Your Asus router may be compromised - here's how to tell and what to do

Do you own an Asus router? If so, your device may have been one of thousands compromised in a large campaign waged by cybercriminals looking to exploit it. In a blog post published Wednesday, security firm GreyNoise revealed that the attack was staged by what it suggests is "a well-resourced and highly capable adversary." Also: Massive data breach exposes 184 million passwords for Google, Microsoft, Facebook, and more To gain initial access, the attackers used brute-force login techniques and two different methods to bypass the built-in authentication. They've also been able to exploit certain vulnerabilities not yet assigned official CVE numbers. Once they'd accessed the router, they were able to run arbitrary system commands by exploiting a known security flaw identified as CVE-2023-39780. Though no malware was actually installed, the attackers certainly left their mark. By using built-in Asus settings, they were able to set up SSH access, a secure way to connect to and control a remote device. They also installed a backdoor to return easily to the router's firmware without worrying about authentication. The backdoor was stored in non-volatile memory (NVRAM), which meant it couldn't be removed by rebooting the router or updating its firmware. To avoid being caught, the criminals even disabled logging, which would otherwise record their access. Also: Why no small business is too small for hackers - and 8 security best practices for SMBs Based on data from internet scanner Ce...