Update RT-AC68U to 3.0.0.4.384_20624, got login attempts non-stop

[Buzzly]

Updated my working Ac68u, 1 router to 2 nodes aiMesh to 20624 firmware on 5/25. Rebooted all units and it worked fine.

But I checked the system log and found this. Look like it is a "break-in" attempt. And it started right after the firmware update.

Any explanation???

Yes. I am still using ADMIN as username

May 30 13:14:21 dropbear[24952]: Login attempt for nonexistent user from 60.229.32.161:58632
May 30 13:16:35 dropbear[25057]: Login attempt for nonexistent user from 115.231.9.131:54025
May 30 13:17:36 rc_service: httpd 265:notify_rc reset_vp_db
May 30 13:18:10 rc_service: httpd 265:notify_rc reset_mals_db
May 30 13:38:41 dropbear[25996]: Bad password attempt for 'admin' from 212.129.36.253:60801
May 30 13:38:46 dropbear[26006]: Bad password attempt for 'admin' from 212.129.36.253:60907
May 30 13:38:51 dropbear[26014]: Bad password attempt for 'admin' from 212.129.36.253:61133
May 30 13:38:54 dropbear[26016]: Login attempt for nonexistent user from 212.129.36.253:61313
May 30 13:38:57 dropbear[26018]: Login attempt for nonexistent user from 212.129.36.253:61426
May 30 13:45:21 dropbear[26283]: Login attempt for nonexistent user from 62.76.12.60:9224
May 30 14:11:34 dropbear[27333]: Bad password attempt for 'admin' from 113.254.71.194:46591
May 30 14:11:35 dropbear[27333]: Bad password attempt for 'admin' from 113.254.71.194:46591
May 30 14:11:35 dropbear[27333]: Bad password attempt for 'admin' from 113.254.71.194:46591
May 30 14:12:18 dropbear[27373]: Login attempt for nonexistent user from 185.51.214.35:48648
May 30 14:18:17 dropbear[27614]: Login attempt for nonexistent user from 119.28.77.70:52744

 

[ColinTaylor]

Looks like the normal hacking attempts you get when you have enabled SSH access from the WAN. Disable it.

 

[ForkWNY]

I'm seeing the same thing. Unlikely that it coincides with the firmware update. Home router hack attempts have been all over the news the past few days thanks to Malware that has spread itself around, known as "VPN Filter".

Use a fairly lengthy complex password with numbers and special characters and it's highly unlikely that anyone will gain access to your router's admin UI.

 

[Adrian Knight]

If you do not need ssh login via WAN, change the setting to LAN only, this way the issue will stop flooding your log with crap.