Guy accessed remote administration port 4567 on my router. Thanks, Verizon!

Question

Some  dude has been running botnet attacks to gain access to my  Westell 9100 BHR router and this past weekend he was successful:
Oct  9 20:01:39 2010    Inbound Traffic    Blocked - Default policy    TCP 74.125.227.33:80->71.170.238.87:49396 on eth1
Oct  9 20:03:50 2010    Inbound Traffic    Blocked - Default policy    TCP 173.192.226.198:80->71.170.238.87:49487 on eth1
Oct  9 20:04:34 2010    Outbound Traffic    Blocked - Default policy    UDP 192.168.1.3:50018->65.55.158.118:3544 on eth1
Oct  9 20:04:36 2010    Inbound Traffic    Blocked - Default policy    TCP 65.60.38.194:80->71.170.238.87:49497 on eth1
Oct  9 20:04:37 2010    Outbound Traffic    Blocked - Default policy    UDP 192.168.1.3:50018->65.55.158.118:3544 on eth1
Oct  9 20:06:45 2010    Inbound Traffic    Blocked - Default policy    TCP 74.125.227.49:80->71.170.238.87:49534 on eth1
Oct  9 20:07:01 2010    Inbound Traffic    Blocked - Default policy    TCP 78.141.177.62:443->71.170.238.87:49540 on eth1
Oct  9 20:16:35 2010    Inbound Traffic    Blocked - Packet invalid in connection    TCP 77.67.87.105:80->71.170.238.87:49683 on eth1
Oct  9 20:16:37 2010    Firewall Info    Rate Limit    1 messages of type [9] Packet invalid in connection suppressed in 1 second(s)
Oct  9 20:23:25 2010    Inbound Traffic    Blocked - Default policy    TCP 81.200.61.23:60289->71.170.238.87:2439 on eth1
Oct  9 20:23:25 2010    Inbound Traffic    Accepted Traffic - Remote administration    TCP 81.200.61.23:60289->71.170.238.87:4567 on eth1
Oct  9 20:23:25 2010    Firewall Info    Rate Limit    17 messages of type [15] Default policy suppressed in 1 second(s)
Oct  9 20:23:25 2010    Inbound Traffic    Blocked - Default policy    TCP 81.200.61.23:60289->71.170.238.87:4964 on eth1
Oct  9 20:23:27 2010    Firewall Info    Rate Limit    53 messages of type [15] Default policy suppressed in 1 second(s)
Oct  9 20:23:27 2010    Inbound Traffic    Blocked - Default policy    TCP 81.200.61.23:60290->71.170.238.87:4728 on eth1
Oct  9 20:23:27 2010    Inbound Traffic    Accepted Traffic - Remote administration    TCP 81.200.61.23:60296->71.170.238.87:4567 on eth1
Oct  9 20:23:27 2010    Firewall Info    Rate Limit    59 messages of type [15] Default policy suppressed in 1 second(s)
Oct  9 20:23:27 2010    Inbound Traffic    Blocked - Default policy    TCP 81.200.61.23:60289->71.170.238.87:2000 on eth1
Oct  9 20:23:28 2010    Firewall Info    Rate Limit    74 messages of type [15] Default policy suppressed in 1 second(s)
Oct  9 20:23:28 2010    Inbound Traffic    Blocked - Default policy    TCP 81.200.61.23:60290->71.170.238.87:2749 on eth1
Oct  9 20:23:29 2010    Inbound Traffic    Accepted Traffic - Remote administration    TCP 81.200.61.23:60297->71.170.238.87:4567 on eth1
Oct  9 20:23:29 2010    Firewall Info    Rate Limit    74 messages of type [15] Default policy suppressed in 1 second(s)
I went ahead and reset whatever settings he changed, but how do I close this port to prevent this guy from gaining access to my router in the future?

Answer 1

whokebe1 wroteI'm pretty certain I didn't see that bottom entry the previous week. And if you'll notice, I can't undo it without resetting the router.
That certainly doesn't look like anything I've seen VZ add.
I have seen VZ add a UDP from from ANY address / ANY port to DVR port 63145 which effective blocks port forwarding needed for third party VOIP.
VZ recently encrypted the Actiontec config file.  However the config file for Westells remains unencrypted.
If you want to block access to the CPE Management port. 
Save your current configuration to a file.
Open it with a text editor.
About 3/4 of the way down the file you will see the following lines:
(cwmp
    (enabled(1))
Change it to:
(cwmp
    (enabled(0))
That should block remote CPU access.