Home Invasion: Home Routers May Be The Next Big Hack

Researchers warn that millions of insecure home routers and broadband gateways—often shipped with trivial default credentials and vulnerable UPNP implementations—can be discovered by scanning ISP-assigned netblocks and trivially compromised (e.g., via default logins or malicious firmware). Compromised CPEs could be aggregated into large botnets to distribute malware, send spam, or launch disruptive attacks (including mass reboots or DDoS) against ISPs and their customers; the report cites scans finding hundreds of thousands of potentially vulnerable devices and references Rapid7 research estimating tens of millions of affected devices.