Router was hacked

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
whoppr
DD-WRT Novice


Joined: 03 Aug 2019
Posts: 6

PostPosted: Sat Aug 03, 2019 13:56    Post subject: Router was hacked Reply with quote
Hi...

I own a E4200 router and found my router was hacked. I had *stock* firmware from linksys on there and went to log in and found DD-WRT installed.

A helpful person on another forum suggested there are some BotNets out there and that may be my issue.

The default password does not work. I assume it is admin/password. So someone installed and changed the password.

Oddly enough I can get to the admin page remotely, but cannot on the local network.

Does anyone have any experience with this?

The short of it is I would like to put the stock firmware back on to make sure I erased the malware image and then maybe install a clean DD-WRT install. How do I go about this especially since I cannot log in?

Has anyone seen this before?

Thanks
Sponsor
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 6973
Location: Texas, USA

PostPosted: Sat Aug 03, 2019 15:33    Post subject: Reply with quote
Reset button. Do a hard reset and reboot and re-configure or re-flash locally. And never, ever open remote management without locking it down properly.
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 6973
Location: Texas, USA

PostPosted: Sat Aug 03, 2019 20:00    Post subject: Reply with quote
Only need for JTAG is is CFE got blown out. Serial / TFTP recovery is probably easiest, if you have to go that far because a 30/30/30 doesn't reset it.
whoppr
DD-WRT Novice


Joined: 03 Aug 2019
Posts: 6

PostPosted: Sun Aug 04, 2019 14:34    Post subject: Reply with quote
d0ug wrote:
I would reflash the thing after you get it reset. No telling if the firmware was modified and is compromised in some way. If they did mod it, it is also possible that the default password has been changed that a factory reset will not reset it. You might be dealing with an essentially "bricked" router unless you can TFTP or JTAG flash it.

out of the box, ddwrt has no "default" password. It prompts you to create a new user/password the 1st time you open the web ui.


That was my thought. I dont trust the build for obvious reasons. I had trouble using chrome of all things to do the re-flash. I put dd-wrt.v24-30880_NEWD-2_K3.x_mega-e4200.bin on it and was able to do a 30/30/30 reset. I wanted to just get something else running on the router.
It did indeed prompt me for a new password and think I am good to go.

Re kernel-panic69, I thought I had it locked down properly but evidently I did not. I would be curious whether the stock firmware has another vulnerability or whether this was re-imaged through remote management.

Loaded question. Now that I have this 'bad' image off, what image should I be running? Now that I am taking a fresh look at this curious whether I should be running K3.x or K2.x or stock. I saw a blog posting Steve Jenkins did and saw that the stock image performed better, but was curious if anyone has any experience with this.

I can post on another thread since it is a little out of scope of my original posting.

Thanks again everyone
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 6973
Location: Texas, USA

PostPosted: Sun Aug 04, 2019 17:29    Post subject: Reply with quote
I just got done flashing today's build DD-WRT v3.0-r40527 mega (08/04/19), so far, so good. I still have some configurations to check and test, but otherwise, all good. If you stuck at 30880, you'd want the K2.6 build (the one he recommended in that blog), but otherwise, a much newer K3.x would be ideal. There have been so many patches since that old build. I wouldn't recommend a K2.6 build after 35531, though, especially if you run scripts via commands tab.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum