News for hackers. Stuff that matters.

A comment on Over 65,000 Home Routers Are Proxying Bad Traffic for Botnets, APTs. Parent comment

Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by ge0rg on Monday April 16, 2018 @06:05AM (#16847844)
Disable UPnP in the router settings. In theory, that should close the hole.

Disable remote maintenace / web access. Many router web UIs have exploitable flaws that can be used to bypass password authentication.

Ensure that you are always running the latest firmware version. If there are no up-to-date versions / the router is too old, you might complain to the ISP. However, they might try to sell / rent you the latest and greatest router model then.

[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by prepend on Monday April 16, 2018 @06:29AM (#16847941)
It looks like this exploit gets around disabled remote maintenance, since it makes remote traffic seem local.

Disabling upnp will do it. I’m going to set up blocking all inbound on 1900 on ISP’s router stopping traffic before it gets to my home router. I might finally be grateful for being forced by the isp to use their hardware for nothing other than a hop between my network’s router and the isp’s network.

[ Parent | on HN ]
Re:Over 65,000 Home Routers Are Proxying Bad Traffic for Bot... by EADGBE on Monday April 16, 2018 @03:46PM (#16852094)
> Disable remote maintenace / web access

By this do you mean a public remote address/login or the generic 192.168.0.X login page when on the serving network?

[ Parent | on HN ]