6 ms·
Headline is a bit incorrect - a reboot will interfere with the malware by restarting the it’s C&C process, which the FBI now controls. This does not eliminate
by djrogers 8y ago
Headline is a bit incorrect - a reboot will interfere with the malware by restarting the it’s C&C process, which the FBI now controls. This does not eliminate the malware, but it will stop it’s data collection and makes it more difficult for an adversary to activate it on a large scale.
- lobo_tuerto 8y agoWhat about a factory reset? (by pressing on the pinhole button for a few secs)
- drchiu 8y agoA factory reset, according to Cisco, will fix it. Correction: according to the original report a reset will mitigate the stage 2 and 3 attack only Source: https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=1 https://blog.talosintelligence.com/2018/05/VPNFilter.html?m=...
- isostatic 8y agoAccording to talos, a reboot will remove stage 2 and 3 but not 1. It's not clear how stage 1 installs. Is it into the (hidden) base Linux install in rc.local or whatever, does it get into the bios/firmware of the computer.
- WalterBright 8y agoIt's really too bad that nobody makes hardware with the obvious solution - put the firmware in ROM. Then it cannot be altered by malware. If the vendor really, really wants to update the firmware, have the write-enable switch be a physical one, not a software switch.
- ryanmarsh 8y agoMind boggling this isn’t the default.
- ComodoHacker 8y agoYou really want vendor to patch vulnerabilities in firmware without pushing any buttons.
- WalterBright 8y agoSo you want the ability to remotely update to protect against the malware being installed via remote update?
- jake_the_third 8y agoAnd you really don't want malicious actors to push malware to vulnerable firmware without pushing any buttons. When firmware can't fully trust itself (and it cant), the correct option is to deffer ultimate judgement and control to the physical owner.
- ComodoHacker 8y agoThis wouldn't work with consumer hardware.
- jake_the_third 8y agoWhy?
- 8bitsrule 8y agoHeh. I'm so old, I can remember that only time, ever, that a vendor sent me an upgrade hardware and a box to return the old one in. (Don't remember which vendor, only that it wasn't a rich one.)
- bumblebritches5 8y ago> Blindly trusting the FBI
- awat 8y agoTrue but it should help since one of the stage 1 C&C’s domain has been seized (by the FBI as you mentioned). https://arstechnica.com/information-technology/2018/05/fbi-seizes-server-russia-allegedly-used-to-infect-500000-consumer-routers/ https://arstechnica.com/information-technology/2018/05/fbi-s...
- djsumdog 8y agoIf they've seized the C&C domain, can't they push an update that disable the malware?
- CapacitorSet 8y agoAs far as I know, they typically won't do this to avoid responsibility for bricking safety- and mission-critical routers.
- asah 8y agoum, few-if-any of the devices on this list are approved for safety- and mission-critical uses.
- caymanjim 8y agoThat would be illegal hacking on the part of the FBI. Do you really want the federal government installing software on your devices?
- votepaunchy 8y agoThe FBI can get a court order authorizing the necessary activities.
- Someone 8y agoI would hope and expect that, at least, they would need a separate court order for every modem. Also, chances are courts would deny them such orders on the grounds that it would be easier for about everyone involved if the FBI just asked the router’s owner to restore its firmware (why would the FBI need a court order against foo because bar hacked its modem?)
- duxup 8y agoIn one case they asked a judge for permission to do just that, but as you cam imagine taking on that responsibility isn't something to do lightly.
- jlgaddis 8y agoSo when these devices reboot, the FBI is now going to have control of ~500,000 home routers? That's, uh, "reassuring".
- ocdtrekkie 8y agoPresumably if they intended to use this maliciously, they wouldn't have told you about it. But in most cases, the FBI having control is still better than a random malicious actor having control, unless you belong to a certain high risk segment of the population. In the long term, you want a fix for your router, or you want a new router. Mine is similar to one of the affected units, enough so that it's likely vulnerable. I'm looking at replacing it.
- lisper 8y ago> unless you belong to a certain high risk segment of the population. I don't think we are so far from the day that "high risk" will mean anyone who opposes the government. > Mine is similar to one of the affected units, enough so that it's likely vulnerable. I'm looking at replacing it. That's probably wise.
- ocdtrekkie 8y agoPeople in an adversarial relationship with the government they live under would definitely be that segment of the population, yes.
- hedora 8y agoSo, 100% of the US population, based on: - the continued militarization of police - classifying 66% of houses as constitution-free border crossings - holding citizens for years without charges or trial - a for-profit prison system that engages in de facto forced labor - criminalizing mental health issues and withholding psychiatric care from insured people. For the record, these things have all been going on for multiple presidential administrations, and have enjoyed bipartisan support.
- deleted 8y ago[deleted]
- Godel_unicode 8y agoAs I say below, a reboot will force the router to hit the now-sinkholed domain. This will let the ISP identify customers with affected equipment and notify them. The core message here that everyone should reboot their router is simple enough to survive on Twitter and be understood, whereas specific instructions about which devices are bad will likely be screwed up.
- ddtaylor 8y agoThey should have exfiltrated to Tor, using a DGA, or a corporate-friendly network like OneDrive.
- SmellyGeekBoy 8y agoThe information is in the article, I don't think the headline is misleading.