German telecommunications service Deutsche Telekom confirmed that connectivity problems experienced by 900,000 of its customers on Sunday were the result of a hack attempt.
“Following the latest findings, it appears that some of Deutsche Telekom customers’ routers were affected by an external attack. Our network was not affected in any way. The attack attempted to infect routers with malware, and although it failed, it caused problems and limitations on 4 to 5 percent of our customers’ routers. This led to limited use of Deutsche Telekom services by the affected customers,” the company said.
“According to what we know, an attack on the maintenance UI of routers is currently taking place worldwide. This has also been confirmed by the Federal Office for Information Security.”
In order to mitigate the attack, Deutsche Telekom implemented a series of measures on their network. At the same time, they also released a firmware update for the targeted routers: Speedport W 921V and Speedport W 723V Typ (Type) B. The update will prevent the malware from accidentally or intentionally compromising the routers, creating a denial-of-service situation.
“Currently, an updated version of the software is being provided to all our interested customers who wish to fix the router issue. The installation of the software has already begun and we can see the success of this measure,” the company added, noting that it asked its customers affected by the attack to unplug their router for 30 seconds, as after rebooting the malware is removed from the device.
Meanwhile, Kaspersky Lab researchers report that the specific attack on Deutsche Telekom customer routers comes from a variant of the Mirai malware.
