RT-N66U No Wired Link Lights Post-Attack

[s814jdh]

My in-laws very recently had their Comast Internet connect turned off after an attacker broke in enough to use the networking gear and trip the gates at Comcast.

I don't know really what happened since Comcast took care of it all for them, but they came to the conclusion that the modem and router were both dead. Comcast has sent them a replacement modem/wifi unit that I am sure won't be as good as the Surfboard + RT-N66U combo, but at least they are back up.

Days later, I have taken the RT-N66U back to my house now, figuring the hackers may have leveraged firmware vulnerabilities to get access to the router and put their own thing on there, and I only needed to put the router in recovery mode to re-flash a good firmware on there and it would be good.

That doesn't seem to be the case. I can hold the reset button while powering it on, get the power signal to blink, but I can't get any of the LAN wired connections to work. No link lights for any of the 4 ports. I configured the NIC with a 192.168.1.2 static IP address, but with the cable plugged in Windows says the cable is disconnected.

Could it just be that the firmware on the device has disabled the LAN ports? Is there any hope of flashing a good firmware on it?

 

[L&LD]

If it really was hacked, who can tell what the installed firmware does?

Try different ways to revive it, but if all fails, junk it and put the cost of the new router to the AV budget for this year.

 

[s814jdh]

AV seemed to have done it's job, the computers don't show any sign of infection. The attackers didn't come in through the computers, they came in through the Comcast Internet connection and seemed to stay within the cable modem and the router alone.

I am afraid the LAN ports were disabled and can't seem to get in there at all, even with the router in recovery mode.

 

[L&LD]

Okay, does it broadcast any wifi ssid's?

 

[wouterv]

Are we facing this issue?
http://www.cvedetails.com/cve/CVE-2014-2718/
Further explained here:
http://www.securityweek.com/vulnerability-found-firmware-update-process-asus-routers

Unless the posted issue is due to a user mistake, it could be worth to in depth investigate the involved router by an expert.

[EDIT]
@ s814jdh: if your router is still at F/W: 3.0.0.4.270.25, the router is vulnerable to a ship load of known security issues. Your router may be the next to get hacked.