1

My home network Edimax AR-7084gB ADSL modem/router with firmware verison 2.9.5.0(RUE0.C2A)3.5.18.0 was exploited from WAN few days ago. The attacker changed DNS server settings - primary server to 192.99.14.108 and secondary to 8.8.8.8. The first DNS server served a trojan virus (detected as Crypt3.NRM by AVG) via a fake Adobe Flash update page. My location is Czech Republic and media reported about the modem exploit with similar DNS settings so this was quite now common in my region.

I swapped the modem for a different one in the meantime (Siemens CL-040-I) which hopefully will not be compromised anytime soon. My question is what should I do in long term to prevent similar attack on the modem side? Sure I could set manual DNS server on all PCs but I dont want this because of administrative inconvenience. Will a common inexpensive brand new SOHO modem have a secure enough firmware to prevent most of the usual exploits? Are there any modem WAN security rankings that I could use then looking for new modem brand and model?

I updated firmware on the Edimax to version 2.11.38.0 (dated 2010-12-08, original version dated probably to 2007/2008) but I am not sure if that will be enough to prevent the exploits. Before the attack the modem had a custom weak password and with WAN administration disabled.

Edit: I realized that my WAN administration was enabled, because it is enabled in the factory settings (probably of all historical and current devices with Trendchip Front End since this Front End still ships with TP-Link or Edimax !!!) Such a factory settings is unbelievable... One has to explicitly forbid that in a custom Access Management setting. I guess most users won't do this after purchase anyways and thus reveal their login page into the public internet...

I also found the chipset type of the modem here (see "Specifikace"):

  • CPU: Trendchip TC3162P2

  • Front End: Trendchip TC3085 (web admin)

Improve this question

1 Answer 1

Reset to default
1

In security practices we try to patch the vulnerabilities. But if the patches are not available, we try to make attackers life hard by things like isolation.

  • There are huge problems with WAN Management in routers these days, you should disable it, if you really do not use it. Unlike modern OSes, patches for router OSes comes very hardly.

  • Many ADSL routers provide built-in firewalls in these days. Make sure Incoming Default Policy = Deny.

  • Limit WAN access IP if possible in your router and go to some different port for accessing console, if supports.

  • If your router supports you can try Open WRT like firmware/OS which has relatively good patching cycle.

Improve this answer
1
  • My WAN management was disabled. It seems like some other exploit was used (rom-0 etc?). But as you say it is about patching cycles. The best would be a modem with simple manufacturer-firmware that updates itself when needed... though I am not sure if something like that exists at all. Regarding Open WRT - probably a good solution, but I think it will take quite some time to find a compatible device, install it, set it up, than keep up to date etc. etc. - looks like loads of time to spend.
    – Kozuch
    May 14, 2014 at 18:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .