Linksys blocked access to users of the cloud service Smart WiFi asking them to update their passwords after suffering one account compromise with an attached change to the router settings to send users to sites containing malware.
The Linksys decision affects only those with a Smart WiFi account. For those unfamiliar with it, it is a cloud-based account system that allows owners of a Linksys device to remotely connect to their router and manage its settings.
Being widespread on Linksys devices, it represents an ideal target for hackers who want to carry out mass compromises. And exactly what happened in this situation: it was Bitdefender who identified a campaign last month with the aim of violating routers Linksys and D-Link and change the DNS settings.
In this way, unsuspecting victims are redirected to a landing page that contains a coronavirus-themed app connected to the Oski malware, which has the task of stealing sensitive data. Here are the websites for which the user is redirected, according to the information disclosed by Bitdefender:
aws.amazon.com
goo.gl
bit.ly
washington.edu
imageshack.us
ufl.edu
disney.com
cox.net
xhamster.com
pubads.g.doubleclick.net
tidd.ly
redditblog.com
fiddler2.com
winimage.com
Linksys confirmed this last month, and recently announced that it has blocked Smart WiFi accounts as a containment measure and to exclude hackers from accessing users' devices. The closure of the accounts was accompanied by the request to reset the password for the legitimate owners, and an action taken forward as there is no possibility to establish which accounts have been compromised and which ones are safe. The company also requests to use a unique password that is not already used for any other service.