Hacked Routers Linger on the Internet for Years, Data Shows

According to Censys, Emily Austin, a principal security researcher, identified several hundred Ubiquiti network routers with hacked banners while trawling Internet scan data, showing these were not new compromises but devices that had been compromised at some point and remained so. The researchers note that the number of defaced Ubiquiti hosts has declined over the past few years, suggesting these aren’t part of a fresh campaign, though several hundred still remain compromised.

Campaigns targeting Ubiquiti routers have occurred over the past ten years, including MF work in 2016 when the banner HACKED-ROUTER-HELP-SOS-WAS-MFWORM-INFECTED appeared, and in 2017 when over 36,000 routers displayed the banner HACKED-ROUTER-HELP-SOS-HAD-DUPE-PASSWORD. Austin says it’s possible these devices have been compromised for a long time, and that device owners should have noticed.

The majority of incidents are traced to weak credentials, such as reused or easily crackable passwords or default ubnt/ubnt passwords, underscoring a visibility gap in asset maintenance.