Router web interface in "Asian" language...

[jdfthetech]

The big problem is that most home wireless routers ship out of the box insecure. Hell, even the new CISCO NV series shipped with vulnerabilities.

The best thing I always recommend is to go through the settings, change the default password first thing, then upgrade the firmware to the latest version.

After you upgrade the firmware, reset all passwords again, then disable all web services and enable all encryption. That's a basic good overview. You'll really need to read about your device but it's getting pretty necessary these days. I don't like the router to be accessible even in the home network with any sort of server, only when direct connected.

That's pretty much as secure as you'll get, but even then, you're not keeping out everyone, so just make sure you don't store personal stuff on non encrypted local sources.

[the86d]

Do you have any evidence that it was breached? NVRAM overflow still sounds likely.

In any event, why would you ever leave the default web server open to the internet? It's a simple httpd server built on busybox, not the best code out there. If you absolutely must use the admin console remotely, at least turn on OpenVPN and tunnel to the inside interface, and leave the admin server only open to internal addresses.

https://www.asus.com/support/FAQ/1008713#

Yes, DDNS was set to a name with dictionary words and numbers in it, Lang was set to Korean, and logging was set to disabled. Normally I ssh tunnel in, but wanted a backup plan, in case work blocked whatever port I was using... again.
I do netstats often, and neither had additional connections, other than the ones I was using. As soon as I saw it was in Korean again, I changed the router password to a bunch of random chars, copied from a notepad, so I could paste 2nd passwd confirmation too, shut down both boxes, and worried about it when I got home, as it was only about lunch time at work. With the pipe being so saturated (slow) I assume it was being used to relay packets, or something, I didn't bother digging too deep, as I wanted to get my rigs shut down quick. I couldn't get back in to do further research in what was changed, as I even locked myself out with said random passwd, and knew when I got home the reset button would be held anyway. I normally do play "the game" of poking a single ephemeral hole for a port FW, but left another open, since the Asus is such a pain-glitch-monkey if changing it, and you can lock yourself out too easily. Now I will just ssh-tunnel in (ephemeral port) and connect from the private martian addy only.

[67Cuda]

Barney enough?

Yes, Thank You.

[Robotron2k84]

Yes, DDNS was set to a name with dictionary words and numbers in it, Lang was set to Korean, and logging was set to disabled. Normally I ssh tunnel in, but wanted a backup plan, in case work blocked whatever port I was using... again.
I do netstats often, and neither had additional connections, other than the ones I was using. As soon as I saw it was in Korean again, I changed the router password to a bunch of random chars, copied from a notepad, so I could paste 2nd passwd confirmation too, shut down both boxes, and worried about it when I got home, as it was only about lunch time at work. With the pipe being so saturated (slow) I assume it was being used to relay packets, or something, I didn't bother digging too deep, as I wanted to get my rigs shut down quick. I couldn't get back in to do further research in what was changed, as I even locked myself out with said random passwd, and knew when I got home the reset button would be held anyway. I normally do play "the game" of poking a single ephemeral hole for a port FW, but left another open, since the Asus is such a pain-glitch-monkey if changing it, and you can lock yourself out too easily. Now I will just ssh-tunnel in (ephemeral port) and connect from the private martian addy only.

Just for shiggles, if you have terminal access to the router, do a "nvram show |grep entries" and look at the free memory. If it's below 1K free you have exhausted NVRAM and strange behavior is bound to occur.

[the86d]

Firmware update dropped today.

LOTS of overflow issues fixed in said update, so maybe it wasn't specifically the port, as they didn't change the user or pass?

[the86d]

...do a "nvram show |grep entries" and look at the free memory. If it's below 1K free you have exhausted NVRAM and strange behavior is bound to occur.

[Robotron2k84]

Interesting. One thing you can do also is to dump the NVRAM to a text file every day and if things change again, can diff them to quickly see what was modified. That may give a clue as to what is happening.

Try adding to cron:

"0 0 * * * nvram export --dump > /tmp/nvram.out 2>/dev/null"

Be aware that unencoded passwords will be in that file, so:

"touch /tmp/nvram.out"
"chown root:root /tmp/nvram.out"
"chmod 0600 /tmp/nvram.out"

And that upon reboot you will need to reset the permissions (or put that in a cron script) due to /tmp being a RAMFS fileststem.

[the86d]

Interesting. One thing you can do also is to dump the NVRAM to a text file every day and if things change again, can diff them to quickly see what was modified. That may give a clue as to what is happening...

...DDNS was set to a name with dictionary words and numbers in it [I don't think a glitch would drop dictionary-words in a DDNS entry, enable it too], Lang was set to Korean, and logging was set to disabled...

It was clearly cracked/exploited.

[Robotron2k84]

I guess I was too subtle for you. Logging the NVRAM transactions will fingerprint the malware that might have attacked you.

I'll just mind my own business. Take care.

[the86d]

I let Asus chose the port for ext access, and although on an alt-port, it is a pseudo-industry standard alt-port, because changing the port goofs up future access due to some Asus glitches that can lock you out of your own router. I have since stopped ext.-access. If it happens again, I will dig deeper. I do appreciate the input, whole-hardheartedly, and I will give your suggestions a shot, if needed, as I did just drop a firmware update in the beast too. This is just not something I want to dig that deep into right now if it might already be resolved, as I have a lot of other things going on.