Thousands of ASUS Routers Hit by Persistent Backdoor

Someone – possibly nation-state hackers – appears to be constructing a botnet from thousands of Asus routers in hacking that survives a firmware patch and reboots. Nearly 9,000 routers have been compromised and the number is growing, say researchers.

See Also: Cracking the Code: Securing Machine Identities

Security firm GreyNoise warned Tuesday that hackers use a mix of known and previously undocumented vulnerabilities, including a command injection flaw tracked as CVE-2023-39780 to infect routers.

The tradecraft involved suggests “a well-resourced and highly capable adversary,” possibly one constructing an operational relay box. ORBs are a method embraced by advanced persistent threat groups including intelligence agencies across the globe to hide nefarious activity by bouncing internet traffic through a swirl of compromised Internet of Things devices. One cybersecurity company describes them as the offspring of a VPN and a botnet (see: Chinese Cyberespionage Groups Tied to ORB Network Attacks).

GreyNoise said it first spotted the campaign on March 18, dubbing the technique used to backdoor the routers “AyySSHush.” The intrusion chain begins with brute-force login attempts and two authentication bypass methods that do not have associated CVEs. After gaining access, attackers exploit CVE-2023-39780 to activate a security feature embedded into Asus routers by TrendMicro.

“Irony? Top Score. You love to see it,” wrote GreyNoise researcher Matthew Remacle.

The feature enables “Bandwidth SQLlite Logging,” allowing attackers to pass a string directly into a system() call. With that power, attackers enable secure shell and bind it to a TCP port, adding an attacker-controlled public key. That’s the step that makes firmware updates impotent against the hack. “Because this key is added using the official ASUS features, this config change is persisted across firmware upgrades. If you’ve been exploited previously, upgrading your firmware will NOT remove the SSH backdoor,” Remacle wrote.

Censys search records 8,645 compromised routers as of publication.

ASUS patched CVE-2023-39780 in recent firmware updates. But the devices compromised before patching may still harbor the backdoor unless administrators review SSH configurations and remove the attacker’s key removed. GreyNoise recommends a full factory reset for suspected compromises.