How to find potentially compromised ASUS routers in your network

Backdoored ASUS routers #

GreyNoise Intelligence has published a report describing a backdoor campaign affecting ASUS routers. ASUS routers exposed to the public Internet are being compromised, with backdoors being installed. Once compromised, these devices are then integrated into advanced persistent threat (APT) networks.

The report indicates that initial access is gained via brute-force login approaches and two previously undisclosed authentication bypass vulnerabilities (as of writing, neither of these vulnerabilities have been assigned CVEs). Once authentication has been bypassed, attackers can leverage known post-authentication vulnerabilities such as CVE-2023-39780 to execute arbitrary commands and install malicious software and arbitrary SSH keys.

Compromised devices appear to be running an SSH server on an unusual port, 53282.

What is the impact? #

Users who see an SSH server running on this unusual port should immediately investigate to ensure it is an expected service and not an indicator of compromise.

Are any updates or workarounds available? #

CVE-2023-39780, the post-authentication vulnerability, has been patched by ASUS, as have the additional authentication bypasses that are not yet assigned CVEs.

However, the backdoor SSH service and keys installed by attackers are not affected by firmware upgrades. Therefore, if there is any suspicion of compromise, the SSH configuration on these routers must be manually reviewed. Users should consider rotating all authentication tokens on these routers (passwords and SSH keys) and clearing affected devices' NVRAM through a factory reset (contingent on your own incident response procedures).

How do I find potentially compromised routers with runZero? #

From the Service Inventory, use the following query to locate potentially impacted assets:

_asset.protocol:ssh AND protocol:ssh AND port:53282

Additionally, runZero customers who are comfortable with command-line tooling can use our open-source SSH attack simulator, SSHamble, to scan suspected hosts for the attacker's public key:

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZJ8L5mzhhaxfGzpHR8Geay/xDlVDSJ8MJwA4RJ7o21KVfRXqFblQH4L6fWIYd1ClQbZ6Kk1uA1r7qx1qEQ2PqdVMhnNdHACvCVz/MPHTVebtkKhEl98MZiMOvUNPtAC9ppzOSi7xz3cSV0n1pG/dj+37pzuZUpm4oGJ3XQR2tUPz5MddupjJq9/gmKH6SJjTrHKSECe5yEDs6c3v6uN4dnFNYA5MPZ52FGbkhzQ5fy4dPNf0peszR28XGkZk9ctORNCGXZZ4bEkGHYut5uvwVK1KZOYJRmmj63drEgdIioFv/x6IcCcKgi2w== rsa 2048-020623

An example of this usage would be:

sshamble --pubkey-hunt-file asus-pubkey.txt --checks=pubkey-hunt -p 53282 network/16