Thousands of ASUS Routers Hacked? The Facts

Yes, in early 2024, thousands of ASUS routers were compromised in a coordinated attack that exploited a known vulnerability, but the number is far smaller than the 1.2 million devices initially feared. The attack targeted a specific model, the RT-AX56U, using a vulnerability that ASUS had already patched, meaning most affected users had not applied the available firmware update.

What Actually Happened

The attack came to light in March 2024 when reports surfaced of a large-scale compromise of ASUS routers. Initial estimates suggested that up to 1.2 million devices were at risk, but further investigation by security researchers and ASUS narrowed the actual number of compromised devices to around 3,000 to 5,000. The attackers exploited CVE-2022-35405, a command injection vulnerability in the router’s web interface, which had been patched in ASUS firmware updates released in late 2022. The attack used a botnet to scan the internet for vulnerable RT-AX56U routers and then attempted to log in using a list of common credentials. Successful exploitation allowed the attackers to change DNS settings, redirecting traffic to malicious servers.

Why the RT-AX56U Was Targeted

The RT-AX56U is a popular mid-range Wi-Fi 6 router, widely used in homes and small offices. Its popularity made it an attractive target, but the specific reason it was vulnerable was that many users had not updated their firmware. The exploit used a known vulnerability that had been fixed, so the attack was essentially a race between the attackers and users applying the patch. The attackers also used a technique called “credential stuffing,” where they tried username and password combinations leaked from other breaches. This is why using the default admin/admin password or a weak password made the attack much more likely to succeed.

How the Attack Worked

The attack unfolded in several stages:

• Scanning: The botnet scanned the internet for RT-AX56U routers with the web management interface exposed to the internet.
• Exploitation: The attackers sent a specially crafted HTTP request to the router’s web interface, exploiting CVE-2022-35405 to execute arbitrary commands.
• Credential Stuffing: The attackers then attempted to log in using a list of common credentials, such as admin/admin or admin/password.
• DNS Hijacking: Once logged in, the attackers changed the router’s DNS settings to point to malicious servers controlled by them.
• Traffic Redirection: The malicious DNS servers redirected users to phishing sites or injected malicious content into web pages, potentially stealing credentials or delivering malware.

How to Check If Your Router Is Affected

If you own an ASUS router, especially an RT-AX56U, here are the steps to check if you are affected:

1. Check your DNS settings: Log into your router’s admin page and look at the WAN or Internet settings. If the DNS server addresses are not the ones provided by your ISP or are unfamiliar, you may be compromised.
2. Update firmware: Go to the router’s administration page and check for a firmware update. Install the latest version immediately.
3. Change your admin password: If you haven’t already, change the router’s admin password to a strong, unique one.
4. Reset to factory defaults: If you suspect compromise, perform a factory reset and reconfigure the router from scratch.

How to Protect Your Router

Preventing this type of attack involves a few simple but critical practices:

• Enable automatic firmware updates: Most modern routers, including ASUS, offer an option to automatically install updates. Turn this on.
• Disable remote management: Unless you absolutely need it, turn off the “Access from WAN” or “Remote Management” feature. This prevents attackers from reaching your router’s admin interface from the internet.
• Use a strong admin password: Never use the default password. Create a long, unique password that you don’t use anywhere else.
• Disable UPnP if you don’t need it: Universal Plug and Play can be convenient, but it can also expose services to the internet. Turn it off if you don’t use it.

What ASUS Did in Response

ASUS released a security advisory and urged users to update their firmware immediately. They also pushed out an automatic update to some affected routers, but this only worked if the router was still under the company’s cloud service and had the default settings. For most users, the onus was on them to manually update. The company also improved its firmware signing and added more rigorous security checks to prevent similar attacks in the future. However, the incident highlighted a broader issue: many users never update their router’s firmware, leaving them vulnerable to known exploits.

Comparison with Other Router Attacks

This attack is not unique to ASUS. Similar campaigns have targeted other router brands, such as D-Link, TP-Link, and Netgear. For example, in 2021, a botnet called “Mirai” targeted D-Link routers using a default password vulnerability. The ASUS attack is notable because of the scale of the initial scare and the fact that it used a patchable vulnerability. The key takeaway is that router security is often neglected, and attackers know this. Unlike a smartphone or computer, a router is a “set and forget” device for many people, making it a prime target for exploitation.

Frequently Asked Questions

How do I know if my ASUS router has been hacked?

Signs include a changed admin password, unfamiliar DNS settings, slow internet, or being redirected to unexpected websites. You can check your DNS settings by logging into the router’s admin page and looking at the WAN/Internet settings. If you see IP addresses that aren’t from your ISP, you may be compromised.

Can I recover a hacked ASUS router?

Yes, you can. Perform a factory reset by holding the reset button on the back of the router for about 10 seconds. Then, log in with the default credentials (usually admin/admin), update the firmware immediately, and set a new strong admin password. Reconfigure your Wi-Fi settings and change your Wi-Fi password as well.

Is my ASUS router safe if it’s not an RT-AX56U?

While the specific attack targeted the RT-AX56U, other ASUS models may have similar vulnerabilities. Always keep your firmware up to date and follow the security practices mentioned above. Check ASUS’s security advisory page for any alerts related to your model.

Should I stop using ASUS routers?

No. The attack was not a flaw in ASUS’s design but a failure to apply a patch. ASUS is a reputable brand, and their routers are generally secure if properly maintained. The same risk applies to any router brand if you don’t update it.

How often should I update my router’s firmware?

You should check for updates at least once a month, or enable automatic updates if your router supports it. Firmware updates often include security patches for newly discovered vulnerabilities, so staying current is crucial.

What should I do if I see unknown devices on my network?

If you see unknown devices, it could be a sign of a compromised router. Change your router’s admin password and Wi-Fi password immediately. Also, check your router’s connected devices list and block any that you don’t recognize. After that, update your firmware and consider a factory reset.

Related

• Cheap Mechanical Keyboards: What to Know Before Buying
• 1Password vs Keeper: Which Password Manager Wins?
• Midnight Blizzard Breach: Why Identity Trust Failed