Afduubka Router DNS iyo UPnP Gudbinta Dekadda Is-afgaradka: ISP Gateway Tilmaanta Adeegayaasha DNS ee Rogue, 30-30-30 vs. NVRAM Hard Reset, iyo DoH/DoT sir ah¶

Furitaanka laptop-kaaga ama casrigaaga gurigaaga ama xafiiska yar ee Wi-Fi kaliya si aad u aragto been abuur "Chrome / Windows Critical Update Required" pop-ups, shaashado-xiran oo portal ah oo weydiinaya routerkaaga ama eraygaaga sirta ah ee iimaylka, NET::ERR_CERT_AUTHORITY_INVALID Digniinaha shahaadada TLS ee shabakadaha bangiyada, ama ogaanshaha in routerkaaga WAN / DHCP qaabeynta ayaa si aamusnaan ah dib loo qoray si loo tilmaamo shisheeye qallafsan DNS Ciwaanka IP-ga (ama waxa uu furay daraasiin aan la ogolayn UPnP Xeerarka gudbinta dekedaha ee NAS kaaga, kamaradaha, iyo kombuyuutaradaada u soo bandhigaya intarneedka dadweynaha) waa isku tanaasul heer shabakadeed oo daran. Marka uu weerarku waxyeeleeyo routerkaaga Wi-Fi ama albaabka ISP (Netgear, TP-Link, ASUS, Linksys, D-Link, MikroTik, Ubiquiti, Arris, Comcast Xfinity, AT&T BGW, BT Smart Hub), waxay maamulaan kadinka caadiga ah (192.168.1.1 ama 192.168.0.1* Qalab kasta oo ku yaal dhismahaaga isku mar ***, oo ay ku jiraan iPhones, taleefannada Android, TV-yada Smart, Laptop-yada shaqada, iyo xarumaha IoT ee aan rakibin karin software-ka-hortagga dhaqameed.

Waxaa ka sii daran, qoysaska malware-ka router-ka casriga ah (VPNFilter, KV-Botnet, RaptorTrain, Volt Typhoon, ZuoRAT, Cyclops Blinkiyo GhostDNSIsticmaal laba hab oo kala duwan oo ku adkaysiga: qaar waxay beddelaan oo kaliya kuwa aan isbeddelayn NVRAM dejinta (DNS server, CWMP / TR-069 maamulka fog, iyo UPnP miisaskaCSRF) ama furaha sirta ah ee adminka, halka botnets-ka horumarsan ee heerka lacag bixinta gudaha /tmp RAM ama dib u qor Linux MTD SPI flash partitions. Shabakadda la xidhiidha iyo tanaasulka NAS, akhri Afduubka DNS, ISP router WAN dib-u-habaynta, iyo xadhkaha goosashada, guriga ama xafiiska yar ee NAS, DeadBolt ransomware, iyo UPnP damintaiyo hubinta router guriga iyo aaladaha IoT. Haddii isu tanaasulka shabakadaadu ay saamayso qalabka telemetry ee caafimaadka ama nidaamka badbaadada nolosha jidhka, isla markiiba u beddel xogta gacanta oo wac nambarka degdega ah ee degaankaaga (911 Maraykanka iyo Kanada, 112 guud ahaan Midowga Yurub, 999 gudaha Boqortooyada Midowday (UK) ama hubi hagahayaga nambarada degdega ah.

Hadda samee tan¶

1. **Isku xidhka ka saar teleefannadaada iyo laptop-yadaada shabakada Wi-Fi-ga ee la jabiyay isla markaaba hana gujin "Update", "Install Certificate", ama "Verify Account" browser kasta oo soo booda ***:
2. **Waa maxay sababta daba-galka ah ee DNS pop-ups ay u dilaan ***: Marka router la afduubay uu kuu tilmaamo DHCP Xallinta DNS ee ciwaanka IP-ga xaasidnimada leh, adoo ku qoraya magac domain caadi ah (ama marka OS-gaagu hubsado isku xidhka msftconnecttest.com / captive.apple.com) waxa uu u jiheeyaa biraawsarkaaga server-ka uu gacanta ku hayo weerarka gujiFix/Lumma Stealer/Cusbooneysii Chrome been abuur ah malware ama bog ISP been abuur ah. U beddel taleefannada gacanta gacanta 5G/LTE isla markiiba.
3. ** Ku soo jiid korantada router-ka 60 ilbiriqsi MARKA HORE (Stage-2 /tmp RAM Malware Flush), ka dib ku xidh kombuyuutar keliya oo nadiif ah adoo isticmaalaya fiilada Ethernet (oo Wi-Fi dansan) si aad u baadho oo dib u dejiso router ***:
4. ** Maxay FBI-du ugu talinaysaa wareegga korantada ee degdegga ah ***: Inta badan aaladaha botnets-ka ee router-kaVPNFilter, KV-Botnet, ZuoRAT) ma qori karaan baakidhkooda firfircoon ee firfircoon iyo binaries-ka-yar ee akhris-kaliya SquashFS qaybo toosan; Taa beddelkeeda, waxay ku socodsiiyaan Marxaladda 2 iyo Marxaladda 3 si kacsan RAM (/tmp ama /var/run). Furitaanka xadhkaha korantada ilaa 60 ilbiriqsi isla markiiba waxay dishaa xirmada xirmada xusuusta ee firfircoon si aad si badbaado leh ugu gasho bogga maamulka router si aad u tirtirto adkaysiga Marxaladda 1 oo aad dib u shiddo firmware-ka.
5. Ogow runta ku saabsan "30-30-30 Hard Reset" vs. Casriga ah Bootloader / NVRAM Factory Reset:
6. Tobannaan sano, hagayaashu waxay ku taliyeen 30-30-30 reset (xajinta godka dib u dejinta 30 ilbiriqsi oo shidan, 30 ilbiriqsi oo aan furnayn, iyo 30 ilbiriqsi inta aad dib u soo celinayso korontada).
7. ** Xaqiiqda Farsamada ***: The 30-30-30 waqtigu wuxuu ahaa mid gaar u ah dhaxalka Broadcom CFE (Common Firmware Environment) bootloaders ordaya DD-WRT. On casriga ah ARM iyo MIPS router ordaya U-Boot (ASUS, TP-Link, Netgear, UniFi, GL.iNet), Furitaanka awoodda adigoo haya badhanka Dib-u-dejinta inta lagu jiro boot-ka ayaa dhab ahaantii ku tuuraya router ** Bootloader TFTP / Crashed Recovery hab *** halkii aad ka tirtiri lahayd NVRAM.
8. Si warshad dib-u-dejin NVRAM Router kasta oo casri ah: ** ka tag xadhkaha korantada oo ku xidhan oo routerku si buuxda u shido ***, taabo oo qabo recessed Reset batoonka pinhole si joogto ah ** 10 ilaa 30 ilbiriqsi ** ilaa dhamaan nalalka LED-ka ee hore ay dhalaalayaan amber/cas oo router-ku uu dib u bilaabo, ka dibna sii daayo.
9. ** Dib u milicso sawirkii firmware warshadii ugu dambeeyay (.bin / .chk / .trx / .img) lagala soo degay xiriir nadiif ah ka hor inta aan dib loo xirin WAN (Internet) fiilada Ethernet ***:
10. Haddii aad warshad dib u dejiso router inta uu jiro WAN dekeddu wali waxay ku xidhan tahay intarneedka dadweynaha, iskaanka botnet otomaatiga ah (Shodan / Censys qoraalada ka faa'iidaysiga ballaaran ee lagu beegsanayo WAN dekedaha maamulka 8080, 8443, 7547 TR-069, ama UPnP SOAP) waxay dib uga faa'iidaysan kartaa nuglaanta aan la daboolin admin/admin gal gudaha 90 ilbiriqsi ee reboot.
11. Soo deji feylkii ugu dambeeyay ee firmware adiga oo isticmaalaya goobta gacanta ee taleefankaaga marka hore, ka saar furaha WAN cable ka router, sameeyo dib u habaynta warshad, ku shubi file firmware offline via 192.168.1.1, deji furaha maamulaha ee 20-xaraf oo cusub, oo kaliya markaas ku xidh lambarka WAN fiilada internet-ka ayaa dib u soo galay.
12. **Dami UPnP (Universal Plug and Play), NAT-PMP, Remote WAN Managementiyo WPS isla markiiba goobaha router ***:
13. Boqolkiiba 90 ee tanaasulka gudbinta dekeddu waxay dhacdaa sababtoo ah UPnP waxaa si toos ah ugu shaqeeya router-ka macaamiisha: TV kasta oo cudurka qaba, kamarad IoT, ama qoraalka browserka ee shabakadaada deegaanka ayaa soo diri kara mid aan la xaqiijin. UPnP IGD SOAP Codsiga XML (AddPortMapping) ku 192.168.1.1:1900 Farista router-ka inuu furo dekedaha dab-damiska dibadda si toos ah NAS kaaga gudaha (port 5000/445ama Windows PC (port 3389 RDP).
14. ** Dareeraha deegaanka DNS Cache iyo ARP Cache qalab kasta oo Windows, Mac, iPhone iyo Android ah, oo karti Encrypted DNS (DNS-over-HTTPS / DoH ama DNS-over-TLS / DoT***:
15. Xitaa ka dib marka aad hagaajiso router-ka, laptops-yadaada iyo telefoonadaada waxay sii wadi doonaan socodka gaadiidka ee ciwaanada IP-ga ee weerarka ilaa DNS TTL-yadooda kaydsan ay dhacayaan ama aad gacanta ku nadiifiso OS iyo browserka DNS caches (ipconfig /flushdns).

Geedka go'aanka: ogaanshaha iyo ciribtirka router DNS afduubka ama tanaasulka UPnP¶

Raac shaqada shabakadan forensics si aad u xaqiijiso afduubka, ciribtirka adkaysiga, oo aad u adkeeyso albaabkaaga:

flowchart TD
    Start["Jihaynta tuhunka leh, Digniinta Shahaadada, Cusboonaysiinta Been Abuurka ah, ama Gaadiidka Qunyar/Afduuban ee Wi-Fi"] --> AuditDNS["TALLAABADA 1: Orod 'nslookup google.com' & Hubi Router WAN/DHCP DNS IP + UPnP Miiska Gudbinta Dekadda"]

    AuditDNS --> IsHijacked{"Router-ku ma muujiyaa Ajnabi DNS IP-yada Ajnabiga ah AMA UPnP Port Porto oo aan la ogolayn?"}

    IsHijacked -->|"MAYA: Router DNS & Dekeduhu waa Nadiif, Hal Qalab Keliya Ayaa Leexiyey"| LocalMalware["Tanaasulku wuxuu u dhow yahay PC/Telefoonka Keliya -> Hubi faylka 'hosts', kordhinta Chrome-ka xaasidka ah, ama Profile Proxy/VPN ee Rogue"]

    IsHijacked -->|"HAA: Router DNS waa la bedelay, Maaraynta WAN Furan, ama Xeerarka UPnP ee xun ee hadda jira"| UnplugWAN["TALLAABADA 2: Ka saar fiilada WAN (Internetka) ee Router + Power-Cycle Router ilaa 60 ilbiriqsi si aad u daadiso '/ tmp' RAM Malware"]

    UnplugWAN --> EoLCheck{"Routerku ma yahay Gateway ay ISP leedahay mise Router Tafaariiqda adiga kuu gaar ah?"}

    EoLCheck -->|"ISP-Kiro Modem/Router (Comcast, AT&T, Spectrum, BT, Virgin, Rogers)"| ISPGateway["1. Qabo Dib-u-dejin Jireed 15-30s. 2. Beddel Admin & Wi-Fi Passwords + Dami UPnP. 3. Haddii TR-069 / Firmware la jabiyay, Dalbo Isku Bedelka Qalabka Bilaashka ah ee degdega ah ee Bakhaarka ISP"]

    EoLCheck -->|"Router tafaariiqda: Moodelku waa dhamaadka-nololeed (EoL / Ma jiraan Cusbooneysiin Firmware ah 2+ sano gudahood)"| ReplaceRouter["Si joogta ah uga saar oo Beddel HARDWARE: Rooteriyeyaasha EoL ee aan la xidhin ayaa dib loo jabin doonaa saacado gudahood marka dib loogu xidho WAN"]

    EoLCheck -->|"Router tafaariiqda: Model si firfircoon loo taageeray"| CleanReflash["1. Soo deji Firmware-kii ugu dambeeyay ee Rasmiga ah ee Nadiif ah Hotspot Cellular. 2. Qabo dib u dajinta biinhole-ka 15-30s (inta lagu shaqaynayo & khadka-la'aanta). 3. Flash Firmware iyada oo loo marayo Ethernet -> Dami UPnP & WAN Admin -> Deji DoH/DoT sir ah"]

Marxaladda 1: Sida loo caddeeyo in DNS-ka ama miiska UPnP ee routerkaaga la afduubay (Audit Forensic)¶

Kahor intaadan tirtirin router-ka, qaado 2 daqiiqo si aad u baarto waxa wax laga beddelay si aad u ogaato in weeraryahanku kaliya sumeeyay DNS (GhostDNS qaabka) ama sidoo kale dekedaha loo gudbiyo shabakadaada gudaha (UPnP / NAT faragelin).

1. Xisaabinta server-kaaga DNS ee firfircoon ee khadka taliska (nslookup / scutil / resolvectl)¶

Fur Terminal ama Command Prompt kumbuyuutarka ku xiran shabakada oo socodsii: - DaaqadahaCommand Prompt / PowerShell:

ipconfig /all
nslookup example.com

scutil --dns | grep 'nameserver\[[0-9]*\]'

resolvectl status

Is barbar dhig DNS Servers Ciwaanka IP-ga waxa soo celiyay routerkaaga oo ka soo horjeeda shaxdan qaabaynta sharciga ah iyo kuwa la afduubay:

2. Xisaabinta routerkaaga UPnP iyo Port Forwarding / Virtual Server Shaxda¶

Markaad gasho interface adminka router kaaga (http://192.168.1.1, 192.168.0.1, 10.0.0.1, ama 192.168.50.1), tag Advanced -> NAT Forwarding / Port Forwarding / UPnP: - Fiiri UPnP Portmap Table (Kirooyinka UPnP ee firfircoon): - Qalabka ciyaarta ee sharciga ah ayaa si ku meel gaar ah u furaya dekedo sare oo UDP ah (sida UDP 3074 loogu talagalay Xbox/Call of Duty). - Calaamadaha tanaasulka firfircoon: Haddii aad aragto UPnP xeerarka u gudbinta dekedaha TCP ee dibadda Port 445 (SMB, Port 3389 (Windows Remote Desktop / RDP, Port 22 (SSH, Port 5000 / 5001 / 8080 (Synology / QNAP NAS, Port 554 (RTSP Security Cameras, ama Port 1080 / 9050 (SOCKS5 Proxy Botnet, malware-ka ku jira shabakadaada (ama WAN UPnP SOAP ka faa'iidayso) wuxuu si toos ah godad uga dhuftay darbigaaga. - Sidoo kale hubi Advanced -> Security -> Remote Management (WAN Access* iyo Firewall -> DMZ: - Xaqiiji taas Remote Management (Galitaanka Shabakadda WAN) waa Naafo (Naafo)OFF* iyo taas DMZ Host waa NaafoBlank / 0.0.0.0). Weeraryahanada jebiya router-ka had iyo jeer way shidaan Remote Management on Port 8080 / 8443 ama geli IP gudaha ah DMZ si ay hadhow dib ugu soo laabtaan.

Wajiga 2: Talaabo-tallaabo ciribtirka router-ka, NVRAM dib u dejin, iyo dib u soo kicin firmware-ka qad la'aanta ah¶

Waligaa si fudud ha u galin router la jabiyay oo nooca 8.8.8.8 dib ugu soo celi sanduuqa DNS iyada oo aan dib loo dejin oo dib loo kicin: haddii weeraryahanku beero a cron shaqada, wax laga beddelay dnsmasq.conf, karti TR-069 (CWMPHabaynta auto-qaabaynta, ama laga faa'iidaysto nuglaanta firmware-ka aan la daboolin, goobta DNS ee rogue waxay soo noqon doontaa isla markiiba 10 daqiiqo ka dib.

Samee soo kabashada qolka nadiifka ah ee 6-talaabo ah:

Tallaabada 1: Soo deji firmware-kii ugu dambeeyay ee rasmiga ah iyo aaladaha KA HOR inta aan la jarin internetka¶

1. Isticmaalka taleefoonka casriga ah ee xogta gacanta (Wi-Fi dansan) ama kombuyuutar ku xidhan barta gacanta ee taleefankaaga:
2. Fiiri dhejiska jireed ee ku yaal xagga hoose ee routerkaaga oo akhri saxda ah Lambarka Moodelka IYO ** Dib-u-habaynta Qalabka (Hardware Revision)Ver: 1.0, v2, v4.20)**. * (Foosh Hardware v1 firmware gal a v2 router ayaa ku dhufan kara.)*
3. Si toos ah ugu tag website-ka rasmiga ah ee soo saaraha (asus.com, tp-link.com, netgear.com, linksys.com, ui.com) oo soo deji ** firmware-kii ugu dambeeyay .zip kaydi *** kumbiyuutarkaaga.
4. Soo saar .zip file si aad u hesho ceeriin .bin, .chk, .trx, ama .img feylka firmware oo diyaar ku ah Desktop-kaaga.

Talaabada 2: Ka saar router-ka WAN (Internet) oo si deg deg ah u kacsan RAM¶

1. ** Ka saar WAN Fiberka Ethernet *** (fiberka ka imaanaya fiber-kaaga ONT ama cable modem galay buluug/jaalle Internet / WAN dekedda on your router).
2. ** Dhammaan ka saar LAN Xadhkaha Ethernet** marka laga reebo hal Laptop/PC ah oo nadiif ah (Wi-Fi-giisuna dansan yahay).
3. Ka saar xadhkaha korantada ee 60 ilbiriqsi oo buuxa: Tani waxay si buuxda u sii daysaa capacitors-ka Motherboard-ka oo waxay baabi'isaa malware kasta oo ku socda Marxaladda 2/Stage-3 /tmp RAM.

Tallaabada 3: Samee Hardware sax ah NVRAM Dib-u-dejinta Warshada (iyo sababta looga fogaado 30-30-30 router casri ah)¶

1. Ku soo celi xadhigga korantada ee router-ka (ku hayso WAN fiilada internetka ** la furay ***) iyo ** sug 2 daqiiqo oo buuxa ** ilaa routerku dhammeeyo kor u qaadista gabi ahaanba.
2. Adigoo isticmaalaya xaashida ama aaladda SIM-jector, taabo oo qabo inta harsan Reset badhanka pinhole ee gadaasha router:
3. Heerka U-Boot / Routers Linux Casriga ah (ASUS, TP-Link, Netgear, Linksys, Ubiquiti, Synology, Eero*: Qabo Reset button continuously for 15 to 30 seconds while the router is powered on until all LED lights blink rapidly or turn amber, then release the button and wait 3 minutes for the router to reboot with a wiped NVRAM qaybsasho.
4. ASUS Specific "Hard Factory Reset" (NVRAM + /jffs Partition Wipe): On ASUS routers (RT-AX, RT-BE, GT-AX series), malware or rogue scripts can hide inside the persistent /jffs flash partition which survives a normal reset. To wipe both NVRAM iyo /jffs on an ASUS router:
   1. Turn the router power OFF.
   2. Press and hold the physical WPS button (not the Reset button).
   3. While holding the WPS button, turn the router power ON.
   4. Keep holding WPS for 15 seconds until the Power LED starts flashing quickly, then goes dark/reboots, and release. This executes a hardware-level NVRAM + /jffs erase.

Step 4: Reflash the firmware offline and lock down the administration plane¶

1. On your Ethernet-connected computer, open a private/incognito browser window and go to the router's default IP (http://192.168.1.1, 192.168.0.1, ama 192.168.50.1).
2. Complete the initial setup wizard offline and immediately set a unique, 20-character Administrator Password (never reuse your Wi-Fi password as the router Admin password).
3. Go to Administration / System -> Firmware Upgrade -> Manual / Local File Upload, select the official firmware file you downloaded in Step 1, and flash it. Even if the version number is the same as what was already installed, reflashing overwrites the rootfs system image and verifies the cryptographic firmware signature.
4. Once the router reboots after the firmware flash, verify these 6 Mandatory Hardening Settings before plugging the internet cable back in:
5. UPnP (Universal Plug and Play): Set to DISABLED / OFF.
6. Remote Management (WAN Web Access / HTTPS from WAN / SSH from WAN): Set to DISABLED / OFF.
7. TR-069 / CWMP (On Retail Routers): Set to DISABLED / OFF (unless required by a fiber ISP gateway).
8. WPS (Wi-Fi Protected Setup PIN / Pushbutton): Set to DISABLED / OFF.
9. Wi-Fi Security: Set to WPA3-Personal (or WPA2/WPA3-Personal AES; never WPA/TKIP ama WEP) with a brand-new Wi-Fi passphrase.
10. WAN DNS Server: Manually set Primary DNS to 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9 Malware-Blocking DNS) and Secondary DNS to 1.0.0.1 or 149.112.112.112 (and enable DNS-over-TLS / DoT on the router if supported).
11. Plug the WAN (Internet) cable back into the router.

Phase 3: Flushing poisoned DNS caches on all devices and enabling Encrypted DNS (DoH / DoT)¶

Even after your router is 100 percent clean, any laptop, desktop, or smartphone that was connected during the hijack may still hold poisoned DNS records (TTL ilaa 7 maalmood), mid maxalli ah hosts file, or a poisoned browser socket pool.

Tallaabada 1: Hubi deegaanka hosts file and flush OS + Browser DNS caches¶

1. **Verify malware did not write fake entries into your computer's local hosts file ***:
2. **Daaqadaha ***: Fur notepad maamule ahaan oo fur C:\Windows\System32\drivers\etc\hosts. Khad kasta oo ku jira default default hosts faylka waa inuu ku bilowdaa # (faallo). Tirtir khariidad kasta oo khariidaynta magacyada domainka dhabta ah (google.com, microsoft.com, goobaha bangiyada, ama goobaha antivirus) ciwaannada IP-ga ee qariibka ah.
3. ** macOS / Linux ***: Hubi cat /etc/hosts gudaha Terminalka.
4. ** Dareemi nidaamka hawlgalka DNS iyo kaydka ARP ***:
5. DaaqadahaRun Command Prompt as Administrator*:

   ipconfig /flushdns
   ipconfig /release
   ipconfig /renew
   arp -d *
   

6. ** macOS (Terminal***:

   sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
   

7. iPhone/iPad/Android: Daar Qaabka Diyaaradeed 15 ilbiriqsi, damise dami, oo Ilow oo dib ugu biir shabakada Wi-Fi
8. ** Daadi Chrome, Edge, iyo Brave Internal browser DNS & Caches Caches ***:
9. Darowsarrada Chromium waxay ilaashadaan kaydkooda DNS ee gudaha ka madax banaan Windows/macOS.
10. Fur Chrome, Edge, ama Brave -> nooca chrome://net-internals/#dns gudaha ciwaanka -> guji Clear host cache.
11. Marka xigta, dhagsii Sockets dhinaca bidix ee dhinaca bidix (chrome://net-internals/#sockets) -> guji Close idle sockets iyo Flush socket pools.

Talaabada 2: Ka yeel DNS sir ahDNS-over-HTTPS / DoH iyo DNS-over-TLS / DoT) markaa router yuusan mar dambe afduubin DNS kaaga¶

DNS-dhaqameedka (UDP port 53) gabi ahaanba waa mid aan qarsoodi ahayn oo aan la hubin: router kasta oo la dhibay, ISP, dukaan kafeega Wi-Fi, ama albaabka hudheelka ayaa kaa qaban kara dekedaada 53 codsi oo been abuur ah jawaabo been abuur ah. Dajinta DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) waxay ku duubtaa su'aalahaaga DNS gudaha TLS 1.3 sireed lagu xaqiijiyay shahaado qarsoodi ah, taasoo la macno ah **xitaa haddii routerkaaga la jabsado, ma akhrin karo mana beddeli karo hal DNS raadin ***:

Marxaladda 4: Baadhitaanka qalabka gudaha ee la kashifay intii lagu jiray UPnP furnaa (NAS, Camerasiyo RDP)¶

Haddi hantidhawrka routerkaaga ee Wajiga 1 uu shaaca ka qaado ** mid aan la ogolayn UPnP hore u marsada** (ama DMZ soo-gaadhista) waxa uu ahaa mid firfircoon ka hor inta aanad dib u dejin router-ka, waa in aad xaqiijisaa in weeraryahanadu aanay saldhig ka dhigin qalab gudaha ah halka dekedaha dab-damiska ay furnaayeen:

1. ** Hubi Guriga / Xafiiska Qalabka NAS (Synology DiskStation, QNAP, TrueNAS***:
2. Fur guddiga kontoroolka NAS -> Security Advisor / QuFirewall / Connection Logs.
3. Ka raadi isku-dayga gelitaanka maamulaha ee guul-daraystay ama guulaystay ee cinwaannada IP-ga ee ajnabiga ah, koontooyinka maamulka ee dhawaan la sameeyay, ama lama filaanka ah ee la qorsheeyay cron hawlaha.
4. Gudaha NAS settings (Control Panel -> External Access -> Router Configuration), ** si toos ah uga saar dhammaan UPnP sanduuqyada habaynta router** sidaa darteed NAS waligeed iskuma dayin inay furto dekedaha router mar kale.
5. ** Ka hubi Windows PC-yada RDP (Port 3389) Dulqaad Xoog-Cusub ***:
6. Hadii TCP 3389 ka soo muuqday routerkaaga UPnP miiska, fur Windows ** Daawade Dhacdadaeventvwr.msc*** -> Windows Logs -> Security oo shaandheeya Event ID 4624 (Logon Guul leh, Nooca Logon 10 Remote Interactive) iyo Event ID 4625 (Failed Logon).
7. Dami Desktop-ka fog ee Windows (Settings -> System -> Remote Desktop -> OFFHaddii aan si adag looga helin mesh VPN-ka-saaxiibka ah (Per-to-peer mesh)Tailscale, WireGuard, ama ZeroTier).
8. ** Ka go'doom TV-yada casriga ah, kamaradaha IP-ga, iyo aaladaha IoT ee Shabakadda Wi-Fi ee martidaVLAN / AP Isolation***:
9. Inta badan gudaha UPnP Waxyeellada router-ku waxay ka timid kamarad IoT ah oo jaban, plug smart, ama sanduuqa TV-ga Android ee shabakadda Wi-Fi-gaaga ugu weyn ee ku biira botnet oo soo dira UPnP IGD amra in 192.168.1.1.
10. Daar router kaaga Shabakadda Wi-Fi Martida leh Access Intranet / Allow guests to see each other and access my local network dhigay OFF (Client Isolation, oo dhaqaaji dhammaan TV-yada Smart, kamaradaha, faakuumyada robot-ka, iyo aaladaha caqliga leh SSID-ga martida ah ee go'doonsan si aysan waligood ula hadlin routerkaaga LAN maamulka IP192.168.1.1) Ama laptop-kaaga shaqada mar kale.

Su'aalaha soo noqnoqda¶

Sidee buu jabsadahu u bedelay goobaha DNS ee ku dhex jira router gurigayga haddii aanay ku fadhiyin gurigayga Wi-Fi-gayga?¶

Weeraryahanadu waxay meel fog wax u dhimaan guryaha iyo xafiisyada yar-yar iyaga oo aan waligood ka ag dhowaan Wi-Fi-gaaga iyagoo isticmaalaya saddex hab oo aasaasi ah: (1) Codsiga Been-abuurka ee GoobtaCSRF) iyo dib u soo celinta DNS: Waxaad booqatay shabakad caadi ah oo ay ku jirto qoraal xayaysiis xaasidnimo leh markaad ku jirto kombayutarka gurigaaga; qoraalkaasi wuxuu si aamusnaan ah ugu soo dirayaa codsiga HTTP POST biraawsarkaaga si toos ah routerka deegaankaaga (http://192.168.1.1/apply.cgi), iyo haddii routerkaaga uu wali isticmaalo erayga sirta ah ee caadiga ah (maamulka / maamulka ama maamulka / erayga sirta ah), qoraalku wuxuu dib u qoraa WAN DNS server-ka routerkaaga 1 ilbiriqsi gudahood. (2) Maaraynta WAN ee la kashifay ama TR-069 (Dekedda 7547/8080/8443)Sawir-qaadayaasha internet-ka ee otomaatiga ah waxay helayaan router-yada Maamulka fog-fog ee ka tagay dayacanka firmware-ka oo furan ama aan la daboolin oo amarrada si toos ah uga duraya internetka; iyo (3) UPnP Muujinta WAN: Router-yada da'da weyn ama khaldan ayaa si lama filaan ah u kashifaya UPnP SOAP daemon (dekedda 1900/5000) interface-ka WAN, taas oo u oggolaanaysa qof kasta oo internetka ku jira inuu ku daro xeerarka gudbinta dekedda ama isbeddelka SetDNSServer goobaha bilaa sirta ah.

Maxaad u tidhi "30-30-30 Hard Reset" caanka ah kuma shaqeeyo router-yada casriga ah oo dhab ahaantii waxay keeni kartaa dhibaatooyin?¶

The 30-30-30 dib u habeyn (qabsashada Reset 30s oo koronto leh, 30s oo koronto leh, iyo 30s marka dib loo shido) waxaa la qoray 20 sano ka hor si gaar ah Linksys WRT54G router-ku waa socdaa DD-WRT ee Broadcom CFE bootloaders. Ku dhawaad router kasta oo casri ah oo la soo saaray 12-kii sano ee la soo dhaafay (ASUS, TP-Link, Netgear, Linksys Velop, UniFi, MikroTik), adigoo hoos u haya badhanka Dib u dejinta marka la xidho xadhigga korontada waa kiciye hardware si uu u joojiyo boot caadiga ah oo galo Bootloader TFTP Habka Soo kabashada Firmware (halkaas oo iftiinka korontadu uu si tartiib ah u biligleeyo isagoo sugaya server-ka TFTP, iyo NVRAM waa maaha gebi ahaanba la tirtiray). Si sax ah loo tirtiro NVRAM dib ugu noqo khaladaadka warshadda ee router kasta oo casri ah, xadhkaha korantada ha ku xidho inta uu routerku si buuxda u korayo, Hay biinanka Dib u dajinta 15 ilaa 30 ilbiriqsi ilaa nalku ka iftiimaan, oo u ogolow inuu iskii dib u bilaabo.

Haddaan curyaamiyo UPnP (Universal Plug and Play) dhanka routerkayga amniga, miyay jebin doontaa shaqadayda wicitaanada Zoom, Netflix streaming, ama browsing web?¶

Maya, curyaaminta UPnP wax saameyn ah kuma leh Zoom, Kooxaha Microsoft, Netflix, YouTube, Slack, iimaylka, ama daalacashada webka. Dhammaan codsiyada internetka ee caadiga ah ayaa bilaabay dibadda u baxay Isku xirka qalabkaaga iyo server-ka daruuraha, kaas oo Kormeerka Xirmada Gobolka ee routerkaaga (SPINAT firewall si otomaatig ah ayey u qabataa la'aanteed UPnP. The kaliya waxyaabaha isticmaala UPnP waa ciyaaraha konsole-ka-ciyaaraha badan ee fac-ilaa-faca (PlayStation, Xbox, Nintendo Switch hosting lobbies), macaamiisha BitTorrent, iyo server-yada iskood isu martigeliyay (Plex) isku dayaya in uu aqbalo iyada oo aan la codsan soo galaysa isku xirka shisheeyaha ee internetka. Tagitaanka UPnP jeestay DAMN waxaa ku taliya NSA, CISAiyo FBI because it prevents malware or rogue IoT devices inside your home from secretly opening firewall ports to the public internet.

What if my router is a rented ISP combo modem/gateway (like Comcast Xfinity xFi, AT&T BGW320, or Spectrum) and it won't let me change the DNS servers or flash firmware?¶

Many ISP-supplied gateway modems lock down the WAN DNS fields in the web interface so customers cannot change them, and manage firmware exclusively over the ISP's coaxial/fiber headend via DOCSIS ama TR-069. If an ISP-rented gateway is exhibiting rogue DNS behavior or unauthorized port forwards: (1) Hold the physical recessed Reset pinhole on the back of the ISP gateway for 20 to 30 seconds to force a factory reset and fresh DOCSIS / ONT bootfile download from your ISP; (2) Log into your ISP mobile app (Xfinity, SmartHomeManager, My Spectrum) to change your account password and review any app-configured Port Forwards; and (3) Configure Encrypted DNS (DoH / DoT) directly on your laptops, phones, and browsers (as shown in Phase 3 above), or put the ISP gateway into Bridge Mode / IP Passthrough Mode and connect your own secure retail router behind it.

Tilmaamaha la xidhiidha¶

• Afduubka DNS, ISP router WAN dib-u-habaynta, iyo xadhkaha goosashada
• Compromised home or small office NAS (QNAP/Synology), DeadBolt ransomware, and UPnP port forwarding shutoff
• Securing home routers and IoT devices
• Fake CAPTCHA ClickFix PowerShell Win+R clipboard malware and Lumma infostealer remediation
• Zero-day exploit emergency patching and End-of-Life (EoL) device isolation
• Nambarada degdega ah wadan ahaan

Ilaha iyo hanuuninta rasmiga ah¶

• National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA Joint Cybersecurity Information Sheet - media.defense.gov): Best Practices for Securing Your Home Network (Disabling UPnP, WAN Maamulka, Dhaxalka WPS, iyo Beddelida Dhamaadka Nolosha SOHO Routers).
• Xafiiska Baarista FederaalkaFBI Public Service Announcement I-052518-PSA & KV-Botnet / RaptorTrain Advisories): Foreign Cyber Actors Targeting Home and Office Routers: Immediate Reboot to Flush Stage-2 RAM Payloads, Factory Reset, and Firmware Upgrade Protocol.
• Internet Engineering Task Force (IETF RFC 8484 - DNS Queries over HTTPS (DoH) & RFC 7858 - Specification for DNS over Transport Layer Security (DoT)): Cryptographic Authentication and Integrity Protection of Stub-to-Recursive DNS Resolution.
• ASUS, Netgear, and TP-Link Official Security Advisories: Hardware NVRAM iyo /jffs Partition Factory Reset Procedures vs. U-Boot / CFE TFTP Recovery States.