Forum Discussion

JCH1's avatar
JCH1
New Member
4 years ago

Mirai Botnet

There are multiple articles published saying the Hughesnet router HT2000W is vulnerable to the Mirai Botnet security issue.  The articles recommend getting a patch from the device provider or ISP.  W...
  • Liz's avatar
    Liz
    4 years ago

    Good morning folks,

     

    Thanks for the discussion! Just wanted to let you know that Arcadyan is addressing this matter and we are in touch with them. You'll hear from us on further updates.

     

    Your patience and understanding are much appreciated.

     

    Thanks,

    Liz

     

    Edit:

     

    In the meantime, wouldn't hurt to do an overall security check of your devices. Google periodically reminds me to review my security settings, would be good to apply the same to everything else. Here are some tips.

GabeU's avatar
GabeU
Distinguished Professor IV
4 years ago

They're likely already looking into it.  

 

If/when they release a patch, it will be done automatically.  

  • chuckyofterror's avatar
    chuckyofterror
    New Poster
    4 years ago

    I am going to go out on a limb, and say that unless you have Static IP enabled on your account (Only SME accounts can do that, residential can't), then you should be OK for the time being, as no one can remotely access your terminals.  Those that do have an SME account with Static IP, could very well become impacted.

    Hmm, not sure why I posted under this account... -C0RR0SIVE

    • Remy's avatar
      Remy
      Moderator
      4 years ago

      JCH1,

       

      Thank you for reaching out, and welcome to the Community! We appreciate you letting us know about the article, and we've gone ahead and escalated it to the appropriate department. We'll let you know as soon as we have news to share about the issue, and we appreciate your patience!

       

      Thanks,

      Remy

    • MarkJFine's avatar
      MarkJFine
      Professor
      4 years ago

      For those that are curious about what it is and what it does this is pretty comrehensive: What is the Mirai Botnet? 

       

      I suspect that hackers trying to deploy this incrementally scan IPs looking for IoT devices via /HNAP1 or /thinkphp or /TP/public/index.php signatures. Once a target is found, they attempt to use default passwords to get control of it.

      As chuckyofterror (er, @C0RR0SIVE) mentioned, they cannot even get to the HN2000W modem on standard residential networks because of the double-NAT that's in-place. That is not the case with Business accounts with static IPs, which are accessible from the outside.

  • maratsade's avatar
    maratsade
    Distinguished Professor IV
    4 years ago

    I hope a rep chimes in about this. 

     

    GabeU wrote:

    They're likely already looking into it.  

     

    If/when they release a patch, it will be done automatically.