2

hmm could you tell more about the firmware version and also share hash?

Also how much sure are you if it is by the firmware and not someone doing it via wireless or using some kind of exploit?

If its indeed a external factor you might want to place this router behind a NAT (a different modem or router) and reflash it, or if you use wifi make sure you use ccmp with a long password, you could set ssh access on the lan interface only via luci, also it would be better to use ssh keys to login and aswell use a big password for the web interface which isn’t reused.

Thats one of the things I can think off to megitate the attack surface even though wireless is never fully secure you might want even go as far to block port 80 and 443 for 0.0.0.0 but you may have to place wireless in its own isolated interface and firewall zone.

To be honest it looks like someone is pranking you since I can’t remember there is such thing as virus id as code as in html tags.

1 Like