Unexplained 'hacks' into Asus routers

[sanke1]

We'd have to see more detailed information from @sanke1 to confirm that it's the same hack and not something different. @sanke1 can we see your syslog please?

I had posted the screenshot of the problem in this post but the image got deleted while editing the post. Maybe a mod can retrieve the image from there. Post #36 of this thread.

But I assure you the logs were same as mentioned. Few failed attempts and few success and my SSH port was changed to 2222.

 

[ColinTaylor]

But I assure you the logs were same as mentioned. Few failed attempts and few success and my SSH port was changed to 2222.

Thanks for the extra info. The tell-tale signs for this hack are logging in on the first attempt without failure and then starting up another dropbear instance in background before logging out. This is usually followed within a couple of minutes by another login from a different IP address.

Dec 30 08:51:28 dropbear[30095]: Child connection from 46.20.215.170:52354
Dec 30 08:51:33 dropbear[30095]: Password auth succeeded for 'admin' from 46.20.215.170:52354
Dec 30 08:52:15 dropbear[30267]: Running in background

If you're seeing failed login attempts then they are probably not connected with this hack.

 

[eddiez]

Thanks for the extra info. The tell-tale signs for this hack are logging in on the first attempt without failure and then starting up another dropbear instance in background before logging out. This is usually followed within a couple of minutes by another login from a different IP address.

Dec 30 08:51:28 dropbear[30095]: Child connection from 46.20.215.170:52354
Dec 30 08:51:33 dropbear[30095]: Password auth succeeded for 'admin' from 46.20.215.170:52354
Dec 30 08:52:15 dropbear[30267]: Running in background

If you're seeing failed login attempts then they are probably not connected with this hack.

"Password auth succeeded for 'admin' from 46.20.215.170:52354"

That's in to me.
And same IP range as others.

 

[hggomes]

It's called karma:

http://46.20.215.170/login.htm


It seems this IP also has WEBUI opened WW.

 

[ColinTaylor]

It's called karma:

http://46.20.215.170/login.htm


It seems this IP also has WEBUI opened WW.

He's probably some poor sap that got infected as well and now his router is part of the bot net infecting other people.

 

[sfx2000]

It's called karma:

http://46.20.215.170/login.htm

It seems this IP also has WEBUI opened WW.

Nice...

The Wheel of Karma is the sky keeps on turning...

 

[swetoast]

thats why i dont trust ISP gear cause most of em leave shirt like that open and unsecured.

 

[sfx2000]

thats why i dont trust ISP gear cause most of em leave shirt like that open and unsecured.

https://media.ccc.de/v/32c3-7133-beyond_your_cable_modem

 

[swetoast]

exactly why where i live they use SOAP and that is insecure as **** the whole zyxel botnet (mirai) that something i was exposed to until recently kinda plugged that whole but its still scary cause there are far more things i have no clue about in their software.

btw funny video watching it now and enjoying myself