router security after ransomware attack

[#1]

hi all, I was hit by a phobos ransomware crypto virus yesterday, which I am pretty sure infiltrated a brute force attack thru a port forward instruction for a remote desktop connection, despite high level randomly generated password for that connection.

I am dealing with the infection itself separately, and obviously have now closed all the ports that were forwarded on the router. my question is, has the router itself been compromised? do I need to factory reset or change the login admin credentials?

w.

[#2]

Hey @whatsisname22,

Thanks for getting in touch.

I'm really sorry to hear your router has been attacked by this virus.

I would suggest factory resetting the router for now, I've sent an email to our products team to find out more info if your router has been compromised and what the next steps would be.

Thanks.

[#3]

hi mads, thanks for the reply. will I be able to speak to someone tomorrow about this? I'm reluctant to even use the router until I know the score.

if I do reset, what information will I need to get up and running again? just user name and password?

[#4]

No worries @whatsisname22.

It can take up to 24-48 hours sometimes for a response, but I'll chase it for you tomorrow when I get in at 13:30.

That's correct.

Thanks.

[#5]

ok great thanks mads.

[#6]

Turn off remote desktop connection.

[#7]

yes for sure will turn off remote desktop access from outside my home network. I access my media server machine via remote desktop from my android on my home lan as it's not got a monitor. using remote desktop in this way ie exclusively within the home lan should be ok shouldn't it?

I did have a port forward set up for remote desktop from outside the home lan, with a huge password created by a true random password generator. I though that was ok. clearly I was mistaken.

[#8]

Out of curiosity @whatsisname22 what length of password were you using?

[#9]

I suggest logging into the Plusnet "Member Centre" and then setting Plusnet's network level "Broadband Firewall" to the "High" setting,  to stop ALL externally initiated network sessions from reaching your WAN connection - at least until you are sure that your router is safe again.

I'd also ensure in your home router configuration that "UPnP" is DISABLED to prevent anything on your LAN silently opening any port forwards on your router's firewall.

[#10]

Hi @whatsisname22 

I've managed to get in touch with one of the products team internally (though, it's just my luck the only one I managed to get hold of is a Fixed Line guru, rather than Router Security wizard). 

All the same, they have said that they are going to pass this across to the correct person to look into, so I would expect either someone to reply on here, or, to send me some info (in which case I will update thew thread again). 

Hold tight and I'm sure we will get back in touch soon. 

Thanks,

MoR

[#11]

Hi @whatsisname22 

We have had this reply from Products:

"This customer’s router is highly unlikely to be compromised and any port forwarding/local network access the virus/malware was granted is likely to have been the result of UPnP rather than an explicit port forward.

A factory reset will wipe the memory/config and there’s no method I’m aware of that would result in anything nasty lingering after doing so.

All of this is irrelevant though if the customer still has infected machines that they plan on connecting to the router."

I hope it gives you some peace of mind - have you performed a reset as of yet? 

Thanks, 

MoR

[#12]

@MasterOfReality 

Is the Hub One default condition for uPnP the same as for the Smarthub, that is set to On after a factory reset? If so should the OP (and in my opinion, every other user unless they really need it) be advised to turn it off?

[#13]

Hi @Baldrick1 

I can't answer this right off the bat i'm afraid - I'll reply to products asking for clarity on whether uPnP is set to On after a reset. 

Thanks, 

MoR

[#14]

@Baldrick1 - I got a reply quick sharp 

"UPnP will be on by default with extended security enabled, and this is how I would recommend it is left for most customers"

Thanks, 

MoR

[#15]

I guess that this recommendation is to make the router as simple to use as possible for the average user. I will keep mine switched Off https://www.howtogeek.com/122487/htg-explains-is-upnp-a-security-risk/