Ubiquiti’s EdgeRouter ships with its config open to the internet and default credentials. The feds are telling everyone to secure their boxes and look for indications of compromise.

Ubiquiti, on the other hand, simply issued a broken patch. In today’s SB Blogwatch, we put the “quit” in Ubiquiti.

Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: Om nom no.

“Hacked EdgeRouters”
Military Unit 26165 cyberspies, part of Russia’s Main Intelligence Directorate of the General Staff (GRU) … are using these hijacked and very popular routers to build extensive botnets that help them steal credentials, collect NTLMv2 digests, and proxy malicious traffic. They’re also used to host custom tools and phishing landing pages throughout covert cyber operations targeting militaries, governments, and other organizations worldwide.
…
[So] the FBI says in a joint advisory issued with the NSA, the U.S. Cyber Command, and international partners. … The FBI is seeking information on APT28 activity on hacked EdgeRouters to prevent further use of these techniques and hold those responsible accountable. You should report any suspicious or criminal activities related to these attacks to your local FBI field office or the FBI’s Internet Crime Complaint Center.

“CVE-2023-23397”
The advisory comes two weeks after the U.S. government announced that in January it had disrupted a botnet that was being used by … APT28. Law enforcement was able to neutralize the malware network made up of hundreds of Ubiquiti routers — but despite this disruption, the FBI this week said that device owners should still take remediation steps to prevent similar compromises.
…
As early as 2022 … threat actors used default credentials and Trojanized OpenSSH server processes in order to access the routers, which they then leveraged to collect credentials, proxy network traffic, and host malicious landing pages. They also leveraged various custom post-exploitation tools, including a Python backdoor … capable of executing arbitrary commands. [They also] targeted zero-day vulnerabilities, including … CVE-2023-23397, which they leveraged to collect NTLMv2 digests from targeted Outlook accounts, [and] installed publicly available tools … to assist with NTLM relay attacks.

“Default credentials”
The U.S. Department of Justice, including the FBI, and international partners recently disrupted a GRU botnet consisting of such routers. However, owners of relevant devices should take the remedial actions described below to ensure the long-term success of the disruption effort and to identify and remediate any similar compromises.
…
Ubiquiti EdgeRouters … are often shipped with default credentials and limited to no firewall protections. … Additionally, EdgeRouters do not automatically update firmware unless a consumer configures them to do so. … Rebooting a compromised EdgeRouter will not remove the existing malware.

Now that is half on users and half on Ubiquiti since you can’t allow default credentials to remain unless they are properly randomized. Ubiquiti has updated their software so when you configure an EdgeRouter, it requires that you change the default login.

Ubiquiti used to be my go-to source for smaller SMBs: They had very efficient and cost-effective hardware, and a development team who was always on the ball.

But no more — they’ve jumped aboard the “profit is king” train, lost their most devout and knowledgeable technical staff, and are … expecting customers to simply replace their hardware every couple of years. When a product which just went EOL last year hasn’t received a firmware update in almost seven years, you get a rather foul taste in your mouth that makes you look elsewhere. … Unlike a decade ago, Ubiquiti is far from the only player in that segment.

There are lots of vendors churning out cheap garbage, often based on the same physical chipsets but with their own hacked together firmware. … Typically once deployed they never provide any firmware updates at all, and these devices might run for 10+ years unless the user chooses to replace them.
…
They would be much better off just shipping the cheap generic hardware with OpenWRT, at least then they could be easily updated if a problem is found, and the OpenWRT developers are a lot more vigilant than whoever kludges together [the] firmware.

Why are there still routers being made … that have:
a) default access credentials, and
b) a default interface accessible from outside the LAN?

A properly designed router/firewall will not allow installation without forcing the user to change the root/admin password to something not the default, first. It should have been designed that way from the start, and most of this stuff would not have happened.

This is an old problem that I thought had been mostly fixed.

Ubiquiti did release an update to address … default credentials. But unfortunately, and entirely predictably (as it’s Ubiquiti), it too showed a spectacular level of incompetence, … which made the protection entirely useless.
…
The first boot “change password” dialog [could] be dismissed with a press of the Escape button. … Either this was incompetence from the development team (although any developer with half a brain cell would have realised [it] was total nonsense), or the changes were specified by a lawyer who was only interested in doing the absolute minimum to cover the companies ****.

Recent Articles By Author