UPnProxy and 'EternalSilence' being used to exploit routers

This vulnerability is being exploited in a family of infections referred to as ‘EternalSilence’. These new attacks are believed to be leveraging the Eternal family of exploits, which were used in the WannaCry and NotPetya campaigns.

It’s unclear what the attackers’ intentions are. In previous cases where SMB services have been targeted, attacks such as ransomware and data exfiltration have been carried out.

According to Akamai, there are currently 45,113 known exploited routers worldwide. 

If an attacker is able to insert NAT rules on your router, then they can expose internal services to the internet, to be able to launch attacks directly against those services, from anywhere in the world.

If your router has UPnP enabled and port 1900 is available from the internet, you are likely to be at risk.

Most known affected devices are consumer-grade network hardware. A list of known exploited brands and models is available at the end of this report: 
Akamai whitepaper External Link

Other brands or models may be vulnerable, even if they are not on that list. 

Due to the nature of this vulnerability and the way it’s being exploited, it can be difficult to tell if you’ve been affected.

The researchers of the vulnerability recommend scanning endpoints and auditing entries into your NAT tables.

Further information is available from the Akamai website External Link

If your router is vulnerable to this attack, CERT NZ recommends taking the following steps:

• disable UPnP services on the router. Note: this may affect functionality of devices on your network, or
• configure your firewall to block port 1900 from the internet. This would prevent any new rules from being added from the internet, while still allowing your internal network to make use of UPnP.

If the above mitigations are not possible, replace the router with one that isn’t vulnerable to this type of attack, or will allow for these preventions to be configured.

In all cases, we recommend updating your routers firmware.

If your router has been exploited, you will also need to remove the NAT rules that had been added. This might involve rebooting the router or reinstalling the router firmware.