Currently set to Index
Currently set to No Follow

You’re in Trouble if You Have a Tomato Router

Muhstik Botnet Attacks Tomato Routers to Harvest New IoT Devices

Share via
1 share, 89 points
Share via

Tomato Router


Researchers from Unit 42, the threat intelligence arm of Palo Alto Networks, have discovered a new variant of the Muhstik botnet that adds a scanner to attack Tomato routers for the first time by web authentication brute forcing.

Purchase a reliable and secured router here.

Unit 42’s investigation showed there are more than 4,600 Tomato routers exposed on the internet that could potentially be vulnerable.

Tomato is an open source alternative firmware for routers. Thanks to its stable, Linux-based, non-proprietary firmware, with VPN passthrough capability and advanced quality of service (QoS) control, Tomato firmware is commonly installed by multiple router vendors and also installed manually by end users. According to Unit 42’s investigation on Shodan, there are more than 4,600 Tomato routers exposed on the Internet.

The Muhstik botnet has been alive since March 2018, with a wormlike self-propagating capability to infect Linux servers and IoT devices. Muhstik uses multiple vulnerability exploits to infect Linux services, such as Weblogic, WordPress and Drupal. It also compromises IoT routers, such as the GPON home router and DD-WRT router. This new variant expands the botnet by infecting Tomato routers.

We have not found further malicious activities in Tomato routers after the Muhstik botnet harvests vulnerable routers, but from our understanding of the Muhstik botnet, Muhstik mainly launches cryptocurrency mining and DDoS attacks in IoT bots to earn profit. We will keep monitoring its Command and Control (C2) IRC channel.

New Scanner for Tomato Routers

The new Muhstik variant scans Tomato routers on TCP port 8080 and bypasses the admin web authentication by default credentials bruteforcing. In Tomato routers, the default credentials are “admin:admin” and “root:admin”. We captured the Tomato router web authentication brute forcing traffic.

Read more  Filipino Inventor Develops a Fuel-Efficient and Anti-Pollution Device for Vehicles

To estimate the infected volume, we searched for fingerprints of Tomato routers in Shodan. As noted in Figure 2, there are about 4,600 potential victims on the Internet in total. This total is derived by including the number of TomatoUSB devices, which is used as a NAS server by combining the Tomato router and a USB drive.

Share via

Like it? Share with your friends!

Share via
1 share, 89 points
News Team


Your email address will not be published. Required fields are marked *

I accept the Privacy Policy * for Click to select the duration you give consent until.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Send this to a friend