Linksys home broadband kit worm

PrzemoF

"The worm called “The Moon”, which began spreading between Linksys home broadband kit last week, has been confirmed as a problem with the devices' HNAP1 implementation, and an exploit has been made public."

http://www.theregister.co.uk/2014/02/17/linksys_vuln_confirmed_as_a_hnap1_bug/

White Heart Loon

More malware targeting household routers
http://arstechnica.com/security/2014/03/hackers-hijack-300000-plus-wireless-routers-make-malicious-changes/

infodox

Heh, yeah. I dropped the exploit a few hours after reversing the sample: http://pastebin.com/raw.php?i=6GDbYfmB

This was shortly followed by "Rew" dropping a second exploit which used the echo -ne stager I had redacted from mine to cripple it a bit. Although, the bind-shell payload is unreliable over WAN as most of these things have firewalls.

On the funny side, I noticed that the binaries seem to come with lists of IP ranges to scan, and seem to have rather elegantly put together networking protocols using SSL and suchlike, along with a whole "protocol" of messages for infected routers to tell eachother. Honestly looks to me like this is the "stage one" of a peer to peer botnet attempt using the routers. The code quality is also excellent, although the binaries should have been packed a little to save on space...