1701
Living Room / Re: WARNING! Linksys routers infected with self-replicating worm/malware.
« Last post by Stoic Joker on February 14, 2014, 07:08 AM »Okay... I've only gotten as far as reading the above, but with an exploit that uses an HTTP request to port 8080 as an entry point I can only assume they're targeting the external access remote administration "feature" of the router. A feature that should be either turned off, or highly restricted to start with me thinks.
So is this exploit somehow bypassing configuration imposed restrictions, or is it just targeting the defaults crowd? I'm inclined to think simply turning off remote administration - like it's really used that often by home users - would sufficiently mitigate this but don't want to assume that just yet.
Edit: Looks like SANS confirmed the Remote Administration off = safe hypothesis.
So is this exploit somehow bypassing configuration imposed restrictions, or is it just targeting the defaults crowd? I'm inclined to think simply turning off remote administration - like it's really used that often by home users - would sufficiently mitigate this but don't want to assume that just yet.
Edit: Looks like SANS confirmed the Remote Administration off = safe hypothesis.

Recent Posts


What's the bike on the wallpaper...it looks (to me) to be Italian but I could be (and probably am) wrong.
... And I don't have any!