RondoDox botnet fires 'exploit shotgun' at nearly every router and internet-connected home device

A new RondoDox botnet campaign uses an "exploit shotgun" - fire at everything, see what hits - to target 56 vulnerabilities across at least 30 different vendors' routers, DVRs, CCTV systems, web servers, and other network devices, and then infect the buggy gear with malware. RondoDox is a new-ish botnet that first surfaced in …

[cyberdemon]

> Brickcom IP cameras

Is that a real company name, or are you trolling us?

Surely anyone who buys a Brickcom should expect it to be subsumed into a botnet of some sort..

Frankly I despise the concept of the IP camera. CCTV cameras until about 2010 used to be either analogue or HD-SDI which sent a digital video stream directly to where it needed to go and nowhere else.

[stiine]

Re: > Brickcom IP cameras

Wait until you hear about wifi-enabled security cameras.

[BartyFartsLast]

Re: > Brickcom IP cameras

Nowt wrong with IP cameras, it's when you let them connect it be connected to by anything outside your internal network that they become a liability, but that also applies to network capable analogue DVRs so...

[nagyeger]

Re: > Brickcom IP cameras

It's in the name ***Closed*** Circuit TV

IP cameras are wide-open-to-the-world TV / semi-limited broadcast TV.

[that one in the corner]

Re: > Brickcom IP cameras

IP cameras are attached to whatever network you decide to attach them to. If you give them an address on t'Internet, that is your choice. All the 100s of IP cameras, and their DVRs & monitors, I've been associated with have been on wired LANs, no accessible gateway to the Internet. If you wanted to view anything, live or recorded, you took yourself over to the relevant site and plugged a wire into an access port.

OTOH you can take an analogue "CCTV" camera and plug it into a broadcast transmitter...

Now, whether any particular IP camera from some rando company is capable of working as *just* an IP camera or whether it "helpfully" insists on only working when it is connected to the Internet, sending all its data to a third-party server so that you (and anyone else who guesses your URL, no passwords required) can have the joy of watching it from anywhere in the world on you smartphone... Well, that was a certainly a choice that could be made...

[BartyFartsLast]

Re: > Brickcom IP cameras

*sigh*

Oh dear, that's rather embarrassing for you.

Please, tell me you don't have any responsibility for networks or IT at your drive thru?

[Jou (Mxyzptlk)]

Thanks for showing details I miss when skimming instead of reading an article :D.

[midnitet0ker]

If You Don't Patch Your Devices/Software, You're Begging For It

When I first got into computing, I used to be against patching, mainly because I was pirating software but because I was concerned about tracking. Now that privacy is dead, I get nervous when something like Recalbox has auto-update enabled but hasn't updated in over a year. Really? Your software's that bulletproof?

When I see streaming boxes from fly-by-night manufacturers for sale on Newegg, I basically look at those as an invitation to join a Botnet. I seemed like a crank years ago for being against "smart homes" but now we find that all those people did was introduce gaping cyberattack vectors into their own home. Now your "smart" washing machine moonlights as a soldier in a DDoS attack or mines crypto for some dark figure in a hoodie (the hacker uniform, according to El Reg's stock photos).

[Irongut]

Re: If You Don't Patch Your Devices/Software, You're Begging For It

Streaming boxes don't need an incomming connection. Nor do smart home devices, secure ones anyway. Don't open your shit to the public Internet and you won't get hacked.

Not buying a typical consumer router from the usual suspects also helps.

When I first got into computing there was no such thing as patching, the ARPANET was still being built and the Morris worm had not been written yet. As for pirating software a dual cassette deck was vital!

[jake]

Re: If You Don't Patch Your Devices/Software, You're Begging For It

"When I first got into computing there was no such thing as patching"

You must be very old indeed ... Here's a photo of a patched Harvard Mk I program tape that has been patched:

https://upload.wikimedia.org/wikipedia/commons/f/fa/Harvard_Mark_I_program_tape.agr.jpg

One of the first jobs I had in computing partially involved physically cutting paper tape at the correct point(s), and then taping in either more code, or corrected code, or both, or occasionally undamaged paper with the original code after the tape got "eaten" by the machinery. The bits that got taped in were usually hand-punched. Yes, it was called "patching", for what I hope are obvious reasons.

[that one in the corner]

Re: If You Don't Patch Your Devices/Software, You're Begging For It

Jacquard loom cards: sew them up in a different order to patch the pattern on the patch of material.

[big_D]

Re: If You Don't Patch Your Devices/Software, You're Begging For It

Our local museum still has a working Jacquard loom, the Tuchmacher (cloth maker) Museum in Bramsche. They still run it up regularly, when they do guided tours, likewise the big industrial loom from the lat 19th century still gets fired up, it slides in an out, taking up most of the floor space in the main room.

[Sgt_Oddball]

Re: If You Don't Patch Your Devices/Software, You're Begging For It

Armley mill in Leeds has the whole set too (along with a further section on cinema, since Bradford got the Media museum rather than the birthplace of moving pictures...*grumble, grumble*)

[big_D]

Re: If You Don't Patch Your Devices/Software, You're Begging For It

We didn't use to patch, because the patches could cause more chaos than not patching, because the chances of you being hit by an exploit were tiny... These days, if you delay just a couple of days, you could be in big trouble.

[Irongut]

All the usaul suspests - Belkin, DLink, Edimax, Linksys, Netgear, ZyXEL and Cisco. Plus a few I'd never heard of.

Nothing from my router manufacturer, as usual.

[upsidedowncreature]

Can you share the name of your router manufacturer with the rest of the class?

[jvf]

Mine's a Pepwave SOHO by Peplink. It's a great router and I've never seen it on anyone's list

[Snapshot]

But, perhaps surprisingly, not Asus.

[Grunchy]

What about dd-wrt

“But, perhaps surprisingly, not Asus.”

I’ve always been troubled by asus, it’s like anus but with more ass.

It’s troubling, dammit!

Anyway I got the dd-wrt firmware from way long time ago, I wonder how susceptible it is. No really… I wonder. I think I have d-link dir-wassa wassa.

(I haven’t even looked at it in like 8 years, I guess it’s still running, judging by my ip connectivity.)

[Anonymous Coward]

Nor mine.

(Nope, not going to name it either - don't want to give the bad guys any ideas about whose kit to break into next!)

[big_D]

A link to affected models would be useful, although I had to double check, Zyxel wasn't actually listed, this time, in the article.

[bombastic bob]

Is there a 'generic thing' that can mitigate most of it?

At the risk of looking like I am going after "low hanging fruit", it would seem to ME that if you have open ports exposed to the world+dog, you either use them as simple re-directs via port forwarding (or similar) and don't have something that can access the router's admin screen NOR support UPnP in ANY way [which can open up ports at random to allow a firewalled box to listen to 'teh intarwebs' through the firewall - both convenient AND unwise].

I would think that 'zero config' 'UPnP' and 'remote admin' would be 90% of the problem... or am I wrong this time?

[the default config is nearly always the WRONG one, designed for convenience at the expense of security]

[doublelayer]

Re: Is there a 'generic thing' that can mitigate most of it?

UPNP is probably a lot of it because people don't know to turn it off and some things people buy won't work without either having it enabled or knowing how to administer a network. Take those IP cameras people were complaining about earlier. With such a thing, there are three general options. Here they are, along with the experience of the nontechnical person wanting to view the outside of their house when they are not in the house:

1. The IP camera that sends a data stream to a device of your choosing. The user doesn't know how to set up the server to send the images, so they can't see anything unless they're on their local network.

2. The IP camera with a basic UPNP and DDNS component built in. The camera gets installed, you add the address to your phone, and you can see the camera from wherever you are as long as the network's up.

3. The camera that connects to a remote service like the seven different lines Amazon's got. You can access your footage but only through the app you're already signed into. Also they have access to everything and misuse it in many ways.

For us, the ideal option if we're going to have such a thing is 1, and we can figure out how to either direct the traffic to a server of our choice or VPN into our home network to see it. The average buyer can't use that one so ends up with one of the others. Manufacturers that don't want to maintain a mobile app and cloud system won't build with number 3, and since most customers won't use things with option 1, they mostly land with option 2. Then they stop development as soon as the products are on sale and they become targets for botnets.