19 ms·
FBI tells router users to reboot now to kill malware infecting 500k devices
- degenerate 8y ago"There's no easy way to determine if a router has been infected. It's not yet clear if running the latest firmware and changing default passwords prevents infections in all cases." Antivirus provider Symantec issued its own advisory Wednesday that identified the targeted devices as: Linksys E1200 Linksys E2500 Linksys WRVS4400N Netgear DGN2200 Netgear R6400 Netgear R7000 Netgear R8000 Netgear WNR1000 Netgear WNR2000 QNAP TS251 QNAP TS439 Pro TP-Link R600VPN
- jlgaddis 8y agoMikrotik devices were reportedly affected as well, although I haven't seen any specific model identified (they all run pretty much the same software, although various models are based on different CPU architectures).
- TeMPOraL 8y agoI've read three articles about this today (this one included), and they all specified the same Mikrotik models: - Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072
- jlgaddis 8y agoYou're right, I just got down to the bottom of the article and those models are listed there. I don't recall what article I read a day or two ago, but I don't believe it mentioned the specific models.
- dboreham 8y agoAs GP says, MT boxes all run the same software. The latest release (6.42.3) dated May 24 has suspiciously few bugfixes listed in the changelog. Probably worth updating on the basis the vulnerability fix is in there too.
- pilsetnieks 8y agoThe original Cisco article mentions that these aren't all of the vulnerable models, just the ones they've seen. There isn't anything fundamentally different between a 1009 and a 1016.
- sudouser 8y agodamn, enterprise I used to work at uses mikrotik for critical services...
- pilsetnieks 8y agoSo critical that they'd leave the web interface running on public IPs without firewalling? If not then they're probably safe.
- dboreham 8y agoIs it known that the vulnerability is in the web UI? I ask because the CERT report advised to disable/ACL web UI but it didn't (afaik) say that this was the attach vector. They might have just thrown that in as sound general advice.
- frankzinger 8y agoFrom their official forum post[1]: "Your devices are safe if the port 80 is firewalled, or if you have upgraded to v6.38.5 or newer." [1] https://forum.mikrotik.com/viewtopic.php?f=21&t=132499 https://forum.mikrotik.com/viewtopic.php?f=21&t=132499
- MikusR 8y agoUsing a vulnerability fixed last March.
- ehsankia 8y agoWhat about if you were running a custom firmware like Tomato? I'm surprised there's still so little info on this.
- djrogers 8y agoHeadline is a bit incorrect - a reboot will interfere with the malware by restarting the it’s C&C process, which the FBI now controls. This does not eliminate the malware, but it will stop it’s data collection and makes it more difficult for an adversary to activate it on a large scale.
- lobo_tuerto 8y agoWhat about a factory reset? (by pressing on the pinhole button for a few secs)
- drchiu 8y agoA factory reset, according to Cisco, will fix it. Correction: according to the original report a reset will mitigate the stage 2 and 3 attack only Source: https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=1 https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=...
- isostatic 8y agoAccording to talos, a reboot will remove stage 2 and 3 but not 1. It's not clear how stage 1 installs. Is it into the (hidden) base Linux install in rc.local or whatever, does it get into the bios/firmware of the computer.
- WalterBright 8y agoIt's really too bad that nobody makes hardware with the obvious solution - put the firmware in ROM. Then it cannot be altered by malware. If the vendor really, really wants to update the firmware, have the write-enable switch be a physical one, not a software switch.
- ryanmarsh 8y agoMind boggling this isn’t the default.
- ComodoHacker 8y ago
- JeanMarcS 8y agoHow comes that this kind of information seems to only alerte US officials ? Is it targeted only on US soil ? I really doubt that. Why does EU (for example) authorities not warning their citizens ?
- wil421 8y agoI can find some articles about Interpol/Europol taking down botnets.[1] The US and Russia are probably more advanced than the EU in this regard. I wouldn’t put the UK or China too far behind. Maybe the FBI works closer to manufacturers or victims? I’ve had a freind who got some Wordpress he managed sites infected. He was able to trace it back to a professor in Turkey and call the FBI. The FBI came and interviewed him. [1]https://www.interpol.int/News-and-media/News/2015/N2015-038 https://www.interpol.int/News-and-media/News/2015/N2015-038
- blattimwind 8y agoModem-routers often have subtly different models (sometimes even under the same model number and SKU!) in different regions. "Subtly different" can mean in this instance: completely different OS, different chipset/hardware/board supplier etc. It's possible that the models affected by this particular attack aren't sold in other places, or perhaps they are, but are actually still different (enough). Or they are just not widely used. I say this because govt. organisations have often issued warnings and recommendations like this in similar circumstances, e.g. a while ago some modem-routers widely used in this country were attacked, and a warning very much like this has been issued.
- ddtaylor 8y agoThe US agencies have a very close relationship with router manufacturers. TCP 32764 for example was a backdoor many suggest they used cover ops to create and exploit.
- bsamuels 8y agothat's quite the stretch since the TCP 32764 issue was unique to sercomm routers, which is a Taiwanese router ODM. they write the firmware and create the hardware, then rebrand the UI for however linksys/netgear/whoever wants it.
- jacksmith21006 8y agoGlad now have Google WiFi. Most secure consumer router you can get, imo.
- nfoz 8y agoHow would you know if this were true? Is it just branding/reputation? I use a peplink, which doesn’t target the “consumer” market. Is that better? Seems impossible to know.
- crankylinuxuser 8y agoThe more it seems, is that I should run my own freebsd or centos linux router, and turn on the full compliment of security (Selinux, aide, firewalld, etc) and run my own. And put Openscap on there and use the US government configuration base remediation. Itd be painful to setup initially, but once setup should be rock solid.
- jacksmith21006 8y agoGoogle WiFi would give you a more secure solution. Google has a hardware token in the Google WiFi locked to the stored image and that is locked to the running image. So things like this hack would be exposed. But then Google keeps them up to date. But the other is Google has now found Shellshock, Heartbleed, Meltdown, Cloudbleed, Spectre among several other big ones and just invest far more in security than anyone else. They find these problems before anyone. Plus they write them up and highly recommend a few of their blog posts. A great one is their write up on the Broadpwn vulnerability.
- tonyztan 8y agoAccording to Google, their consumer routers get automatic security updates.[1] While I don't necessarily trust everything that Google says, I do believe in their ability to secure devices better than most other consumer router vendors. [1] https://support.google.com/wifi/answer/6309220?hl=en https://support.google.com/wifi/answer/6309220?hl=en
- 8y ago
- ashleyn 8y agoIf you're infected, you need a new router. Period. Telling people that they can resecure their routers with just a reboot is irresponsible.
- Godel_unicode 8y agoThe reboots are about making the infected routers hit the C2 server so that ISPs can identify and notify users whose routers were infected.
- beager 8y agoIt’s the most accessible way to do it. Most people don’t buy their routers, they lease from the ISP. Major ISPs replacing 100k+ devices will take a while and they’ll drag their feet. FBI commandeering the C&C domain and instructing users to reboot is not the long term fix but it is most effective
- userbinator 8y agoI wonder how the cost-benefit analysis goes between creating yet more e-waste, and letting some malware persist...
- ashleyn 8y agoIt'd be a lot better of a situation if router boards were designed to accept firmware upgrades at a low level. After an attack, you often need to use the software updater to reset it. That can no longer be trusted if it's compromised. Consumer-level routers have been very low-quality for quite a while.
- zackmorris 8y agoDoes anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? At the very least there should be some kind of policy or standard that allows someone on the inside of the network to know if the password or software has been changed. If the FBI can tell from the outside, then how in the world are people still in the dark about this?
- ddtaylor 8y ago> Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? Sometimes the router companies are cover ops like TCP 32764
- jlgaddis 8y agoBecause, just like GPL'd software, they all come with a "no warranty, expressed or implied" disclaimer attached?
- Nomentatus 8y agoNot that in common law, some warranties cannot be evaded, such as the goods being fit for use.
- ryanlol 8y ago>Does anyone know why router manufacturers aren't financially responsible for the exploits that allow their devices to be hacked? Because there is no law that says so?
- charonn0 8y agoThis would/could fall under negligence and/or strict liability torts.
- personjerry 8y agoNo tool manufacturer is responsible for the outcomes of their tools (except the particular function they intended as a warantee)
- ronjouch 8y agoWhat's a good affordable router well supported by Tomato/OpenWRT, these days? (put differently: 2018's version of the Linksys WRT54G :) From what I understand, alternative firmwares like Tomato & OpenWRT are not inherently safe from VPNFilter, but it seems to me the rate at which they are maintained make them less easy targets (?). So this new flaw made me think now is a good time to replace my crappy router and its unmaintained vendor firmware with something more solid running Tomato/OpenWRT. Disagreements?
- wrycoder 8y agoJust search for WRT54GL on Amazon. It's selling for $34.99, which is pretty affordable. N.B. the WRT54G doesn't work with Tomato.
- aesclepius 8y agoA cheaper, and better (longer 5ghz and 2.5 ghz) option is the Archer C7 router as well.
- polshaw 8y agoThe problem with that being a lot of people's internet is now faster than 54mbit
- supertrope 8y ago802.11g actual max throughput is 22Mbps, assuming you don’t live in an apartment.
- wpdev_63 8y agoDoes anyone know if this affects routers flashed with LEDE/DD-WRT?
- Kenji 8y agoYes and how do we find out if we're infected? It can't be that hard, now can it? Once you know what you have to be looking for - it has to be some kind of file or altered binary since stage 1 is persistent.
- mikehotel 8y agoForums don't have anything definite yet, but you can check existing network connections (netstat/iftop) and block the known CC domains. https://forum.lede-project.org/t/cert-advisory-vpnfilter-destructive-malware/14766/5 https://forum.lede-project.org/t/cert-advisory-vpnfilter-des... A comment on another forum suggests OpenWRT/LEDE is not affected due to file system layout differences: https://nakedsecurity.sophos.com/2018/05/23/vpnfilter-is-a-malware-timebomb-lurking-on-your-router/#comment-5082031 https://nakedsecurity.sophos.com/2018/05/23/vpnfilter-is-a-m...
- trumped 8y agoAsus is not affected by this but it I still updated the firmware because it was affected by multiple other vulnerabilities... I wonder if computing we'll become secure before I die...
- thrillgore 8y agoIt's an arms race at this point -- exploits are weapons.
- kode4 8y agoI was wondering about this so that is good to know, thanks. My Asus router was also updated for multiple other vulnerabilities. I really think Asus has been doing a great job with pushing regular updates.
- riffic 8y agoConsumer routers should be self-updating, along the lines of the CoreOS Update Philosophy: https://coreos.com/why/#updates https://coreos.com/why/#updates
- tehlike 8y agoAll connected devices should be similar. IoT included.
- remir 8y agoAbsolutely. How many smartphones, Smart TVs, old routers, etc, are out there running insecure software? A shit ton. This is insane.
- tehlike 8y agoThere is a _huge_ business opportunity for the entrepreneurial mind. Auto update of firmware with proper monitoring and health checks as the roll out continues.
- exikyut 8y agoYes, technically; the reason it doesn't exist is that "proper monitoring" would highlight how atrocious everyone's development practices are. Oh, and this would accidentally plug all the holes "everyone" variously uses when they're found helpful... generally you want to attract military funding, not scare it away :D
- tehlike 8y agoHeh, probably. I don't know if i agree on your point about companies' development practices. Basic monitoring is very simple to add. I thought what'd a very basic monitoring & release for a self driving car would look like: Below could be measured as A/B experiment - (control 1% on old release, experiment 1% on new release). 1. Number of miles driven 2. Number of user intervention. 3. Score rating (assuming users give a rating for their comfort after reach ride). 4. Number of rides completed. 5. Average/median speed driven 6. Average/median G change (like too much breaking would cause a change in G-force user is enforced to). 7. Average/median time-to-destination etc. The data is already available and collected, what's missing is a way that's plug&play for these companies to push the data and necessary dimensions and integrate them into their roll outs. You can find such metrics for almost all internet-connected device. Make a dashboard out of this, give a way to slice data, give visualization tools and a way to query it out, and this is a winner.
- joshe 8y agoI wonder if sometime we'll need to cause a power outage to reboot routers and internet of things products.
- ge0rg 8y agoFeds take aim at potent VPNFilter malware allegedly unleashed by Russia. [..] to counter Russian-engineered malware that has infected hundreds of thousands devices. I'm interested in the evidence for this attribution. Both ars and dailybeast [0] are pointing to Russia, but the only specific hints are that it's targeting Ukraine (which might also have to do with the prevalence of vulnerable devices there, we don't know that), and that it shares code with the BlackEnergy bot builder toolkit[1], which apparently can be bought on the black market for a decade already. Neither of the original articles [2,3] mention Russia or any of the Russian APTs, so I'm genuinly interested in better attribution data. [0] https://amp.thedailybeast.com/exclusive-fbi-seizes-control-of-russian-botnet https://amp.thedailybeast.com/exclusive-fbi-seizes-control-o... [1] https://community.rsa.com/thread/186012 https://community.rsa.com/thread/186012 [2] https://blog.talosintelligence.com/2018/05/VPNFilter.html https://blog.talosintelligence.com/2018/05/VPNFilter.html [3] https://www.symantec.com/blogs/threat-intelligence/vpnfilter-iot-malware https://www.symantec.com/blogs/threat-intelligence/vpnfilter...
- themodelplumber 8y agoMakes you wonder how much is protected sources and methods. One good mole (digital or human, really) would make technical analysis a secondary consideration.
- ndesaulniers 8y agoAnother article mentioned an rc4 implementation that had been tied to a previous Russian State sponsored cyber attack. (Sorry, am mobile, don't have the link).
- ge0rg 8y agoYou are right. The not-quite-RC4 implementation is mentioned in the Talos post, and it is originating from BlackEnergy. Talos is referencing a US-CERT report of APT28/29[0], which links an F-Secure whitepaper on APTs using "crimeware"[1]: BlackEnergy is a toolkit that has been used for years by various criminal outfits. In the summer of 2014, we noted that certain samples of BlackEnergy malware began targeting Ukranian government organizations for information harvesting. These samples were identified as being the work of one group, referred to in this document as “Quedagh”, which has a history of targeting political organizations. The only way I see how anybody could conclude from "APT uses a black market toolkit" to "Anybody using this toolkit is that APT" is: clickbait. [0] https://www.us-cert.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf https://www.us-cert.gov/sites/default/files/publications/AR-... [1] https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf https://www.f-secure.com/documents/996508/1030745/blackenerg...
- el-y0y0s 8y agoJust calling out the good guys at Microtik. They patched their router a year before being notified by Cisco.
- tarellel 8y agoAs a Mikrotik devote, I love the active development and patches being pushed for their Packages and RouterBoard. If anyone maintains a Mikrotik router and/or switches and hasn't heard about the vulnerability and actively patched their systems, then they're completely at fault and putting themselves and possibly they're companies at risk.
- dboreham 8y agoIt's also extremely easy to update RouterOS these days : a couple of clicks in winbox and reboot, for example.
- jlgaddis 8y agoJust make sure that you don't end up downloading a few DLLs you weren't expecting. https://securelist.com/apt-slingshot/84312/ https://securelist.com/apt-slingshot/84312/
- jlgaddis 8y agoHonest question: how's their GPL compliance these days?
- severine 8y agoSome info here: https://forum.lede-project.org/t/mikrotik-gpl-source/6750/12 https://forum.lede-project.org/t/mikrotik-gpl-source/6750/12 Which led to this repo: https://github.com/robimarko/routeros-GPL https://github.com/robimarko/routeros-GPL
- dboreham 8y agoIs this posted somewhere? I read the CERT release, TFA, and the MT forums and can't see any reference to a known fixed version. Thanks.
- kfrzcode 8y agoHow can I verify some malicious code is actually present on my router? What does this code do? Could the FBI put their own malicious code on the router, via this supposed exploit? Why should I trust the FBI? Excuse my ignorance but I'm not not going to ask these types of questions. EDIT: After reading a bit - it seems the control is somehow "transferred" to the FBI rather than the malicious actor - any other external agent controlling my software and hardware should be considered a malicious actor from a defensive standpoint, right? Also, I don't buy the "FBI is better" argument, because I'm a skeptic. EDIT 2: Moved the 'Why should I trust the FBI?' question to the end of my opening paragraph because I just want to know more about how a layman should approach verification of this vulnerability other than just "trust the powers that be"
- archgoon 8y agoWhy do you need to trust the FBI? This is a notification of a potential compromise of your security, you can ignore them if you want. "The FBI is advising users of consumer-grade routers and network-attached storage devices to reboot them as soon as possible"
- kfrzcode 8y agoI'm honestly far from a network expert or even engineer - but it seems if there's a vuln that the bad-actor had control over, then the ping-home domain of that vuln is controlled by the FBI, then the FBI is telling me to reboot my router, there is a non-negligible possibility that the FBI has an interest in using that vuln in their favor. Granted I don't know many specifics here but that's why I'm employing the elenctic method.
- badlucklottery 8y ago>Why should I trust the FBI? Because this is their job. And you'll probably need to reboot your router anyway in the near future so why now do it now just in case? >Could the FBI put their own malicious code on the router, via this supposed exploit? Sure. So could space aliens.
- 8y ago
- SG- 8y agoIs it strange that I'm now feeling it would be acceptable for FBI to counter hack these devices with the seized staging domains and somehow patch them?
- partycoder 8y agoNow the real question is why you can exploit routers using EXIF metadata.
- kumarski 8y agoI find shodan.io terrifying. It allows people to see the IP addresses of printers, routers, etc.... at scale. So if a hacker finds a vulnerability, they can really quantify the amount of devices they can attack.
- ravenstine 8y agoI'm amazed at how many people here think that a company should be default responsible for what is essentially a third-party tampering with their product. Unless the problem is a result of negligence, it's unreasonable to say that a company should be automatically responsible, except perhaps if they decide not to address the problem in in future products.
- ggm 8y agoWhat are bugs, if not negligence?
- hmd_imputer 8y agoMy router started acting weirdly about three weeks ago (intermittent disconnections, slow connection etc. ) and then stopped working all of a sudden. I asked for a replacement from the provider and they changed it last week. Now I am freaked out, because if the device was compromised I will need to change all my passwords which is a real pain in the a
- Fej 8y agoVerizon routers not known to be vulnerable? That's a bit surprising, although not so much if a particular country is being targeted.