Nasty New Worm Targets Home Routers, Cable Modems

[Daniel ~]

Written by Daniel
Wednesday, 25 March 2009

worm psyb0t bluepill

Ian Paul
Mar 25, 2009 8:30 am
PCWorld

A computer worm has been discovered that can infect 55 different home-based routers and DSL/cable modems including common brands like Linksys and Netgear.
Believed to have originated in Australia and known as "psyb0t" or Bluepill, this is the first worm known to be able to infect residential routers and modems. [Front page...]

[MUff1N]

Well, the first thing you need to do is set a strong password for your router, Then you need to Stealth it by stealthing port 113 IDENT.
This is the problem port for most people that will respond to ident requests (ICMP Echo Requests) & is usually on by default!
You want Port 113 to ignore requests so you stealth it, & here's how its done.
They can't Hack you if they can't find you!

Depending on your router will depend on how it's done.
This is for a Lynksys router.

Stealthing Port 113 on Lynksys Routers

Open your Internet Explorer home page and in the address bar type in
http://(then your ip address given to you by your router. If you dont know
it follow this thread: Start/All Programs Accessories/Command Prompt.
In Command Prompt type in ipconfig(spacebar)/all - now dont type in the
spacebar but hit your spacebar then forward slash/all. your ip address will
come up.
If we have the same router it should be 192.168.1.1
So it should be http://192.168.1.1 - when you click go an NR041 window should pop up.
Now in the Password box type in the password given to you by Lynksys or if
we have the same it should be admin <--- (in lowercase). You wont need to
type in a Username

When the Cable/Router Basic Setup window opens it may open to the Basic
Settings so if this is the case click on the Advanced Settings tab.
When the Advanced Settings window opens click on the Forwarding tab. - The
Advanced Settings may automatically open at first so the better.

Now when the Forwarding window opens, on the left hand of that window go
down to Customized Applications.
In the box below Customized Applications type in a title called Port 113
Stealth.

Now in the following boxes to the right you should type this:

Ext. Port - 113

Protocal TCP - put a check in this box by clicking on it.

Protocol UDP - leave blank.

Int Port - 113

IP Address - 192.168.1.250

Enable - put a check in this box by clicking on it.

Now click on the Apply button below.

Now you want to go check to make sure it is stealthed by doing a port scan...so go to Shields Up! to test your ports.
https://www.grc.com/x/ne.dll?bh0bkyd2

You want every single port to be stealthed.

If anyone else has more to add to this it would be appreciated for those that don't know.