Friday, March 29, 2024

Millions of Routers are Actively Exploited Through Bypasses Authentication Bug

The security researcher at the information security company Tenable Evan Grant detected that a serious security violation puts millions of routers at risk all over the world.

According to the report of a security analyst, this is a critical vulnerability that circumvents the authentication and attacks the home devices that are using Arcadyan firmware. 

However, this attack generally enables the threat actors to control them and to implement the attacks utilizing the Mirai botnet.

Millions of Routers Are Vulnerable

After investigating the attack, the security analysts came to know that this vulnerability has attacked millions of routers models from different merchants and ISPs, that also includes:- 

  • Asus
  • British Telecom
  • Deutsche Telekom
  • Orange
  • O2 (Telefonica)
  • Verizon
  • Vodafone
  • Telstra
  • Telus

The security vulnerability has been detected by the Tenable, which is tracked as “CVE-2021-20090” with a CVSS score of 9.9 and after detecting the attack they published about it on April 26, not only this, recently, the experts have also provided some proof of concept exploit code.

However, the cybersecurity experts have studied the matter clearly, and based on the number of routers as well as the merchants that are infected by this vulnerability attack are increasing rapidly and went to millions, that’s why the experts are trying their best to detect all the infected devices.

Attack Details

After investigating the security experts came to know that the attack was started from the IP address 27.22.80[.]19 over HTTP. Moreover, the attackers have modified the configuration of all the attacked devices, and it allows the Telnet to utilize “ARC_SYS_TelnetdEnable=1”.

Once it does, after that it moves to download a new script from the IP address 212.192.241[.]72 utilizing either wget or curl and then administers the whole operation that they have planned.

List of all known affected devices and vendors 

The security experts have mentioned the full list of the affected devices and vendors, and here below we have mentioned an image in which the full list is mentioned:-

Attacks start two days later the PoC exploit release

The most interesting point is that the security lab Juniper Threat has detected some attack patterns that are trying to exploit this vulnerability and after investigating it the analysts came to know that it was coming from IP addresses that are initially located in Wuhan, Hubei province, China.

However, in this attack, the cybercriminals are using some malicious tools so that they can deploy a Mirai botnet variant, and it is quite similar to those which were used in a Mirai campaign that is targeting IoT and network security devices.

In both the attacks, there are some similarities, and the researchers stated that after studying the similarities it indicates that the threat actors that are behind these attacks are the same.

However, to know the exact details of these attacks, the security analysts are investigating the whole matter, and they have claimed that they will soon disclose the details of this attack.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles