Is the Mirai malware attacks related to the TR-069 is a classic port attack?

Question

Refering to the following topic: http://arstechnica.com/security/2016/11/notorious-iot-botnets-weaponize-new-flaw-found-in-millions-of-home-routers/?utm_content=buffer8f018&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer

There is a Mirai malware attacks related to the TR-069. which use the TR-069 opened port 7547 to make attack.

Is it a classic port attack?

I think to fix that attack I have:

1. to use a random port for each device instead of the known port 7547
2. to add a firewall rule in my iptable. The firewall rulle will allow to accept connection request of the opened port from only a know IP address

Are my suggestion is sufficient to protect my devices against this attack?

Answer 1

I have no idea what you consider a "classic port attack" but this attack uses a security problem at the application layer and is thus more comparable to attacks against web applications. In fact this is an attack which uses a security problem in the processing of a SOAP request delivered through HTTP.

While you can block connections attempts with a packet filter in front of the affected router you disable the remote management interface this way which might cause problems for your ISP and thus for your connectivity. Same is if you would just move the service to another port unknown to the ISP.