Ubiquiti AirOS wi-fi devices under worm attack

Devices from wireless equipment vendor Ubiquiti Networks running old firmware are being actively attacked by a self-propagating malware, with multiple infections reported from the United States, Brazil and Spain over the weekend.

A Ubiquiti support staffer confirmed the company's devices were currently under attack.

"There have been several reports of infected AirOS M devices over the last week. From the samples we have seen, there are 2-3 different variations," they said.

"We have confirmed at least two of these variations are using a known exploit that was reported and fixed last year."

The fix stopped unauthorised users from gaining access to devices via both the clear-text hyper text transfer protocol (HTTP) and the secured HTTPS variant. 

A Ubiquity dealer who didn't wish to be named told iTnews the current worm was dangerous for those who got hit by it.

"Unlike past malware that tried to install network proxies and set up domain name system redirection, the current worm tries to install itself across as many radios as it can, and shut them down," the dealer said.

In the Ubiquiti user forums, wireless internet service providers reported that vulnerable systems got infected easily.

"Simply having a radio on out of date firmware and having its http/https interface exposed to the internet is enough to get infected," a user wrote.

Worm attacks can be mitigated by firewalling off traffic and ensuring access points have no direct communication with each other, the dealer told iTnews.

The following Ubiquiti devices running old firmware should be upgraded as soon as feasible and HTTP and HTTPS management traffic cordoned off:

• airMAX M
• airMAX AC
• ToughSwitch
• airGateway
• airFiber

AirOS firmware version 5.6.2 or older is vulnerable to the worm attack.

The malware scans subnets and distributes itself to other Ubiquity systems it can identify. Ubiquiti administrators are reporting mass infections from the worm.

It is possible to remove the worm manually with a script or by installing Red Hat's Ansible automation tool.