Dreambox Virus Beware

[D4ftpunk]

Hi guys, just thought i would post here this important info.

Block port 21 on your dreambox's and change your passwords, there is a virus going around that exploits the ftpd afaik, and harvests your cwshare.cfg and things.

Also some new files get uploaded tool2.tar,start.sh, and activity comes from this hostname: satelli1.dyndns.org

Be Careful.

 

[T_G]

Hi
Can you give us some more details?

 

[mhku]

But it'll only get people who cardshare ;)

WARNING: virus in Dreams boxes...

------------------------------------------------------------

SPYWHARE ONBOARD? VIRUS IN LINUX DREAMBOX ?? CHECK YOURE BOX

something is ******* the dreambox when you have port 21 open
how they find you i dont know maybe because of 1 cw that leads to 100 others and that leads to 100.000 others and so on

when they have hacked you then they uploaded a tarfile 4347_tool2.tar in /var and unpack it in /var/tool2 and then run a script start.sh in /var/tool2 which uses a binary called tvconnector.

who thes people are i dont know what this does i dont know
i do know that it should not be in youre dreambox
this could easy be spyware from who knows

my advise is to you all check youre dreambox id you see one of thes files/dir's in youre box

FLASH IT

dont take any risk maybe youre box is sending data about youre peers
maybe youre box is sending data to collect as evidence against you



TO ALL CHECK YOUR BOXES AND CLOSE FTP PORT FOR THE EXTERNE NETWORK

THIS INFORMATION IS FROM A VERY TRUSTED PPL




It's good practice to change the image default password. Anyone trying to ftp or telnet to the box must supply the correct password.

Telnet to your dreambox and type passwd. It will ask for the new password twice. It has to be at least 6 characters long and no more than 8.

source: http://www.gccadm.net/forum/viewtopic.php?t=86874

 

[D4ftpunk]

Well ive seen this happen, thats where i got my info from, i watched it as it happened on a friends box. All we did after is did a factory reset using the remote control and reuploaded the cardshare files (for legal purposes of course) and changed password to something obscure, null routing port 21.

 

[CROSSBONES]

and changed password to something obscure

Did he have the standard DB pass or was it hacked?