Draytek Router - Compromised

[crmcatee]

Helped a fellow I know out as he was having problems getting connected to his printer from any of the devices on his network. Used to work; now doesn't. His network was initially setup by someone else who's since moved.

After some initial investigations The printer could get an IP address and could be printed directly via IP but not using a higher service such as Bonjour or Windows Print. They didn't appear to those services on the network. Thought it must be DNS related.

After checking the DNS servers the secondary was listed as Googles 8.8.8.8 but the primary one was configured as 38.134.121.95 which I thought was just his ISP's. It wasn't though as it seems. At the time of testing it wasn't responding.

It transpires that he's been compromised and Draytek know about it so they have a fix.

https://www.draytek.co.uk/support/security-advisor...

Everything else was working, if his printer hadn't played up he'd have been none the wiser.


Now if only the idiot who set it up hadn't left it exposed and open to the Internet for administration.


If you've got one of these routers; I'd suggest checking it yourself.

[buggalugs]

I remember this from about 2 years ago, if you’re going to open up your routers admin page to the internet you really should keep it up to date.

[stemll]

Are you sure this isn't from a couple of years ago? The only date is "In May 2018, we became aware" and doubt it would have taken Draytek almost two years to patch this.

The firmware it lists for my model is 3.8.8.2 but my router is already running 3.9.1.3

[crmcatee]

It is from a couple of years ago - but I only fixed his this week so it's a heads up if you've got one of these to do it; he'd been quite happily working for a few years.

[bristolracer]

I was mailed this today

https://www.draytek.co.uk/support/security-advisor...

may be relevant or not depending on your kit

[buggalugs]

Interesting

I found some more detail about this 2020 vuln on the interwebs, I'm surprised it's restricted to that model of Draytek actually as the login page looks the same as every other Draytek out there...

https://sku11army.blogspot.com/2020/01/draytek-una...

Running the public facing login script as root is a bit of a fail.

Edited by buggalugs on Wednesday 12th February 15:00