Your old router could be silently letting hackers into your PC, and you wouldn’t even know they were there.
Most people upgrade their PCs every couple of years but don’t extend the same courtesy to their routers. Therefore, the same router can easily stay plugged in for a decade. As long as the Wi-Fi works, no one thinks anything of it. But this is dangerous, and a new piece of malware called AryStinger is quietly taking advantage of this. So far, it’s taken control of more than 4,300 routers around the world. Yours could be next.
Not Your Typical Hack
AryStinger is a little different from your usual router attack. Typically, malware that targets home routers uses them to flood websites with traffic or send spam. AryStinger is not doing that. Instead, it turns infected routers into an invisible scouting network. The hijacked routers quietly scan the internet and gather information about potential targets. All of this takes place before an attack even begins. The hackers are using your hardware, initially, to carry out reconnaissance missions.
The routers at the center of this attack are older models built with chips manufactured by Realtek. The affected routers date roughly from 2012 to 2015, so these are significantly dated. Router brands involved include D-Link and Linksys, with one D-Link model accounting for nearly three quarters of all infections. AryStinger manages to take control of these routers due to vulnerabilities which are a decade old. Patches are readily available to plug these security holes, but many of the routers involved stopped receiving updates many years ago.
Once inside, AryStinger quickly and discreetly recruits the router into a fleet. With full control of the device, the attackers can assign it tasks remotely. These include scanning other devices on the internet, tunneling traffic to disguise the hackers’ location, and sending data back to the hackers. However, the router remains working normally, meaning the owner is unlikely to suspect anything. A second version of AryStinger has also been discovered. This variant is more powerful and able to run commands directly on the infected PC.
Don’t Fall Victim to Router Hacks
The AryStinger attack has targeted domestic routers, but its methods could easily be applied to business routers. Accordingly, you need to keep yours secure. Thankfully, a few simple steps go a long way:
- Retire legacy hardware: if your router is more than five to seven years old and updates are no longer being released for it, replace it. Without regular updates, any device is permanently vulnerable. If a security gap is present, hackers will always find it eventually – regardless of how carefully you browse online.
- Restrict remote router management: most routers have a setting that allows them to be accessed and configured remotely. This is one of the main ways attackers can get a foothold in your network. Therefore, you should restrict remote access privileges to only a few, and ensure activity is automatically logged and monitored.
- Check your router’s admin panel: a simple way to keep your router safe is analyzing the data within its admin panel. It sounds basic, but most people forget about it. In here, you should be able to see if there are any unfamiliar devices connected or unusual outbound traffic. If something looks suspicious, disconnect the router and contact an IT professional.
For more ways to secure and optimize your business technology, contact your local IT professionals.
