Does the VPNFilter malware affect ASUS Routers?

[AntonK]

Hi,

Just wondering if this latest botnet malware is a threat to ASUS routers.

Thanks,
Anton

 

[kfp]

Discussion from yesterday:

https://www.snbforums.com/threads/ai-protection-vpnfilter-affecting-home-routers.46811/

 

[AntonK]

Discussion from yesterday:

https://www.snbforums.com/threads/ai-protection-vpnfilter-affecting-home-routers.46811/

Great, thanks!

 

[MustacheSwe]

FYI --

I have now seen three seemingly unrelated reports from individuals claiming that they have recently discovered that their Asus router started behaving strange, and that a new VPN client has been created. They all speculate that this could have something to do with VPNFilter. Two of the individuals were running the stock Asus WRT firmware, one claims to have been using Merlin's firmware. As far as I have seen, they all were using updated firmware, and did not have any spectacularly unsecure configuration (at least one may have had remote access enabled, from using Asus' smartphone app.

Sources:

1. https://www.reddit.com/r/HomeNetworking/comments/8m95re/asus_ac68u_hacked_vpnfilter/
2. https://www.reddit.com/r/HomeNetwor...d_unknown_vpn_on_my_router_was_router_hacked/
3. (the third report was written yesterday in the Facebook "Synology Admins & Users" Group, but for som reason that whole thread was deleted yesterday (possibly due to the fact that the thread had nothing to to with Synology)). The story was similar -- a fairly tech-savvy user (i.e., not using outdated firmware or crap-settings) discovered a newly created VPN on the router

 

[umarmung]

No Asus router, or any other router tbh, can be affected by a remote exploit like VPNFilter if it has no WAN ports open.

Unfortunately, it is surprisingly easy to open up such ports on Asus routers, especially by the Asus mobile app. Exactly as one of those Reddit links you posted made clear.

Just follow the usual security practices, avoid the Asus mobile app, and you will be and would have been fine: https://routersecurity.org/checklist.php

 

[ColinTaylor]

@MustacheSwe There's already a thread about VPNFilter here as noted in post #2.