Draytek Router DNS Hijack

#Chri5# · 18 May 2018 at 16:41

https://twitter.com/GossiTheDog/status/997445209515536384

https://www.draytek.co.uk/support/security-advisories/kb-advisory-csrf-and-dns-dhcp-web-attacks

Looks best to disable remote management and check for any incorrect DNS / DHCP settings

bledd · 18 May 2018 at 16:51

Woof, sent this on to a relative that has a Draytek router.

EYEREX · 18 May 2018 at 19:03

Will this affect modems as well ie a Vigor 130 or as the DNS is handled by the router plus a Pi running NoTrack there ok

Admetos · 19 May 2018 at 01:03

EYEREX said:
Will this affect modems as well ie a Vigor 130 or as the DNS is handled by the router plus a Pi running NoTrack there ok

Just had a check on Drayteks firmware page against Vigor 130, there is no firmware for Vigor 130 yet specific to this issue, however I would keep checking over the coming days. If Draytek don't release firmware for the issue then it's a safe bet the Vigor 130 won't be effected.

https://www.draytek.co.uk/support/downloads/vigor-130

pcfarrar · 19 May 2018 at 08:40

I’ve got loads of DrayTek routers at work, I checked them all this morning and none were compromised. I always switch the remote management to a random port, disable the VPN services etc.

bremen1874 · 19 May 2018 at 10:59

There’s a list of affected models on their website https://www.draytek.com/en/about/ne...of-urgent-security-updates-to-draytek-routers.

Nice to see legacy models like the 2820 and my 2920 should be getting updates.

And the Vigor modems are listed.

Avalon · 19 May 2018 at 11:28

bremen1874 said:
There’s a list of affected models on their website https://www.draytek.com/en/about/ne...of-urgent-security-updates-to-draytek-routers.

Nice to see legacy models like the 2820 and my 2920 should be getting updates.

And the Vigor modems are listed.

One thing I have to give Draytek is that they keep patching way longer than most, it’s refreshing compared to the disposable support of other oem’s.

Caged · 19 May 2018 at 11:40

bremen1874 said:
There’s a list of affected models on their website https://www.draytek.com/en/about/ne...of-urgent-security-updates-to-draytek-routers.

Nice to see legacy models like the 2820 and my 2920 should be getting updates.

And the Vigor modems are listed.

Bear in mind that's the .com site - annoyingly the UK region of the Vigor 130 and the one available elsewhere behave quite differently. It defaults to being a router rather than a dumb bridge, for example.

Orcvader · 19 May 2018 at 14:40

Have a lot of sites using 2830/2860/2832, luckily they all have remote management off but will keep an eye on them, thanks for this.