Hackers are exploiting a new zero-day flaw in GPON routers

Even after being aware of various active cyber attacks against the GPON Wi-Fi routers, if you haven't yet taken them off the Internet, then be careful—because a new botnet has joined the GPON party, which is exploiting an undisclosed zero-day vulnerability in the wild.

Security researchers from Qihoo 360 Netlab have warned of at least one botnet operator exploiting a new zero-day vulnerability in the Gigabit-capable Passive Optical Network (GPON) routers, manufactured by South Korea-based DASAN Zhone Solutions.

The botnet, dubbed TheMoon, which was first seen in 2014 and has added at least 6 IoT device exploits to its successor versions since 2017, now exploits a newly undisclosed zero-day flaw for Dasan GPON routers.

Netlab researchers successfully tested the new attack payload on two different versions of GPON home router, though they didn't disclose details of the payload or release any further details of the new zero-day vulnerability to prevent more attacks.

TheMoon botnet gained headlines in the year 2015-16 after it was found spreading malware to a large number of ASUS and Linksys router models using remote code execution (RCE) vulnerabilities.

Other Botnets Targeting GPON Routers

Earlier this month, at least five different botnets were found exploiting two critical vulnerabilities in GPON home routers disclosed last month that eventually allow remote attackers to take full control of the device.

As detailed in our previous post, the 5 botnet families, including Mettle, Muhstik, Mirai, Hajime, and Satori, have been found exploiting an authentication bypass (CVE-2018-10561) and a root-RCE (CVE-2018-10562) flaws in GPON routers.

Shortly after the details of the vulnerabilities went public, a working proof-of-concept (PoC) exploit for GPON router vulnerabilities made available to the public, making its exploitation easier for even unskilled hackers.

In separate research, Trend Micro researchers spotted Mirai-like scanning activity in Mexico, targeting GPON routers that use default usernames and passwords.

"Unlike the previous activity, the targets for this new scanning procedure are distributed," Trend Micro researchers said. "However, based on the username and password combinations we found in our data, we concluded that the target devices still consist of home routers or IP cameras that use default passwords."

How to Protect Your Wi-Fi Router From Hacking

The previously disclosed two GPON vulnerabilities had already been reported to DASAN, but the company hasn't yet released any fix, leaving millions of their customers open to these botnet operators.

So, until the router manufacturer releases an official patch, users can protect their devices by disabling remote administration rights and using a firewall to prevent outside access from the public Internet.

Making these changes to your vulnerable routers would restrict access to the local network only, within the range of your Wi-Fi network, thus effectively reducing the attack surface by eliminating remote attackers.

We will update this article with new details, as soon as they are available. Stay Tuned!