- FBI report warns on risk targeting outdated routers
- Numerous models have known vulnerabilities and are no longer supported
- FBI claims hackers are assimilating the routers into two botnets
Cybercriminals are targeting old and outdated routers that are no longer supported by their vendors, the FBI has warned.
The agency noted how hackers are exploiting known unpatched vulnerabilities to deploy malware on such devices, assimilating them into botnets which are later used for attacks, or rented out as proxy services to other criminals.
These devices are being targeted to be pulled into 5Socks and Anyproxy network, two services who didn’t start off as malicious, but ended up being hijacked by criminals.
Chinese threat
5Socks is a proxy service that offers a large pool of rotating SOCKS5 and HTTPS proxies. Its primary use case was web scraping, anonymity, and bypassing geo-restrictions.
Anyproxy, on the other hand, is advertised as a lightweight, open-source HTTP/HTTPS proxy tool designed for debugging and modifying web traffic in real time. It was often used by developers and testers for intercepting and analyzing requests.
The FBI did not detail which threat actor groups were abusing the two services, but it did mention that the routers were being targeted by “Chinese actors” interested in “establishing botnets to conceal hacking into US critical infrastructures.”
As per the report, the devices currently vulnerable to compromise include a number of Linksys and Cisco models:
E1200
E2500
E1000
E4200
E1500
E300
E3200
WRT320N
E1550
WRT610N
E100
M100
WRT310N
The agency urged all users to unplug and replace the outdated equipment as soon as possible. If they cannot do that, then they should at least disable remote administration features and reboot affected devices to minimize the chances of getting compromised.
Routers, being the gateway of all internet traffic on a network, are the first and most common target in a cyberattack.
Via BleepingComputer
