a worm for routers :D

Padre

psyb0t is a worm that was discovered not long ago infecting embedded devices, mostly routers, and spreading. i like the idea :D

We have come across a botnet worm spreading around called "psyb0t". It is notable because, according to my knowledge, it:

is the first botnet worm to target routers and DSL modems
contains shellcode for many mipsel devices
is not targeting PCs or servers
uses multiple strategies for exploitation, including bruteforce username and password combinations
harvests usernames and passwords through deep packet inspection
can scan for exploitable phpMyAdmin and MySQL servers

BashLogic

err nothing new about that, it basically targets common ports, anyone who leaves any ports open to the public networks should be shot dead on the spot for the crime of idiocy! with the age over the internet, idiocy is no longer pardoned!

nuclearcat

port is not the issue. Weak security is issue.
I can leave all ports, if my box is secure.

BashLogic

hiding ports ensures that the system wont be loaded.
and as we all know, each protocol has bugs and these bugs are found every now and then.

if you think of the embeded boxes, they use particular versions of for example ssh, which i guarantee has not been updated or patched sufficiently for the box to be classified as secured. users often neglect and are unaware of the benefits of upgrading the firmwares. so blocking the ports covers that issue. and for one thing, its very rare that you would require to have the modem box ssh/http ports opened to the wan.

nuclearcat

issue of that worm - just dumb manufacturer of specific modem model
usually routers will not let u even to save executable files, only small config in nvram

Padre

executable isn't saved :P it's just in mem. when u power cycle ur router, it gets cleared and will need to be re-infected.

BashLogic

which it would since the breakin info is stored, the credentials are known, stored and reusable so power cycle only buys you time.