Backdoor found in routers from various vendors... listening to port 32764.

[blankslate]

http://www.bbc.com/news/technology-26287517

Serious security failings in home routers are getting more attention from both attackers and researchers.

In recent weeks, attacks have been mounted on Linksys and Asus routers via loopholes that thieves could exploit.

One such flaw is a backdoor discovered by someone who forgot his admin password to his router and instead of just hard resetting the router to factory defaults decided to scan it.

http://www.bleepingcomputer.com/for...er-routers-and-waps-port-32764-vulnerability/

^the above link is to a thread about the vulnerability which includes links to other articles including a site that will check port 32764 where the backdoor listens

The following link is where I first became aware of the issue
http://arstechnica.com/security/201...routers-lets-attacker-reset-router-get-admin/


The following link includes details on how to check your own router.
http://blogs.computerworld.com/network-security/23443/how-and-why-check-port-32764-your-router

also there is some interesting speculation from the author of the blog post

Back in December 2011, the WPS system was shown to have a design flaw that rendered every router using it vulnerable to attack. To this day, routers need to implement WPS to get certified. Nothing was ever done to fix the design, so routers running WPS remain vulnerable. Chances are you can disable WPS but good luck verifying it. In retrospect, we have to wonder if it really was a design flaw, or, if the design was influenced by a spy agency.

In January 2013 security firm Rapid7 warned about UPnP programming errors that left millions of routers vulnerable to attack. This followed the October 2011 warning from CERT and Daniel Garcia about routers that responded to UPnP commands over the Internet. UPnP was designed for LAN use only, so enabling it over the Internet was either a huge mistake or purposely done to enable spying.

Now we have port 32764.

Luckily my router doesn't respond to port 32764.


But now I wonder if I should just get a router that supports being flashed to open source firmware.


*e2a*

to any moderators.

I posted about this in the Software security section but it seems that barely anyone reads that forum and this does, imo, seem to be a worthy general news item.
Especially, since some have speculated that these "mistakes" might be influenced by certain groups.
If I am mistaken feel free to remove this post.

Already posted by the OP in Security. admin allisolm


.....

 

[Victorian Gray]

Thanks for the info. Much appreciated.

 

[JEDIYoda]

I am not trying to be a jerk but this is all old news......most of us know about how to test for open ports and the Shields Up website..... https://www.grc.com/x/ne.dll?bh0bkyd2

 

[John Connor]

Shields up only tests the first 1,056 ports. So seeing if port 32764 is open you need to manually check.

 

[BoomerD]

Shields up only tests the first 1,056 ports. So seeing if port 32764 is open you need to manually check.

https://www.grc.com/x/portprobe=32764