JioFiber Gateways actively brute force and surveil your LAN

[techworId 27]

A recent security blog Allot-Deepdive exposed that Jio’s base firmware includes a hidden component called "Allot HomeSecure" (cyberiotUserAgent). It acts as a persistent network scanner, brute-forcing SSH/Telnet on your internal LAN devices and exfiltrating credentials to Microsoft Azure C2 servers.

What the original blog missed: To ensure it sees all your network traffic, the firmware disables WiFi AP Isolation. This allows its DPI kernel module to act as an active wiretap on inter-device traffic (e.g., your laptop talking to your NAS). It also uses specific CPU affinity and throttling policies to hide its resource usage, so you don't notice the slowdown.

The Fix (No Root/SSH Required): Jio claimed there was no UI to turn this off, but they just hid the page from the menu.

1. Log into your Jio Router’s Web GUI (Admin).
2. Go to the Search bar in the settings.
3. Type allot and click on the result.
4. This loads a hidden page (allot.html). Flip the toggle to OFF / Disable and click Save.

This writes a 0 to the internal SQLite database, permanently killing the agent persisting across reboots.

 

[techworId 27]

cyberIOT payload tar
This is the latest cyberIOT payload

 

[nando]

Is it only doing this wireless because I have connected my own router to jio router via lan cable and have never seen any ssh brute force logs in it.

 

[techworId 27]

No, it also looks at DNS requests and TLS handshakes. You are safe from WLAN AP isolation, but if your router uses Jio's DHCP instead of its own DHCP, then other than the AP isolation everything else remains the same. Jio might have stopped the SSH brute-forcing after the initial report (I too didn't see any authentication logs from it) but reverse engineering the binaries reveals functions related to SSH authentication and brute forcing. Even if your router uses its own DHCP, the DNS requests will go through the Jio Gateway and cyberiot's kernel agent will look at it

 

[nando]

@techworId 27 Im using cloudflare dns in my router, disabled 2.4ghz radio in jio router, only 5ghz is enabled

 

[techworId 27]

You are still affected. Even though you are using 2.4 GHz on your own router, you are connecting to Jio for 5 GHz, which has AP isolation enabled. On top of all this, the DNS requests still go to Cloudflare through Jio and since it is not encrypted, the cyberIOT agent will inspect it

 

[techworId 27]

I made a typo in my initial post, the Gateway enables AP isolation to inspect packets between WLAN devices

 

[nando]

disabled allot

 

[naitik1203]

Bruh, I use Adguard Home as my DNS server and both DHCP server on JF ONT (benefits of rooting)