The FBI has issued a security warning urging owners of old internet routers to replace their equipment, lest they become victims of a cyberattack.
The flash notice, issued May 7, said that “end-of-life” (EOL) routers, or those made so long ago that their software is no longer supported by their manufacturers, are being targeted by bad actors due to their age. With no patches or regular software updates to address security weaknesses, the outdated equipment becomes exceptionally vulnerable, allowing cyberattackers to access it remotely and install malware.
The targeted routers come pre-loaded with remote management software that threat actors know how to tap into, advised the notice. Once they do, they may install malicious software or set up a botnet − a group of internet-connected devices compromised and controlled by a third party that can then use them in an orchestrated manner to carry out activities such as stealing data, sending spam or committing denial-of-service attacks.
Cybercriminals may also use compromised devices to sell proxy services, which entails selling access to these devices to other bad actors who then use them to hide their locations and identities. This specific notice concerns known attacks associated with 5Socks and Anyproxy, services known for selling these proxies to shady figures that were recently seized by the FBI.
List of internet routers at risk
The vulnerable routers in question will be familiar to early internet users, as many are Linksys brand, one of the most popular and iconic at-home networking suppliers of the 2000s and 2010s.
-
E1200
-
E2500
-
E1000
-
E4200
-
E1500
-
E300
-
E3200
-
WRT320N
-
E1550
-
WRT610N
-
E100
-
M10
-
WRT310N
Signs your router may have been compromised
The remote administration feature that comes pre-installed on these routers is the major source of vulnerability, explained the FBI warning. Cybercriminals have become familiar with accessing outdated remote management software, allowing them to install their own software that gives them perpetual access to your device.
Even if the remote administration feature of your router is password protected, threat actors can still easily get in. The installed malware then allows them to communicate with the router periodically, ensuring continued access.
Because the malware is router-based, said the FBI, it can be more difficult for users to notice when something is wrong. While the agency suggests replacing any router from the above list altogether, the FBI did provide a list of file names you can check for that are associated with these attacks.
What to do if you have a router from the list
If you have a router from the above list, it may likely have been struggling already to keep up with the demands of a modern digital home. The best course of action is to replace it with a more modern model, advised the FBI notice, and one that is new enough that it is still being serviced with regular software updates.
Users can also disable remote administration and reboot their routers to cut off this primary access point.
If you believe your router or another device in your home may have been compromised or the subject of suspicious activity, the agency asks that it be reported to your local FBI field office. Field offices can be located and contacted at www.fbi.gov/contact-us/field-offices.
This article originally appeared on USA TODAY: These 13 internet routers are vulnerable to attacks, FBI says
