ALERT: Major attack to Routers. 41 Million Routers worldwide on risk.

alarmMajor attacks to routers are currently ongoing. These attacks already resulted in major outages of the German Telekom network and others in many countries.

The attack is using an old vulnerability on port 7547. This port is basically the interface for the Telecom companies to configure a router remotely. A variant of Mirai currently uses this vulnerability to install a bot using this interface.

Here is, what you can do:

1.) Restart your router

This will clean your router in case it was already affected. However, even after a restart, it may happen that the router will get infected shortly after by another attack as this attack is currently still going on.

2.) Check if your router is vulnerable

For this, you need to perform a reverse (from outside) Portscan on your public IP Address and Port 7547 by following these steps from NetworkToolbox:

– Select the Devices Tool
– Tap on Network
– Locate the Public IP Address
Take down this public IP Address (or bookmark to the Logbook)
Switch off (disable) WiFi mode on your device

Next, ensure that NetworkToolbox can use the Celular/Mobile network as follows:

– Quit NetworkToolbox
– Open Settings
– Tap on Celular Data
– Search for “NET-Toolbox” on the list
– Ensure that the switch for NET-Toolbox is switched ON

Then:

– Reopen NetworkToolbox
– Tap on the Portscan Tool
– As Address, enter the Public IP address you took down previously
– As Port enter 7547
– Tap on Scan

You should get an empty list (0 Results). If that’s not the case, your router might be vulnerable.

3.) Protect your router

First of all, you should look for a firmware update. German Telekom currently provides an update for the effected router which is installed automatically after restarting the router. Other may need to look for a router update on the suppliers/vendors website.

After an update has been installed, I would recommend to perform another portscan.

In addition, I suggest to disable this port if possible. Some Routers, like the German Telekom Routers, offer an option to disable the remote configuration feature which will also disable port 7547. On the German Speedport routers this feature is called “Easy Support”. On other routers it might be called “TR-069” or similar.

I would suggest to switch this feature completely off. Please note: if you are using a rented router, your provider may not be happy about this as they can no longer look into your router in case of issues.

Once the port can not be accessed from outside, you should be safe.

Some more background information:

As mentioned before, port 7547 will be used for remote access configurations on your router using a so called TR-069 interface. This interface is quite safe as it uses a callback feature that ensures that only the valid provider can access and change the configuration data.

This interface will also be used for instance by a Synology NAS if you would allow the NAS to configure your router on your behalf for convenience.

However, due to a bug in older implementations of the TR-069 protocol, this interface can also be used for code-injection.

So an open port 7547 alone does not mean you are vulnerable but along with a buggy firmware you are.

Then, either updating the firmware or disabling TR-069 (or closing the port if the router offers such a possibility) would fix a possible issue. If possible, I would suggest to do both (updating and closing the port).