One Million ASUS Routers Under Control: Exploiting ASUS DDNS to MITM Admin Credentials
summary
Researchers demonstrate a reliable method to overwrite ASUS DDNS entries and force the official ASUS Router App to connect to attacker servers, using an open-source ASUS DDNS override tool on a cloud VM and listening on port 8443. The DDNS update accepts any 8-digit PIN, the app sends base64-encoded admin credentials on connect, and the team observes about 1.08–1.6 million vulnerable routers worldwide; demos on GCP show credential capture and large-scale DDNS misuse.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 6:44Investigation
- 8:42Attack Method
- 9:39Demo
- 13:05Impact
- 14:24Monitoring
- 17:23Research
- 18:47Assumptions
- 20:08IP addresses that alternate
- 21:42Multiple domains
- 23:41Residential ISP
- 25:23US DoD ISP
- 26:24Summary
related talks
40mAll Your LAN are Belong to Us. Managing the Real Threats to Remote Workers.
13mThe dark side of IoT
45mAirBnBeware: Short Term Rentals Long Term Pwnage
39mWho put the backdoor in my modem?
25mAdventures & Findings in ISP Hacking
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
29mAttack of the Clone Army
25mAttacking Mobile Broadband Modems Like a Criminal Would