Spam Botnet of Over 100K Routers Abuses UPnP

[silversurfer]

Security researchers have uncovered a major new botnet of over 100,000 compromised machines, made up mainly of home routers with UPnP enabled.

Netlab 360 researchers Hui Wang and ‘RootKiter’ explained in a blog post that the main target is a vulnerability in the UPnP feature from Broadcom, which is widely available: in fact, 116 infected device models were found. These included routers made by D-Link, Linksys, ZTE, TP-Link, Zyxel, Technicolor and many more.

“The interaction between the botnet and the potential target takes multiple steps, it starts with tcp port 5431 destination scan, then moving on to check target’s UDP port 1900 and wait for the target to send the proper vulnerable URL,” they explained.

“After getting the proper URL, it takes another four packet exchanges for the attacker to figure out where the shellcode's execution start address in memory is so a right exploit payload can be crafted and fed to the target.”

Source: https://www.infosecurity-magazine.com/ne...k-routers/