said by Eth_Rem:It’s pretty scary to think that this malware manages to obtain root access and the primary infection vector hasn’t been found - or if it has, it hasn’t been publicly disclosed. I mean, ASUSWRT being vulnerable is a pretty serious feat...
There does not appear to be any single 'primary vector'.
Some use of default user/password has been confirmed but otherwise the actual methods of infection have not been otherwise definitively confirmed.
For the most part devices that have been infected have either had the default username and password (apparently a large number in fact) or have outdated firmware that has well-known vulnerabilities. In other words - devices that have not had their firmware updated to the latest, leaving them exposed to those vulnerabilities that are now well-known and that have functional exploits. This detail has been disclosed, even with the first announcement.
Most of the devices found infected so far don't really use a segregated privilege model - any access is privileged. In other cases there are exploits that can may bypass privilege separation.
If your device is still supported by the vendor, has its firmware up-to-date with the latest available, and you have changed the default username/password you are likely safe. The last reports I had seen indicated that devices that followed these best-practices did not appear to be among those infected.
