The miscreants taking credit for knocking image board site 8chan offline, and earlier for taking down Sony's and Microsoft's gaming networks, operates an attack platform powered mostly by thousands of hacked home Internet routers, according to a published report.

The revelation, in an article posted Friday by KrebsOnSecurity , is the latest evidence documenting a big uptick in the hacking of Internet routers. Over the past 18 months, researchers have uncovered several other large-scale attacks on routing devices, including those made by Asus Linksys , and many other manufacturers . Routers are often ripe targets because users fail to change default passwords, and the devices often contain security vulnerabilities that can easily be exploited by attackers halfway around the globe.

Those compromising routers for financial gain appear to be members of the Lizard Squad, a group that operates an online attack service that promises to take down any site a paying customer has requested. KrebsOnSecurity namesake Brian Krebs cited security researchers assisting law enforcement officials investigating the group. The researchers asked to remain anonymous. According to Krebs, the for-hire denial-of-service service is powered by a network of compromised devices that mostly include home routers from around the world that are protected by little more than default usernames and passwords. Krebs wrote:

The botnet is not made entirely of home routers; some of the infected hosts appear to be commercial routers at universities and companies, and there are undoubtedly other devices involved. The preponderance of routers represented in the botnet probably has to do with the way that the botnet spreads and scans for new potential hosts. But there is no reason the malware couldn’t spread to a wide range of devices powered by the Linux operating system, including desktop servers and Internet-connected cameras.

Once considered a novelty hack, router compromises are moving into the mainstream—and for good reason. It's much harder to compromise Windows-based computers now than it was five or 10 years ago. For DDoS campaigns and some other online criminal ventures, router hacks work just as well and are much easier to carry out on a mass scale. Readers are reminded to take a few minutes periodically to review the settings of routers and other Internet-connected devices. In addition to replacing default credentials with strong passwords, users should disable remote administrative capabilities unless they are truly needed. It's also a good idea to review the firmware version powering routers and check to see if there's a security update available.