0

Two days ago I installed a new router. It was a new TPlink AC1900. I established a password for the web admin, went through the quick setup questions, changed the IP ranges for the DHCP service from the default 192.168.0.1 to 192.168.1.1 to match my prior router. Those were the only changes I made as far as I could tell. I didn't change or turn on port forwarding or set up VPNs or gateways. I also upgraded the firmware and downloaded the tplink app onto my ipad (but didn't create a cloud account) and made sure the app could connect ok.

Among the devices on my LAN is my main desktop computer which runs linux mint version 18.3. The VNC/desktop sharing service is enabled but doesn't require a password (one of many problems this experience has taught me). On this computer I also have a libre calc file, not password protected (another problem), that contains all my website usernames and passwords. This password document does not have a filename that would suggest it was a file containing passwords, so it's possible it was already open when I got hacked because it'd be amazing if they guessed they should open that specific file.

This morning when I woke I turned on the monitor (I often forget to turn off the computer for the night) I noticed activity on the screen. On the task bar were a 15 or so open folders, all open to my home folder. Cinnamon melange debugger was open. A desktop sharing session was active to an external IP address I didn't recognize. My libre office password file was open, and in the last rows of the spreadsheet the following had been typed: cmd.exe /c PowerShell -ExecutionPolicy Bypass ...blah blah blah a bunch of other stuff...

and the following was being typed when I realized what was going on and pulled the network cable:

rcmd.exe /c PowerShe

I assumed this was the result of someone having exploited my new router somehow. I logged in using the password I had created at install and under "Advanced Routing" there was an entry for a gateway IP address I didn't recognize. My IP Address is currently A.B.C.D but the gateway listed had an IP with a similar but not same address A.B.C.Z. No ports were being forwarded to explain how my desktop was being accessed.

I'm wondering how this all happened. I suspect some sort of script/bot found a way to log into my desktop via VNC but didn't realize I was linux rather than windows and that's why it was typing those commands into my libre calc document instead of a command line. But how did the script get behind my router when I hadn't set up any port forwarding? I discovered there is a router account named admin with password admin that I didn't realize was there (the web interface using a separate password), but my router does have the "remote management" option enabled.

I already know I need to add a password to my VNC server and store my passwords in keypassx or some other password-protected, encrypted document. I have reverted to my old router for now.

  1. Based on what I've written, do you suspect the new router was the vulnerability or is it my linux mint computer?
  2. Is there a way to see on my mint computer what specifically was accessed or how it was accessed? I left the computer on after I unplugged the network.
Improve this question
2
  • What service can you log into with admin:admin on the router? That sounds like a likely source of compromise. Did you check your computer's logs?
    – multithr3at3d
    Jun 10, 2020 at 3:38
  • Agree with the above, but before investigating further make sure you have changed all those compromised passwords - or it won't just be your computer that gets hacked!
    – Unencoded
    Jun 10, 2020 at 8:16

1 Answer 1

Reset to default
3

I believe I found the vulnerability. On my linux box's Desktop Sharing app I had enabled "Automatically configure UPnP router to open and forward ports" a long time ago without realizing it. My old router did not support UPnP so it hadn't been an issue. Not only does my new router support it, but it apparently is enabled by default (WTF TPLink thanks for that!). When I run a port scan against my IP address with my desktop computer off, no ports were open. When I run a port scan with my desktop computer connected, the default VNC port 5900 was open, and sure enough on the router a port forwarding rule had automatically been created via UPnP.

My suspicion was that a bot port scanner discovered my open VNC port and connected to it, then tried a bunch commands intended to install malware/ransomware on a windows machine. It probably opened my formerly-unlocked password file via a custom hotkey I have (SuperKey+P), and all my open folders to home were probably the SuperKey+E, and Cinnamon melange window was probably opened via SuperKey+L.

And the admin:admin user was actually not for the router but for USB sharing which I have disabled.

And indeed I plan to spend the rest of the day updating all my passwords.

Improve this answer
3
  • as you will be changing your passwords, use a password manager. It will encrypt everything, create very strong passwords, and support TOTP.
    – ThoriumBR
    Jun 10, 2020 at 16:02
  • yes thanks! I intend to use KeePassX
    – Glenn
    Jun 10, 2020 at 16:07
  • 1
    Thanks for posting your findings Glenn, and good detective work! I'm afraid to say UPnP is pretty common these days, manufacturers continue to put ease of use above security. With that said, this suggests that your VNC software actually thought it would be a good idea to request that your router forwards the port from the internet, which would ridiculous behaviour if true. Alternatively - and more frighteningly - it could be that your router is vulnerable to public UPnP manipulation, which is still a common issue in 2020: tomsguide.com/uk/us/home-router-security,news-19245.html
    – Unencoded
    Jun 10, 2020 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.