28 Mar
2018
28 Mar
'18
4:46 p.m.
it is not wise to block port 8291, because the
exploitable service is
on http port 80 tcp.
The worm uses port 8291 to identify possible victims (when it can connect to port 8291 it
assumes
there is a MikroTik router on that address), then attacks it on port 80 and some other
ports that
people may likely have set as an alternative for HTTP access to the router (8080 etc).
So blocking port 8291 effectively blocks the worm in its current version, while not
destroying the
useful port 80. Of course experience with earlier events like this shows that such a worm
typically
evolves and may skip the port 8291 scan later, rendering this block ineffective.
For now, I have blocked access to port 8291 from addresses outside AMPRnet on our
gateway.
Of course this restriction will be lifted when/if this worm stops operation.
It appears to be controlled via a peer-to-peer network and it looks like it is a version
of an
existing worm that has been active on network cameras/recorders, routers from other
manufacturers,
etc, all running embedded Linux.
Rob