Email from ASUS about firmware update to registered users

[Ellipse]

It looks like ASUS is being proactive to their registered users of several router models.

Here is a copy of the email that was sent out today.

ASUS Router Security Update

New firmware available for RT-AC5300 / RT-AC88U / RT-AC3100 / RT-AC3200 / RT-AC87U / RT-AC87R

Dear RT-AC5300 / RT-AC88U / RT-AC3100 / RT-AC3200 / RT-AC87U / RT-AC87R users,


We have released a new firmware version (version 3.0.0.4.380.4180) for your wireless router. This new firmware version includes important bug fixes and security updates that address software vulnerabilities and protect against unauthorized access to or modification of your wireless router. You can easily update to this new firmware version by using the ASUSWRT web interface – just click Administration and then click Firmware Upgrade. A step-by-step guide for this simple procedure is available online at:
https://www.asus.com/Microsite/2015/networks/routerfirmware_update/

To improve privacy protection and guard your wireless router against unauthorized access, alteration, disclosure, or destruction from malware, phishing, and other malicious actions, we strongly recommend that you:

(1) Install this new firmware version on your router immediately.
(2) Always keep your router up to date with the latest firmware version.

If you choose not to install this new firmware version we strongly recommend that you log out of the ASUSWRT web interface, close any open browser windows and restart your browser to provide increased protection against unauthorized access to your router.

If the model name of your wireless router is not RT-AC5300, RT-AC88U, RT-AC3100, RT-AC3200, RT-AC87U, RT-AC87R, or if you have already installed the latest firmware version, please disregard this notice.

Best regards,
ASUS Development team | ©ASUSTeK Computer Inc.

Here are the technical details of the changes in the new firmware version:

RT-AC5300 / RT-AC88U / RT-AC3100 / RT-AC3200 / RT-AC87U / RT-AC87R Security Updates
Version 3.0.0.4.380.4180

Security Fixes
- Updated OpenSSL library to 1.0.2j to fix security issues.
- Updated Dropbear SSH to 2016.74 to fixe security issues.
- Fixed a security vulnerability regarding XSS.
- Fixed a security vulnerability regarding CSRF.
- Added protection for Brute-force attack.

Bug Fixes
- Fixed Chrome, Edge and IE compatibility issues.
- Fixed quick internet setting wizard compatibility issues.
- Fixed NAT issue caused by UPnP media server.
- Fixed dual wan issues in PPPoE or PPTP or L2TP + DHCP environment.
- Fixed AiCloud related issues.

Modifications
- Updated NAT Acceleration setting help message.
- Supported Google DDNS .
- Modified the Quick Internet Setting wizard behavior to enhance compatibility.
- Enabled smart sync under AP/Media Bridge.
- Supported new 3G/LTE USB dongle, Docomo L-03D.

 

[ColinTaylor]

Interesting. I wonder if this is in response to those recent successful hacks that we've seen.

 

[RMerlin]

Interesting. I wonder if this is in response to those recent successful hacks that we've seen.

No, it's a response to the FTC requirements of last summer's settlement. They sent similar notifications for a previous version as well.

 

[ColinTaylor]

Ah, OK. Thanks for the explanation.

 

[richardeid]

Interesting. I wonder if this is in response to those recent successful hacks that we've seen.

I try to keep up and I do remember seeing a few posts about SSH "hacking" or something. It was something like people had noticed some successful SSH logins from IPs they didn't recognize and some settings and/or passwords had changed afterwards. Were these confirmed as successful hacking attempts and not just some pretty lax security practices by those affected?

 

[ColinTaylor]

Were these confirmed as successful hacking attempts and not just some pretty lax security practices by those affected?

They were successful attempts, but the attack vector appears to be that the victims had enabled web access from WAN. Despite the fact that some had changed the admin account to something unusual and were using complex passwords.