Malicious Cisco router implant SYNful Knock more widespread than previously thought

By Shawn Knight
Sep 17, 2015
Post New Reply
  1. Researchers earlier this week uncovered malware actively targeting more than a dozen Cisco routers across four different countries. Dubbed SYNful Knock, the malware introduces a backdoor that grants attackers access to a targeted network.

    The attacks, as it turns out, are much more widespread than previously thought.

    As Ars Technica notes, a team of computer scientists from ZMap recently scanned the entire IPv4 address space in search of infected devices. They did this by sending out-of-sequence TCP packets to every Internet address, part of the method used to activate SYNful Knock. By doing this, the team found 79 devices across 19 countries were infected including an ISP in the US hosting 25 infected boxes.

    Security firm FireEye detailed SYNful Knock on September 15. It’s characterized by the fact that it loads each time the router is restarted and supports up to 100 modules that can be tailored to each target.

    It’s worth clarifying that SYNful Knock isn’t exploiting a vulnerability in Cisco devices. Instead, attackers appear to be taking advantage of routers that are using default passwords (or perhaps the attackers are using some other method to get passwords).

    Ars points out that it’s now clear that SYNful Knock is a professionally-developed, full-feature backdoor that’s likely state-sponsored. While it’s not outside the realm of possibility that some of the 79 infected devices in the recent scans are honeypots, odds are, not all of them are.

    Graph courtesy ZMap

    Permalink to story.

  2. G0DofPaiN

    G0DofPaiN TS Booster Posts: 55   +30

    As long as they watch my porn collection without disturbing me, who cares?
  3. Reehahs

    Reehahs TS Addict Posts: 164   +70

    No, they won't just stop there. They will use your webcam to take your picture and record your voice. This will be followed up by an extortion.
  4. G0DofPaiN

    G0DofPaiN TS Booster Posts: 55   +30

    Haha I dont have a webcam or mic. Only store games and programs and music, also don't have a router.
    Reehahs likes this.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...