- FBI -Report warns of risk targeted outdated routers
- Numerous models have known vulnerabilities and are no longer supported
- FBI claims that hackers assimilate the routers in two botnets
Cyber criminals are aimed at old and outdated routers that are no longer supported by their suppliers, the FBI has warned.
The Agency noted how hackers utilize well -known upon vulnerabilities to implement malware on such devices, assimilate them in Botnets, later used for attacks, or rented out as proxy services to other criminals.
These devices are targeted to be drawn into 5socks and Anyproxy Network, two services that did not start as malicious but ended up being hijacked by criminals.
Chinese threat
5Socks is a proxy service that offers a large pool of rotating socks5 and HTTPS PROXIES. Its primary use was web scraping, anonymity and circumvention of geo-limitations.
Any proxy, on the other hand, is advertised as a lightweight, open source HTTP/HTTP’s proxy tools designed for troubleshooting and changing web traffic in real time. It was often used by developers and testers to capture and analyze requests.
The FBI did not detail which threat actress groups abused the two services, but it mentioned that the routers were targeted by “Chinese actors” who were interested in “establishing botnets to hide hacking in US critical infrastructures.”
According to the report, the devices that are currently vulnerable to compromise include a number of linksys and cisco models:
E1200
E2500
E1000
E4200
E1500
E300
E3200
WRT320N
E1550
WRT610N
E100
M100
WRT310N
The agency encouraged all users to unplug and replace the outdated equipment as soon as possible. If they can’t do that, at least they have to disable remote management features and restart affected devices to minimize the chances of being compromised.
Routers that are the gateway to all internet traffic on a network are the first and most common target in a cyberattack.
Via Bleeping computer
