Asus DSL routers hijacked DNS

[#1]

If you have an Asus DSL router that has the "Enable Web Access from WAN" option enabled then check whether your DNS has been hijacked.  I just noticed that my DSL AC-68U has had the DNS changed to 185.183.96.174 which is a known hijack DNS server.  I am on the latest firmware (3.0.0.4.380_7712-ga519811) but I guess this doesn't include some required security updates and hackers are able to access the setup page without needing the router password.

If your DNS has been changed then make sure you set it back to defaults or Google / OpenDNS settings.  Luckily I don't use the router DHCP server so this didn't actually impact me but is worrying that Asus have not publicised this security hole as far as I know.  You should turn off the web access option until the security holes are patched.

Even if you have the option "Connect to DNS Server automatically" enabled your actual DNS server may have been hijacked.  You can check this by going to the network tools and select NSLookup method and try apple.com - it should return something like this:

Name: apple.com
Address 1: 17.142.160.59
Address 2: 17.178.96.59
Address 3: 17.172.224.47

If you see some random looking names instead then it has been DNS hijacked.

Moderator's note by Mike (Mav): Post released from Spam Filter.

[#2]

Moderator's note by Mike (Mav): This thread is now in the appropriate board.

[#3]

Surely, unless you really, really, really have a need to access the router from outside your network it would be best to turn the option off.   If you must enable it - set a really good strong password.

I have an Asus router, however I use Merlin's firmware on mine and "Enable Web Access from WAN"  is turned off by default, not sure if that's the case with the standard firmware.