1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

New Router-Infecting Trojan Identified

Discussion in 'Security Updates' started by starbuck, Mar 12, 2011.

  1. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Security researchers warn of a new trojan that infects home routers by performing brute force attacks against their administration interfaces.

    According to security vendor Trend Micro, the trojan is predominantly found in Latin America, which is also possibly where it originated.

    It functions as an .ELF file, an executable format used on many UNIX-like operating systems such as Linux, Solaris, xBSD, and so on.

    Preliminary investigation suggests the trojan is capable of mounting brute force attacks against routers using a predefined list of usernames and passwords.

    So far it's certain that it targets routers produced by D-Link, however, Trend Micro researchers don't exclude the possibility of the trojan working on others as well.

    Detected as ELF_TSUNAMI.R, the malware displays botnet capabilities. Infected devices connect to an IRC server where they listen for commands from attackers.

    There is not much detailed information about it at this point because analysis is ongoing, but this is not the first time when malware has targeted routers.

    Back in March 2009, the DroneBL project discovered a worm that infected routers and DSL modems running the Debian mipsel distribution.

    The malware was very similar to the new trojan found by Trend Micro because it also connected to IRC and was capable of brute-forcing usernames and passwords.

    In addition, the worm harvested usernames and passwords via deep packet inspection and by exploiting MySQL servers.

    Its creator left a message on the IRC control channel claiming the botnet was an experiment with no malicious intentions that reached 80,000 clients.


    Source:
    http:/ ews.softpedia.com ews/New-Router-Hijacking-Trojan-Identified-188937.shtml
     

Share This Page