asus router
RELY, which can be exhibited on the campaign, which can be put on the campaign. According to the Cybersecurity company Greynoise. POST, aimed at the ASUS Internet march, using the factory firmware.
Attackers used weak accounting data and two bypassing authentication to access the system. Then they used the vulnerability of the ASUS CVE-2023-39780 router to execute commands.
instead of installing harmful programs, they turned on the SSH access on port 53282, using legal ASUS settings and installed their public SSH key. The changes were recorded in an absurd memory, which means that Backdor is experiencing updating the firmware and rebooting.
registration was disabled before constancy was established, which allowed the attack to fly under the radar.
IP compromise. Image loan: Greynoise
Asus Patched CVE-2023-39780 in a recent firmware update. The necessary circuits of the entrance to the system are also, according to the visible, are considered.
However, the routers are compromised before the update can still be vulnerable if access to SSH has been installed and not removed. And the infection is still present, even after a patch.
how to stay safe
Greynoise recommends the following direct actions for the Router owners.
- Check the presence of SSH access on the TCP/53282 port.
- View the Authorized_keys file for unknown records.
- If a compromise is suspected, complete the plant’s full reset and recruit the device manually. Regular updating the firmware of your router is crucial, since security corrections are often the only protection against known vulnerabilities.
In addition, it is important to change passwords by default both for access to the router and your Wi-Fi network. Use strong, unique passwords to improve safety.
The removal of remote control is another effective measure if you do not need access from your local network. Periodically, the audit of the settings of your router can help identify unknown SSH keys, open ports or unfamiliar configurations.
The implementation of the network firewall, even a simple one, can block suspicious and outgoing traffic. Finally, checking the advice of manufacturers from companies such as ASUS may provide updates or warnings of active threats.
