Asus TUF AX4200 security check

Hello everyone,

I had quite a few very serious security issues some time ago (man in the middle attack), which pushed me to get this router to have a double VPN, in addition to the one on my PC. My router has been suddenly malfunctioning lately, which raised some suspicions. Eventually, I lost access to the internet and had to connect to my router.

Simply connecting to my router was complicated, as the login page wouldn't load. I had to restart the router several times to make it work.

Here is the Syslog file that I managed to extract. Would anyone have the analysis capabilities to tell me if there is anything suspicious, or if I can rest easy?

Thank you.

Syslog file

Does the router run Openwrt ?

Are you sure the issue's with the router, not the client ?

1 Like

There AsusWRT logs

1 Like

Then he's barking up the wrong tree.

@Kalitas:

It appears you are using firmware that is not from the official OpenWrt project.

When using forks/offshoots/vendor-specific builds that are "based on OpenWrt", there may be many differences compared to the official versions (hosted by OpenWrt.org). Some of these customizations may fundamentally change the way that OpenWrt works. You might need help from people with specific/specialized knowledge about the firmware you are using, so it is possible that advice you get here may not be useful.

You may find that the best options are:

  1. Install an official version of OpenWrt, if your device is supported (see https://firmware-selector.openwrt.org).
  2. Ask for help from the maintainer(s) or user community of the specific firmware that you are using.
  3. Provide the source code for the firmware so that users on this forum can understand how your firmware works (OpenWrt forum users are volunteers, so somebody might look at the code if they have time and are interested in your issue).

If you believe that this specific issue is common to generic/official OpenWrt and/or the maintainers of your build have indicated as such, please feel free to clarify.

1 Like

Hello frollic,

In essence, yes it's an openWRT version from Asus, although I haven't personally changed the OS.

May  5 07:05:13 kernel: Linux version 5.4.182 (root@asus) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r0-db7dd77)) #1 SMP Sun Aug 20 02:06:05 CST 2023

Regarding a VPN client failure, it is indeed possible, but when I noticed the amount of text in the Syslog, along with the significant difficulty in reaching the connection interface, I preferred to disconnect everything while waiting to figure out what to do...

in essence it's not Openwrt, it's like Darth Vader, he used to be a person
but he got butchered up, just like the "Openwrt" Asus produced.

2 Likes

No. It's just that Asus developers uses the build system from OpenWRT.

1 Like

Yes, I understand perfectly! I just don't know who to turn to for help. And it would be illusory to believe that Asus could help me.

I simply need an external technical opinion, to know if there is something or not...

unless you install openwrt, we can't really help you

https://openwrt.org/toh/asus/tuf-ax4200.

1 Like

I understand your point of view, but I am not trying to solve a technical problem. I am simply trying to eliminate or confirm a hypothesis. Installing a new OS would amount to destroying evidence if there has been an intrusion.

indeed, but the OS you're asking about, is a black box to us.

if you want to dive deeper into the issue, isolate the router + a client, and see what you can find.
assume the client have to be reinstalled once your detective work's done.

there's https://drivers.softpedia.com/get/Router-Switch-Access-Point/ASUS/ASUS-TUF-AX4200-Router-Firmware-3-0-0-4-388-32271.shtml, mentioning some CVEs, no idea how accurate it is.

1 Like

To answer your question:

No, we do not. We wouldn't know about non-OpenWrt logs.

  • Rebooting official OpenWrt would have destroyed the logs (or "evidence" as you call it) anyways, so this is another indication the software in question isn't similar to OpenWrt
  • You don't trust your router anyway, so I don't understand why you wouldn't desire to flash it with known good firmware

Thank you for the advice anyway

1 Like

This topic was automatically closed after 36 hours. New replies are no longer allowed.