Ubiquiti Networks issued a security alert this week that advised users to update their airOS router firmware. This was in response to reports that the company’s routers had seen infections performed by a worm.
The alert noted that two different payloads are operating with the same exploit. However, the exploit in question was reported and patched in July 2015.
Updating the Ubiquiti OS
The company released version 5.6.5 of the airOS, which features some additional security improvements. These improvements include disabling custom scripts usage and enabling syslog by default.
The new OS version will remove the worm from devices. Ubiquiti also released a separate worm removal tool in the form of a Java JAR file.
The worm targets routers, access points and other devices running outdated versions of the airOS firmware. The underlying problem appears to be an arbitrary file upload vulnerability that can allow an unauthenticated attacker to gain access to the device through HTTP/HTTPS.
What the Worm Does
The worm functions by creating a self-replicating virus that gains entry through the use of the ogin.cgi file. The malware uses the default credentials for Ubiquiti devices to log into these routers.
It first leaves a copy of itself as well as a backdoor account on the device. Then it adds rules entries that prevent an admin user from accessing the administration panel through the Web interface and gains persistence on the system.
Finally, the worm downloads a copy of the open-source cURL utility, which it uses to spread to other routers, either on an internal network or the Internet.
Symantec thinks that the worm is not doing any actual damage — for now. “So far this malware doesn’t seem to perform any other activities beyond creating a backdoor account, blocking access to the device and spreading to other routers,” the firm wrote. “It’s likely that the attackers behind this campaign may be spreading the worm for the sheer challenge of it. It could also be evidence of an early, exploratory phase of a larger operation.”
Lessons Learned
The takeaway here is how difficult network security is, particularly with regard to the Internet of Things (IoT).
Even though the exploit used by the worm was previously fixed, many routers are still unpatched and vulnerable. The secure maintenance of all the disparate elements of common networks will require a level of vigilance that many may not yet appreciate.