Is your Asus router part of a botnet? How to check - and what you can do

Do you own an Asus router? If so, your device may have been one of thousands compromised in a large campaign waged by cybercriminals looking to exploit it. In a blog post published May 28, security firm GreyNoise revealed that the attack was staged by what it suggests is "a well-resourced and highly capable adversary." Also: Massive data breach exposes 184 million passwords for Google, Microsoft, Facebook and more To gain initial access, the attackers used brute-force login techniques and two different methods to bypass the built-in authentication. They were also able to exploit certain vulnerabilities not yet assigned official CVE numbers. Once they'd accessed the router, they were able to run arbitrary system commands by exploiting a known security flaw labeled CVE-2023-39780. In a statement shared with ZDNET, Asus acknowledged the vulnerability and said that it had sent a push notification to customers advising them to update the firmware on their devices. Actually disclosed in 2023 as recorded in the company's Product Security Advisory, the flaw's entry is dated Nov. 3, 2023, and is listed as "RT-AX55 security update notice for CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348." All of those are the same as CVE-2023-39780, according to Asus. Though no malware was actually installed, the attackers certainly left their mark. By using built-in Asus settings, they were able to set up SSH access, a secure way to connect to and control a remote device. They also in...