May 23, 2016 By Larry Loeb 2 min read

Ubiquiti Networks issued a security alert this week that advised users to update their airOS router firmware. This was in response to reports that the company’s routers had seen infections performed by a worm.

The alert noted that two different payloads are operating with the same exploit. However, the exploit in question was reported and patched in July 2015.

Updating the Ubiquiti OS

The company released version 5.6.5 of the airOS, which features some additional security improvements. These improvements include disabling custom scripts usage and enabling syslog by default.

The new OS version will remove the worm from devices. Ubiquiti also released a separate worm removal tool in the form of a Java JAR file.

The worm targets routers, access points and other devices running outdated versions of the airOS firmware. The underlying problem appears to be an arbitrary file upload vulnerability that can allow an unauthenticated attacker to gain access to the device through HTTP/HTTPS.

What the Worm Does

The worm functions by creating a self-replicating virus that gains entry through the use of the ogin.cgi file. The malware uses the default credentials for Ubiquiti devices to log into these routers.

It first leaves a copy of itself as well as a backdoor account on the device. Then it adds rules entries that prevent an admin user from accessing the administration panel through the Web interface and gains persistence on the system.

Finally, the worm downloads a copy of the open-source cURL utility, which it uses to spread to other routers, either on an internal network or the Internet.

Symantec thinks that the worm is not doing any actual damage — for now. “So far this malware doesn’t seem to perform any other activities beyond creating a backdoor account, blocking access to the device and spreading to other routers,” the firm wrote. “It’s likely that the attackers behind this campaign may be spreading the worm for the sheer challenge of it. It could also be evidence of an early, exploratory phase of a larger operation.”

Lessons Learned

The takeaway here is how difficult network security is, particularly with regard to the Internet of Things (IoT).

Even though the exploit used by the worm was previously fixed, many routers are still unpatched and vulnerable. The secure maintenance of all the disparate elements of common networks will require a level of vigilance that many may not yet appreciate.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today