Is your router under attack?

happygeek 0 423 Views

Computerworld is of a worm or bot in the wild that is specifically targeting D-Link branded routers. It refers to a three year old vulnerability which Symantec security researchers believe is being exploited by a new exploit. Apparently, the Symantec security response team has seen an increase in attack activity as it relates to D-Link devices.

Oliver Friedrichs, director of the Symantec security response team, is quoted as saying that it looks like hackers are "exploiting the SNMP vulnerability to reset and reconfigure the administrative password on the routers" after scanning TCP port 23 for an active SNMP service.

The report goes on to suggest that router vulnerabilities are up, and unsurprisingly so are attacks against routers as a result. Unfortunately, there is no comment from D-Link itself with regard to whether it had investigated if this vulnerability was being exploited, nor indeed if it had ever been patched.

Dani AI

Generated

As noted, router-targeting activity is a recurring issue. The short, practical checklist below is model‑agnostic and focused on detection and safe remediation so an affected network can be triaged and recovered even years after an initial report. (media.defense.gov)

Checklist — quick triage and checks (do this from a trusted device on the LAN):

  • Inspect the router admin UI for unexpected DNS servers, unknown port‑forwards, extra admin accounts, or unfamiliar devices in the DHCP/connected‑devices list.
  • Verify DNS resolution from a trusted host (compare the router’s DNS answers against a known public resolver).
  • Probe management/monitoring ports from the LAN only — SNMP commonly runs on port 161 and telnet on port 23 — and use safe enumeration scripts rather than brute force. Example commands (run only against equipment owned/authorized to test):
# DNS quick checks
nslookup example.com
dig @1.1.1.1 example.com

# SNMP / management probe (examples)
sudo nmap -sU -p 161 --script=snmp-info <router-ip>
sudo nmap -sT -p 23,80,443 <router-ip>

(See the IANA port registry for standard ports and Nmap SNMP scripts for safe enumeration options.) (iana.org)

If compromise is suspected, follow a conservative recovery workflow:

  • Isolate the device from WAN, record current settings (screenshots), then perform a factory reset (do not restore a potentially infected backup). Reconfigure from scratch while offline.
  • Update firmware to the latest vendor release (or replace EOL hardware). Change the admin login to a long unique passphrase, disable remote administration/UPnP/SNMP unless explicitly required, and enable strong Wi‑Fi encryption and network segmentation (guest/IoT). These are standard hardening steps from government and vendor guidance. (media.defense.gov)

Notes and cautions: avoid restoring unknown saved configurations, notify the ISP if the device was supplied by them, and scan hosts on the LAN for endpoint malware (router changes often follow a compromised PC). For ongoing defense, prefer devices that receive regular firmware updates and apply the hardening checklist routinely.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview