Any idea which routers were vulnerable to this? Article didn’t seem to specify.
I answered this in my top-level comment. (And agreed: the article originally posted is useless. OP has since changed the link to the one I found.)
This article gives no details, but here’s a relevant bit from another article:
Cybercriminals not linked with the GRU (Russian Military Intelligence) first infiltrated Ubiquiti Edge OS routers and deployed the Moobot malware, targeting Internet-exposed devices with widely known default administrator passwords.
Subsequently, the GRU hackers leveraged the Moobot malware to deploy their own custom malicious tools, effectively repurposing the botnet into a cyber espionage tool with global reach.
[…]
“Additionally, in order to neutralize the GRU’s access to the routers until victims can mitigate the compromise and reassert full control, the operation reversibly modified the routers’ firewall rules to block remote management access to the devices, and during the course of the operation, enabled temporary collection of non-content routing information that would expose GRU attempts to thwart the operation,” the Justice Department said.
And here is the press release:
Based on this article it sounds like as long as you don’t have open ports for remote administration open and/or if you’ve changed the default admin password you SHOULD be ok? I’m curious to see what recommendations Ubiquiti has regarding this.
That’s what the released information information suggests, yes. (Edit: Assuming you took those precautions before the original attack, of course.)
Makes me glad I replaced the firmware on my Unifi devices with OpenWrt
OpenWrt has an admin password and UI as well. I hope you changed the former and blocked the latter on external ports, before connecting it to the internet.
Yes of course I changed the root password, I think it would actually be quite difficult not to do that on OpenWrt as it warns you if the password isn’t set.
Was the exploit not related to unifi’s remote / cloud administration features? That’s how I read it, unless they mean remote admin that was installed by the malware.
UniFi and Edge are different product lines. UniFi uses a controller (local or cloud-based) and edge products are the more traditional interface on the device itself.
The article clearly states that edgerouter is the affected product, which means the default password and remote admin interface were the attack vectors.
Thanks, I find the names of Ubiquiti’s product lines pretty confusing particularly as they are often used together.
I have an Edgerouter X, an Edgerouter PoE-5, two UAP-AC-LR (“Ubiquiti UniFi-AC-LR”) access points, and one UAP-AC-MESH (“Ubiquiti UniFi-AC-MESH”) access point.
The access points came with UniFi firmware, whereas the routers were running EdgeOS. I’m no longer using the PoE-5 and I’ve replaced the firmware on all of the other devices with OpenWrt.
