Malware called SYNful Knock has been hijacking internet routers by exploiting default login credentials, allowing threat actors to integrate their own operating system on the routers. Over 200 routers across 31 countries have been infected so far. With access to the routers, threat actors can view all network traffic and use the routers to launch further cyber attacks. Countermeasures have been ineffective due to the new and complex nature of these router hijacking attacks.

1. Phillip LiPari, Writing for Intelligence
23 September 2015
Routers Hijackings pose new Threatto Cybersecurity
Executive Summary:
Malware that hijacks and replaces the integrated operating system (IOS) of internet routers is
likely to become a more commonplace tactic among threat actors. By hijacking routers, threat
actors create a beachhead for further cyber-attacks and can view all data accessed via the
internet. Countermeasures for these attacks are currently ineffective due to their unique and
unprecedented nature.
Discussion:
SYNful Knock is the name given to
the malware used in router
hijacking attacks through default
login codes. Default login codes
are the maintenance usernames and
passwords to routers. These logins
have long been areas of concern for
cybersecurity professionals but
went unexploited prior to SYNful.1
Rewriting a router`s IOS allows
SYNful to become integrated
within the infected router. The
SYNful software updates itself
regularly once inside the router to
ensure an appearance of normal
operations.2 These factors allow SYNful to remain undetected for undetermined periods of
time.
Router based cyber-attacks were only theorized prior to the SYNful attacks on Cisco brand
routers revealed on 15 September 2015. The initial estimate of routers compromised was 14
routers in four countries but it has since risen to over 200 routers in 31 countries. As many as
60 of these routers are located in the US and so far they have only been found in networks used
by private companies.3 “This attack vector is very much a reality and will most likely grow in
popularity and prevalence” stated David Dewalt, CEO of the cybersecurity firm FireEye. 4
Dewalt also stated that Cisco brand routers were not the only brand susceptible to these
attacks. Due to the complexity and scope of the attacks, Dewalt claims a state actor is likely
responsible. 5 Thus far there have been no accusations toward any specific state or group.
Infected routers send data to the threat actors controlling them as well as the intended
destination via the internet. In addition to compromising massive amounts of data, infected
routers serve as a beachhead for further attacks on a network.6 Reformatting infected routers is
Basic diagram of a router connected to the internet,
SYNful would have access to anything connected to
the router (in this case the two computers)

2. the only way to eliminate SYNful due to the IOS integration. FireEye recommends a thorough
examination of networks compromised by infected routers.7
Cisco stated that routers are both valuable to threat actors as well as key points of defense
within a network. Since SYNful and router attacks in general are still vague and difficult to
prevent, they will remain an effective attack method.8 Considering the lack of a defensive
strategy, Cisco`s security division is currently developing methods to detect and repel router
attacks.9
Source Reliability: Moderate
With questions or concerns, please contact the author:
Email: plipar35@lakers.mercyhurst.edu
Phone: (585) 752-9449
Peer reviewed by: Austin Wood
Graphic source: http://www.microsoft.com/library/media/1033/windowsxp/images/using/networking/setup/68573-
router-diagram.gif
Endnotes
1 http://news.softpedia.com/news/some-wifi-routers-can-be-hacked-using-a-hard-coded-default-login-
490207.shtml (L)
2 http://searchsecurity.techtarget.com/news/4500253817/Cisco-router-malware-in-the-wild-more-widespread-
than-first-believed (H)
3 http://fcw.com/articles/2015/09/15/cisco-router.aspx (M)
4 http://www.networkworld.com/article/2984124/security/attackers-can-take-over-cisco-routers-other-routers-
at-risk-too.html (M)
5 http://www.fierceenterprisecommunications.com/story/even-more-cisco-devices-found-be-infected-synful-
knock/2015-09-21 (M)
6 http://www.crn.com/news/networking/300078193/hundreds-of-cisco-routers-infected-with-synful-knock-
partners-say-attack-changing-sales-strategy.htm (M)
7 http://www.infosecurity-magazine.com/news/cisco-synful-knock-threat-victims/ (M)
8 http://www.ibtimes.com/router-hack-creates-ultimate-listening-device-monitor-countrys-entire-internet-
2097511 (M)
9 http://www.eweek.com/security/synful-knock-malware-found-on-almost-200-cisco-routers.html (M)