Hackers Hijack D-Link, Ubiquiti Devices to Resell Your Stolen Bandwidth
Hackers use proxyjacking to monetize stolen internet connections through legitimate proxy apps on compromised devices.
Intelligence analysis by Qwen 2.5 (3B)
Hackers exploit vulnerabilities in D-Link and Ubiquiti devices to install apps that allow them to resell stolen internet bandwidth.
Hackers tricked devices into letting them use their internet, then sold it to others. It's like if someone tricked your TV into showing their ads instead of yours.
Analysis
{"heading_1":"The Attack Mechanism","subheading_1":"Vulnerabilities Exploited","content_1":"The attackers leveraged three vulnerabilities: CVE-2024-3272 and CVE-2024-3273 in D-Link ShareCenter NAS, CVE-2021-44228 in Ubiquiti UniFi Video NVR, and CVE-2025-31324 in SAP NetWeaver Visual Composer.","subheading_2":"Device Compromise","content_2":"The attackers installed Pawns.app, a legitimate bandwidth-sharing application, on compromised devices without the owners' consent. They configured SSH key authentication as a backup access method.","subheading_3":"Monetization","content_3":"The attacker likely accumulated larger payouts by installing the app on multiple systems. Pawns.app account holders are rewarded for allowing traffic from other users to flow through their network, provided it runs on trusted, non-blocking IP addresses."}
Key points
- Hackers use vulnerabilities in IoT devices to install apps for proxyjacking.
- Pawns.app is a legitimate app that allows users to earn money by sharing their internet.
- SSH key authentication was used as a backup method for access.
Users can protect themselves by keeping their devices updated and using strong passwords.
Hackers might find new vulnerabilities, and devices might still be compromised even with updates.
