Linksys, a router developing firm asked its users to reset passwords to their smart wifi accounts after some of the accounts were hacked and illegally accessed to direct users to a COVID-19 themed malware.
The reset took place after all accounts were locked in order to prevent further hacking on April 2nd. The hackers changed the home routers' DNS server settings and prevented users from accessing various domains like Amazon AWS, Disney or pornography. Instead, the users were directed to a webpage with a corona virus-themed app "that displays a message purportedly from the World Health Organization, telling users to download and install an application that offers instructions and information about COVID-19."
The app was a fluke and it attached the Oski info-stealing malware into the system. The malware uses the victim's login credentials to access various services like cryptocurrency wallets.
Linksys told it's customers to reset their passwords when they login and a confusing message about " The COVID-19 Malware ".
Jen Wei Warren from Belkin's global PR veep Linksys parent firm, told The Register that "the original illicit access to customer routers through their cloud-hosted Smart Wi-Fi accounts was a successful credential-stuffing attempt using login details harvested from previous breaches elsewhere."
She said: "Multiple factors lead us to the conclusion that credentials were stolen elsewhere: the majority of authentication requests contained usernames that have never registered on our system. We checked email addresses with services like haveibeenpwned.com which indicate the list of credentials being attempted on our system are known to have been exposed previously."
She further added, "Multiple attempts were made using the same username but different passwords, which would not be necessary if our own systems were compromised." But refused to mention how many accounts were affected from this hacking.
The email sent to the customers read, "All Linksys Smart Wi-Fi accounts were locked at 8:00 pm PDT on April 2 because someone was logging in with email address and password combinations stolen from other websites.
Your account was not compromised, but out of an abundance of caution we locked it to prevent unauthorized access. You need to change your password to log back in – unless you have already done so since we locked it."
