1

Refering to the following topic: http://arstechnica.com/security/2016/11/notorious-iot-botnets-weaponize-new-flaw-found-in-millions-of-home-routers/?utm_content=buffer8f018&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer

There is a Mirai malware attacks related to the TR-069. which use the TR-069 opened port 7547 to make attack.

Is it a classic port attack?

I think to fix that attack I have:

  1. to use a random port for each device instead of the known port 7547
  2. to add a firewall rule in my iptable. The firewall rulle will allow to accept connection request of the opened port from only a know IP address

Are my suggestion is sufficient to protect my devices against this attack?

  • Do you have Speedport router? The attack uses a bug only present in the Speedport router firmware. Moving the port to another number will not fix the problem. Firewalling your router? – honze Nov 30 '16 at 10:37
  • 1
    TR069 (and any similar management interface) should only be accessed by the ISP. This can be done properly by having two DSL VCs (virtual circuits), one carries the standard Internet traffic while the other one is just a connection to the ISP's management network. The management interface should only be open to the latter. – André Borie Nov 30 '16 at 10:42
1

I have no idea what you consider a "classic port attack" but this attack uses a security problem at the application layer and is thus more comparable to attacks against web applications. In fact this is an attack which uses a security problem in the processing of a SOAP request delivered through HTTP.

While you can block connections attempts with a packet filter in front of the affected router you disable the remote management interface this way which might cause problems for your ISP and thus for your connectivity. Same is if you would just move the service to another port unknown to the ISP.

  • packet filter will accept only the ISP server IP. Is it sufficient to solve the problem ? – MOHAMED Nov 30 '16 at 14:34
  • The new random port will be communicated to the ISP throught the TR-069 mechanisme – MOHAMED Nov 30 '16 at 14:34
  • @MOHAMED: unless the attacker has hacked the ISP too this is probably safe. I don't know if you still need to change the port if you restrict the IP address to the ISP at all. – Steffen Ullrich Nov 30 '16 at 16:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.