Update: Looks like it's not quite as bad as it could be, as the exploit only works if the built-in firewall has been disabled (it defaults to on). Still, wouldn't this be a great time to verify your settings?
Read [LinksysInfo]

U.S. Robotics Broadband Router 8003
Password Disclosure Vulnerability

U.S. Robotics Broadband Router 8003
admin password visible

Wi-LAN and Micro-Link Announce Sale of
Broadband Wireless Equipment to Iskon
Internet of Croatia

Yellowknife Scores a First for Broadband
Wireless Access: SSI Micro and Inukshuk
Internet Introduce New Intern

Research And Markets - Broadband Rollout
In The Residential Market Will Remain
The Main Driver Of The Western European
WLAN Market

Linux LiveCD Router 2.0.8 (Default
Router branch)

Linux LiveCD Router 2.0.8 (VoIP Router
branch)

Research and Markets : Examination of
the Enterprise WLAN Equipment Market in
Particular the Market for WLAN Switches

Syntax Groups' Olevia Brand of LCD TVs
Brings Value & Affordability to Micro
Center Consumer Electronics
Consumers--National Debut at Micro
Center Gains Rapid Consumer Acceptance

Akamai or Backdoor?

Recently my brother contacted me via IM to ask about some strange network behavior on his machine.  He was using sysinternals tcpview, and noticed that svchost.exe was opening connections to two IP addresses; one on 80.66.x.x subnet, and another somewhere beneath a different 80.x.x.x subnet.  He was concerned because the IP addresses in question showed up as "unassigned EU block" in the RIPE database.  The closest assigned block to one of the addresses showed up as being assigned to a company in the Netherlands, and the other to a company in Germany (and GeoIP returned the same information using the original IP addresses).

More interesting was the traceroute.  The address that GeoIP reported being in Germany routed to Hurricane Electric in Fremont, California; with the last hop before 80.x.x.x being a 64.x.x.x router in Fremont.  Could someone in Germany actually be within one hop of a router in Fremont? 

After more investigation, we found a google news posting pointing the finger at Windows Update; and particularly to Akamai servers in the 80.x.x.x range.  With a bit more coaxing, we were able to get the RIPE database to reveal that some small subnets within the unassigned blocks were actually assigned to Akamai.  I knew that Windows Update and many other MSFT sites contract to Akamai for edge-caching services, so this was a very plausible resolution.  However, I am left with a few nagging questions:

• Are there any better tools or techniques to find out exactly what chunk of code is accessing the network?  Knowing that svchost.exe is initiating the connection is not very useful.  More useful would be the exact DLL.
• Akamai works by configuring DNS to resolve differently depending on geographic location (ping download.windowsupdate.com to see this in action).  This is a common architecture for our large globally distributed customers' sites who use routing products like Cisco Global Director and F5 3DNS to accomplish this.  However, it leads to a problem -- using reverse DNS from an IP address is rather unlikely to return the same FQDN that was used to resolve the address in the first place.  So starting with an IP address like 80.67.66.16, you have no way of finding out if that was initiated by a call to download122.windowsupdate.com or spywareupload22.gator.com.  And considering the way that Akamai provides services to spyware vendors as well as to MSFT, you can't necessarily trust a network connection just because it is connecting to a block owned by Akamai.  It would be ideal if Akamai offered an IP address lookup service that could be used to verify which of Akamai customers was being serviced by a particular IP.

Without at least one of the two above requests, the only way to verify that the connections were indeed made on behalf of Windows Update was to bounce the service and watch the connections die (and assume Windows Update DLL hadn't been hacked of course).

~

When I first heard that McDonald's was planning to launch a new ad campaign themed "Lovin' It", I immediately got visions of the horribly tacky "Mentos, the Freshmaker!" commercials.  I envisioned some German ad agency telling hapless McDonald's executives, "We know how to make more teens go to McDonald's; we'll use some real groovy stuff and say the words Lovin' It because then kids will think you are cool!"  So today I saw one of the new ads for the first time, and it wasn't all that bad.  Actually it was kind of nice.  It's kind of a feel-good, "happy memories of carefree times" theme, kind of like the Pepsi spots a few years back.

Backdoor.Autoupder Removal

Backdoor program gets backdoored

Dynalink routers backdoor?

FTC Bars Popup Backdoor Ads

US bars backdoor pop-up adverts

Netgear's Amusing "fix" for WG602v1
Backdoor

New Bagle opens another spam backdoor

Re: Backdoor in Fortinet´s firewall
Fortigate

Linux kernel backdoor blocked

Qwest's Backdoor Enterprise Strategy

'DVD Jon' reopens iTunes backdoor

Re: APC 9606 SmartSlot Web/SNMP
management card "backdoor"

Kerry: Bush army plan is "backdoor
draft"

APC 9606 SmartSlot Web/SNMP management
card "backdoor"

Zindos enters MyDoom backdoor to attack
Microsoft

Fw: APC 9606 SmartSlot Web/SNMP
management card "backdoor" - MORE
PROBLEMS

Re: Fw: APC 9606 SmartSlot Web/SNMP
management card "backdoor" - MORE
PROBLEMS

Sophos warns of new backdoor trojan
security threat, Uproot-A

Remove: Backdoor.Agent.B, Evaman.C,
Erkez.B@mm, Korgo and Donk.Q worms

APC 9606 SmartSlot Web/SNMP management
card "backdoor" - Telnet can't be
disabled.

Backdoor in X-Micro WLAN 11b Broadband Router