How to stop the 'Chuck Norris' botnet roundhouse-kicking your router

I'm receiving a lot of emails about the 'Chuck Norris' botnet that's spreading by taking advantage of poorly configured routers and DSL modems. Here's some information about the attack and how to protect your router from getting a Norris-style kicking.

I'm receiving a lot of emails about the 'Chuck Norris' botnet that's spreading by taking advantage of poorly configured routers and DSL modems. Here's some information about the attack and how to protect your router from getting a Norris-style kicking.

First, while there's been a fair bit of Chuck Norris botnet coverage in the tech media, it's not clear how widespread it actually is. Feedback I've been getting from the security community suggests that, as of the time of writing, this botnet isn't very widespread. What this means is that there's no reason to panic!

Another point I want to make is to highlight that this is a botnet attack on routers. 'Chuck Norris' infects MIPS-based devices (routers, DSL modems) that run Linux by guessing the administrator username and password (which most people conveniently leave on default - defaults well known to hackers). The botnet also appears to use an exploit present on D-Link systems.

Note: In case you're wondering, it's called because of the following line in the source code 'in nome di Chuck Norris,' which is Italian for 'in the name of Chuck Norris.'

Once 'Chuck Norris' has a foothold into the router, it changes the DNS (Domain Name System) settings in the router and directs victims to malicious websites where malware is pushed onto the user. Malware is also installed into the router's memory which scans the network for other vulnerable devices.

So, how can you protect yourself from 'Chuck Norris'?

  • Change all router default passwords and make sure you use a strong password.
  • Update all router firmware.
  • Block off or shut off remote access features.
  • Get on with your life.

Note: You might need to consult your router's manual to find out how to do all this.

If you think that your router is compromised, here's what to do:

  • Restart it (which flushes the malicious code from memory).
  • Check for firmware updates.
  • Reset all the settings and input them again, making sure to choose strong administration passwords.
  • Scan all attached systems for malware using an up-to-date antivirus scanner (free scanner link).
  • Get on with your life.

Newsletters

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
See All
See All