PSA: Thousands of ASUS wireless routers compromised by botnet [U]

Thousands of ASUS wireless routers have been compromised by a botnet that has also been targeting Cisco, D-Link, and Linksys devices. The way in which routers are infected means that they remain under the control of attackers even if the firmware is updated.

Update: The company has issued a statement, added to the end of the piece.

ASUS wireless routers compromised

Security researchers at Greynoise first detected the exploit back in March, but held off on making it public until the industry had time to coordinate a response.

GreyNoise has identified an ongoing exploitation campaign in which attackers have gained unauthorized, persistent access to thousands of ASUS routers exposed to the internet. This appears to be part of a stealth operation to assemble a distributed network of backdoor devices — potentially laying the groundwork for a future botnet […]

The attacker’s access survives both reboots and firmware updates, giving them durable control over affected devices. The attacker maintains long-term access without dropping malware or leaving obvious traces by chaining authentication bypasses, exploiting a known vulnerability, and abusing legitimate configuration features.

It’s believed that a nation state may be behind the attack, and that it plans to use the compromised routers for a large-scale exploit.

ASUS routers affected include the RT-AC3100, RT-AC3200, and RT-AX55.

Once your router has been compromised, it’s then too late to update the firmware, notes Bleeping Computer.

This modifications allow the threat actors to retain backdoor access to the device even between reboots and firmware updates. “Because this key is added using the official ASUS features, this config change is persisted across firmware upgrades,” explains another related report by GreyNoise.

“If you’ve been exploited previously, upgrading your firmware will NOT remove the SSH backdoor.”

The exploit also turns off logging, making it hard to tell whether or not your router is compromised.

What do to

If you have one of the listed ASUS models, it’s recommended to factory reset your router as the only way to ensure it is clean. After that, do a firmware update. Although an update on its own won’t remove the infection, updating after a full reset will prevent it being compromised again.

There is no word on any successful infection of the other brands named, so no action required for these.

You can learn more about it over at Greynoise.

ASUS statement

The company told us:

ASUS sent a push notification ( EDM ) alerting users to update their firmware.
ASUS also maintains our product security advisory page, and it is regularly updated.
ASUS Product Security Advisory�$B!C�(BASUS Global
CVS-2023-39780 and CVE-2023-41345,  CVE-2023-41346, CVE-2023-41347, CVE-2023-41348 are the same thing.
MITRE has modified the CVE CVE Record: CVE-2023-39780

Additionally, support staff have been briefed to assist customers with this issue.

Highlighted accessories

• Anker 511 Nano Pro ultra-compact iPhone charger
• Spigen MagFit case for iPhone 16e – adds MagSafe support
• Apple MagSafe Charger with 25w power for iPhone 16 models
• Apple 30W charger for above
• Anker 240W braided USB-C to USB-C cable

Image: 9to5Mac collage of images from ASUS and Mathias Reding on Unsplash