{"id":22599,"date":"2021-12-16T00:03:00","date_gmt":"2021-12-15T23:03:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=22599"},"modified":"2021-12-15T19:39:50","modified_gmt":"2021-12-15T18:39:50","slug":"hufige-login-versuche-an-routern-fritzbox","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2021\/12\/16\/hufige-login-versuche-an-routern-fritzbox\/","title":{"rendered":"Frequent login attempts on routers (FRITZ!Box)"},"content":{"rendered":"

\"Sicherheit[German<\/a>]Currently, owners of Internet routers – especially FRITZ!Box routers – are noticing recurring login attempts on their devices. At least, some readers have contacted heise with corresponding observations. And also during a short research I came across postings reporting access attempts from an IP 193.46.255.150 of the Dutch hoster Peenq. Here is a brief overview of this topic.<\/p>\n

<\/p>\n

\"\"I had addressed this topic back in March 2021 within my German blog post Achtung: Scans auf FRITZ!Boxen von IP-Adresse 185.232.52.55 (Port 443)<\/a>. At that time, there were more attempts to access routers (FRITZ!Box) from the Internet from the IP address 185.232.52.55, if port 443 is open. This was probably a port scan across the entire IP address range of the Internet, which has been running since 2020, and is intended to detect vulnerable routers.<\/p>\n

New Internet router login attempts<\/h2>\n

I came across the topic in the following tweet<\/a> from German site heise Security. It seems that readers have reported recurring login attempts in the logs of their routers.<\/p>\n

\"Internet-Router-Anmeldeversuche\"<\/a><\/p>\n

The question in the room is whether attack attempts are known and what can be done. The heise editorial team has summarized everything worth knowing about this topic in this German article<\/a>. The short version: By default, the FRITZ!OS on FRITZ!Box routers is set up in such a way that unauthorized third parties cannot access the router. The user interface is inaccessible for access from the Internet and password-protected for network access by the user.<\/p>\n

The reported cases of access attempts are from an IP range of the Dutch hosting provider Peenq<\/a> (IP 193.46.255.150). Also this abuse site<\/a> reports the IP, naming Bunea Telecom SRL in North Holland as the owner. There are numerous reports there from Nov\/Dec 2021 that this IP contacts the FRITZ!Box routers and logins are attempted.<\/p>\n

\"FRITZ!Box<\/p>\n

The manufacturer AVM is not aware of any wave of attacks – AVM has published this German article<\/a> on the subject. The heise article also contains some hints on what to do if necessary. On my FRITZ!Box I could not see any access attempts.<\/p>\n

Mikrotik router vulnerable<\/h2>\n

At this point, a short note to the operators of MikroTik routers. MikroTik is a Latvian manufacturer of routers and wireless ISPs that has sold over 2,000,000 units worldwide. Bleeping Computer colleagues report here<\/a> that about 300,000 MikroTik routers have critical vulnerabilities that malware botnets can exploit for cryptomining and DDoS attacks.<\/p>\n

In August 2021, the M\u0113ris botnet exploited vulnerabilities in MikroTik routers to build an army of devices that carried out a record-breaking DDoS attack on Yandex. MikroTik explained that the threat actors behind the attack exploited vulnerabilities that were fixed in 2018 and 2019 but were not applied by users. I had reported on the issue in September 2021 in the blog post MikroTik Security Advice (CVE-2018-14847)<\/a>.<\/p>\n

TPLink-Router vulnerable<\/h2>\n

In addition, there is this post<\/a> from the colleagues at Bleeping Computer, which reports that Dark Mirai botnet is attacking and taking over TP-Link routers via RCE vulnerability. The botnet was observed exploiting a new vulnerability in the TP-Link TL-WR840N EU V5.<\/p>\n

The vulnerability CVE-2021-41653 is caused by a vulnerable \"host\" variable that an authenticated user can abuse to execute commands on the device. TP-Link addressed the vulnerability by releasing a firmware update (TL-WR840N(EU)_V5_211109) on November 12, 2021. However, many users have not yet installed the security update.<\/p>\n","protected":false},"excerpt":{"rendered":"

[German]Currently, owners of Internet routers – especially FRITZ!Box routers – are noticing recurring login attempts on their devices. At least, some readers have contacted heise with corresponding observations. And also during a short research I came across postings reporting access … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[448,580],"tags":[587,69],"class_list":["post-22599","post","type-post","status-publish","format-standard","hentry","category-devices","category-security","tag-router","tag-security"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/22599","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=22599"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/22599\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=22599"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=22599"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=22599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}