Technology

59724 readers

3484 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

310

Thousands of hacked TP-Link routers used in years-long account takeover attacks (arstechnica.com)

submitted 4 weeks ago by return2ozma@lemmy.world to c/technology@lemmy.world

62 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] finitebanjo@lemmy.world 4 points 4 weeks ago* (last edited 4 weeks ago)

If you don't use Microsoft Azure cloud services then it shouldn't matter, for now. Might want to just avoid running those for a little while.

The article also says:

It’s unclear precisely how the compromised botnet devices are being initially infected. Whatever the cause, once devices are exploited, the threat actors often take the following actions:

Download Telnet binary from a remote File Transfer Protocol (FTP) server

Download xlogin backdoor binary from a remote FTP server

Utilize the downloaded Telnet and xlogin binaries to start an access-controlled command shell on TCP port 7777

Connect and authenticate to the xlogin backdoor listening on TCP port 7777

Download a SOCKS5 server binary to router

Start SOCKS5 server on TCP port 11288.

So maybe setting up some firewall rules could also help prevent further problems.