FRITZ! news - Attacks on FRITZ!Box clarified
Attacks on FRITZ!Box clarified - Security advice still in effect - Updates will be released shortly
The attacks on FRITZ!Box that occurred over the past few days have been clarified. Due to the concentrated work of the development departments, AVM was able to identify the attack patterns of the perpetrators. According to these findings, the perpetrators attacked via port 443 therefore could break into the FRITZ!Box. During these attacks, the perpetrators also obtained passwords. Over the course of the weekend, AVM will make software updates available to prevent further attacks following this pattern. AVM has handed over the latest findings to the investigating authority.
Peter Faxel, CTO of AVM: “Software development at AVM undergoes several security levels and the software is additionally checked by notable experts. Therefore, we regret all the more the latest incidents and the limitations placed upon our customers at the moment.”
The attacks observed so far affect only FRITZ!Box devices with the MyFRITZ! service or the remote access enabled. Since it is possible that other passwords may have been obtained in addition to access data, AVM urgently advises FRITZ!Box users to change all passwords and log-in data stored in the FRITZ!Box. Instructions can be found at the AVM Security pages.
The recommendation to close port 443 (“Internet access to the FRITZ!Box via HTTPS”) remains valid and prevents these attacks. Starting this weekend, AVM will provide new firmware versions for FRITZ!Box models. Once the firmware has been updated, remote access and MyFRITZ! will be available without restrictions. At the AVM Security pages users find an overview of the currently available downloads.
Feb 07, 2014