- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
New worm directly infects Linux-based home routers
This is an alarming development because it's both difficult to detect (software running on your PC can't detect it) and significantly more useful to the botnet operator than infected PCs because home routers generally run 24 hours a day, unmonitored. |
|
|
Comments (33)
13 earlier comments in the full thread.
I'll just unplug that damn router. The editors here can expect snail-mail.
erm, wait, does canihascheeseburgernow have a print edition?
Quoting: By the same token, strong passwords are security-by-obscurity.
True, but an effective form of security-by-obscurity. There is nothing wrong with including some smart security-by-obscurity in your security toolbag.
As much as I preferred having my server also acting as my router, for some reason the IP-Phone dongle didn't work through the NAT.
Everything else worked. Port forwarding, IPv6 tunneling, Gnutella and Bittorrent on the inside of the NAT, etc.
Just not the off-the-shelf Linksys VoIP box.
So I went and bought a router, and everything worked for a while, but now Gnutella can't connect.
Oh, and the idiot Belkin router inserts itself into the DHCP list of DNS servers, and then DOES NOT act as a DNS cache, so everything is slowed to a crawl unless I set things static. Maybe some day I'll let experience instead of budget be my buying guide.
Everything else worked. Port forwarding, IPv6 tunneling, Gnutella and Bittorrent on the inside of the NAT, etc.
Just not the off-the-shelf Linksys VoIP box.
So I went and bought a router, and everything worked for a while, but now Gnutella can't connect.
Oh, and the idiot Belkin router inserts itself into the DHCP list of DNS servers, and then DOES NOT act as a DNS cache, so everything is slowed to a crawl unless I set things static. Maybe some day I'll let experience instead of budget be my buying guide.
Set up your DNS servers in /etc/resolv.conf, then
chattr +i /etc/resolv.conf
Alternately, if you're using dhcpcd, you can add -R or --nodns to leave /etc/resolv.conf as-is. But using chattr is more certain.
chattr +i /etc/resolv.conf
Alternately, if you're using dhcpcd, you can add -R or --nodns to leave /etc/resolv.conf as-is. But using chattr is more certain.
Yup, that's what I do on my router box gus3 since I run my own local dns server and don't want silly ISP changing me to using theirs.
> ...and the idiot Belkin router...
I think you just identified the problem. :) Seriously, Dlink, Netgear, and Linksys are all acceptable and reasonably priced. There's never a good reason to go with Belkin.
I think you just identified the problem. :) Seriously, Dlink, Netgear, and Linksys are all acceptable and reasonably priced. There's never a good reason to go with Belkin.
I have had one Belkin and one re-branded Belkin router.
Never gave me any problems but I was using them with
service from Charter so who knows. I don't do anything
tricky, just pump out a signal and pray. Only used with Linux.
With our fiber to the home connection I have a Linksys WRT160n and it is sweet. Easy to configure, cheap too.
With our fiber to the home connection I have a Linksys WRT160n and it is sweet. Easy to configure, cheap too.
> ...and don't want silly ISP changing me to using theirs.
Apparently Roadrunner won't let you use and outside DNS (I don't see how they could keep you from using your own). Our machines are set up for OpenDNS. When my wife was at Myrtle Beach this winter an using their service, our DNS queries always came back from Roadrunner, even though our settings hadn't changed. It looks like they intercept the DNS queries and answer them themselves. Which makes it fun when their DNS goes down, which it seemed to do on a semi-regular basis.
Apparently Roadrunner won't let you use and outside DNS (I don't see how they could keep you from using your own). Our machines are set up for OpenDNS. When my wife was at Myrtle Beach this winter an using their service, our DNS queries always came back from Roadrunner, even though our settings hadn't changed. It looks like they intercept the DNS queries and answer them themselves. Which makes it fun when their DNS goes down, which it seemed to do on a semi-regular basis.
jdixon: I think you could have solved that by using a socks proxy. With a socks proxy, all traffic is redirected, including DNS queries.
> Belkin
It was on sale.
It was on sale.
Quoting: Quoted: By the same token, strong passwords are security-by-obscurity.
True, but an effective form of security-by-obscurity. There is nothing wrong with including some smart security-by-obscurity in your security toolbag.
My experience reinforces the effectiveness of running admin-level services on obscure ports. Sending anyone who attempts unauthorized access on common ports to Never Never Land is smart...smarter than allowing them to keep running brute-force attacks on 22 and choking your logs. What's nice is that your well-crafted password will give you some temporary protection against anyone who stumbles upon your active port and starts hammering that. You really need a pretty big tool bag.
Quoting:smarter than allowing them to keep running brute-force attacks on 22 and choking your logs.
I run denyhosts and tarpit to solve that.
Denyhosts adds hosts trying and failing to access my machine to /etc/hosts.deny. It's like the ATM. You get three attempts. Denyhosts can also connect to a big database on the web that shares all these blocked hosts. It's pretty cool.
Tarpit intercepts connections to ports and IP address that you don't have anything running on. It then keeps these connections open for as long as possible, tying up the other guy's resources. A real stomp in the face of would-be intruders because suddenly nmap takes a few hours instead of a few seconds to scan all 65,535 porst on you machine :-)
Old Guy question: With all the security you have between your computer and the internet
how much does that slow things down? At my age I don't want to wait too lone for a page
to load.
Colonel: In my case, nothing. DenyHosts and Tarpit only affect incoming connections and not outgoing connections. To boot, they only kick in when you fail to authenticate or try to connect to a port or IP address I'm not using.
Sander, thanks, thats food for thought.
CP, I've found two things that SUBSTANTIALLY speed up the apparent speed of 'Net connections:
The Ad Block Plus extension in Firefox;
The Hosts File Project http://hostsfile.mine.nu
Since I prefer using Konqueror, the former does not have as much impact as the latter, but they have been of fantastic use. A few clients have reported that they thought their whole computer had been upgraded just by using Firefox with Ad Block Plus.
Both of which have nothing to do with security, specifically, but a great deal to do with human-perceptable speed issues.
The Ad Block Plus extension in Firefox;
The Hosts File Project http://hostsfile.mine.nu
Since I prefer using Konqueror, the former does not have as much impact as the latter, but they have been of fantastic use. A few clients have reported that they thought their whole computer had been upgraded just by using Firefox with Ad Block Plus.
Both of which have nothing to do with security, specifically, but a great deal to do with human-perceptable speed issues.
There's a lot of good ways to skin the cat. I deny ALL in hosts.deny and only allow specific IPs in hosts.allow. Then I run some homegrown perl listening to 22 which permanently drop-routes ANYONE making a single attempt if they are not in hosts.allow. They can't do anything now...not even view a web page. Too bad. I don't have to worry about them any more.There's no need to waste my time tying up someone else's resources. I've got more important things to do.
If I want to mess with people I'll just set up an access point and have fun with squid...or better yet just come hang out and post on LXer!
If I want to mess with people I'll just set up an access point and have fun with squid...or better yet just come hang out and post on LXer!
http://www.ex-parrot.com/~pete/upside-down-ternet.html
Upside-Down-Ternet
My neighbours are stealing my wireless internet access. I could encrypt it or alternately I could have fun.
My neighbours are stealing my wireless internet access. I could encrypt it or alternately I could have fun.
tuxtom,
I did something similar on my home-based web server a few years ago. The 404 page was a CGI script that checked the URL for Nimda- or CodeRed-style attacks. Positive hits were promptly handled by 'iptables -A INPUT --source $evil_system -j IGNORE'.
Access and error logs suddenly cleaned up a lot; and it prevented the normal closing of the TCP connection on both ends, an evil my RAM-heavy system could tolerate. And it was fun writing evil in Perl.
I did something similar on my home-based web server a few years ago. The 404 page was a CGI script that checked the URL for Nimda- or CodeRed-style attacks. Positive hits were promptly handled by 'iptables -A INPUT --source $evil_system -j IGNORE'.
Access and error logs suddenly cleaned up a lot; and it prevented the normal closing of the TCP connection on both ends, an evil my RAM-heavy system could tolerate. And it was fun writing evil in Perl.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post
But the good news is that 99.9% of the attacks out there are bot-scripts randomly hammering away at standard ports. Sooner or later they get a sucker (admin:linksys?)...just like the Viagra spammers do. It's more a numbers game more than will or wit.
I have yet to see a single attempt at my chosen obscure ports on my servers, whereas I have thousands of futile port 22 attempts (who are summarily drop-routed after their first attempt).
By the same token, strong passwords are security-by-obscurity.