt="" src="https://lemmy.ml/pictrs/image/e9c5d3f7-4f4c-4e69-98a4-75a33c055d99.jpeg">
My router wasn’t compromised. If it was, ssh would be set to yes, and the sus key/port would be visible here. Please forgive the ultra paranoid purple boxes.
As far as IP blocking, I’m not sure it’s necessary, but I followed this link. It’s pretty easy to get new IPs, so if the attacker wanted to, they would do that. It’s more important to update your router.
On my router. Adminstration (left menu) -> System (tab) -> Service (section in the page).
If ssh is on and there is a key specified, then you were hacked. Disable ssh (toggle) and remove the key (no idea because mine was off)
And they don’t mention this, upgrade your firmware if its out of date.
Thank you.